Mervis.info targeted by Flocker ransomware group

• Ransomware group: Flocker
• Country: Czechia
• Sector: Technology
• Announcement date: February 16, 2025

Flocker claims to have compromised Mervis.info

The threat actor known as Flocker has announced on a leak site that it has successfully targeted Mervis.info. In the announcement, the group claims to have compromised the systems of the organization and exfiltrated various types of corporate data. This claim follows a pattern often seen in modern cyberattacks, where threat actors use leak sites to pressure victims by threatening to release sensitive information.

While the announcement has been made public, it is important to note that these claims are currently attributed to the threat actor and have not been independently verified. Such incidents are common in the landscape of double extortion, a tactic where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage during ransom negotiations.

Details of the alleged attack

According to the claims made by the Flocker group, the unauthorized access to Mervis.info systems occurred on February 8, 2025. The threat actor asserts that they have managed to gain access to the internal environment and have since extracted data specifically related to the organization's system control and operational processes.

The group's announcement alleges that the breach involves a variety of sensitive information. The specific types of data claimed to have been leaked include:

• Corporate files
• Factory data
• Information concerning third-party affairs

The group has not provided information regarding the total size of the data stolen or the specific number of files involved. Furthermore, no specific ransom demand has been disclosed in the announcement.

About Mervis.info

Mervis.info is a technology platform based in the Czech Republic. The organization focuses its operations on the field of industrial automation and control systems, providing specialized technological solutions within that sector.

Potential impact and industry implications

This incident may result in the exposure of operational data within Mervis.info, which could potentially impact the organization's business operations. The inclusion of third-party information in the alleged leak could increase supply chain risks and lead to potential breaches of contractual obligations with partners and clients.

Because the organization is based in the Czech Republic, the incident may trigger regulatory scrutiny under the European Union's General Data Protection Regulation (GDPR). Such regulatory oversight often follows reports of data breaches involving sensitive information within the EU jurisdiction.

Regarding the threat actor, public information regarding the Flocker group is limited; therefore, the group's motivations and technical capabilities remain uncertain. In such scenarios, it is often necessary for organizations to conduct thorough forensic investigations to determine the actual scope of a data breach and to notify all relevant stakeholders as required by law and professional standards.

For organizations operating in the industrial automation and technology sectors, maintaining robust security postures is critical. This typically involves implementing strict access controls, continuous monitoring of operational technology (OT) environments, and ensuring that third-party integrations are secured to mitigate supply chain vulnerabilities. Regular incident response planning and forensic readiness are also vital components of a comprehensive cybersecurity strategy to manage the fallout of potential breaches.