OfficeWorks listed on Genesis ransomware leak site

• Ransomware group: Genesis
• Country: United States
• Sector: Professional Services
• Announcement date: February 17, 2026

Genesis claims to have exfiltrated data from OfficeWorks

The threat group known as Genesis has claimed responsibility for a significant data breach targeting OfficeWorks. According to an announcement posted on the group's leak site, the attackers allege they have successfully exfiltrated a substantial amount of sensitive information from the professional services firm. The listing, which appeared on February 17, 2026, marks a new incident involving the Genesis group and a United States-based organization.

The group alleges that the breach occurred on February 17, 2026, the same day the announcement was made. According to the claims made by Genesis, the attackers managed to access and extract a total of 1.8 TB of data directly from the company's file servers. This volume of data suggests a deep penetration into the organization's internal storage systems. Notably, while the total size of the data has been specified, the group has not provided information regarding the specific number of files involved or the exact amount of the ransom demand.

The announcement on the leak site includes a countdown timer, a common tactic used by ransomware groups to increase pressure on their victims. This timer indicates that the group intends to publish the stolen data publicly if their specific demands are not met within the allotted timeframe. This method is a hallmark of modern cyber extortion campaigns.

The scope of the allegedly stolen data

The data allegedly stolen by Genesis is vast and covers a wide array of sensitive operational and administrative information. The group claims to have obtained access to various critical repositories within the OfficeWorks network. Based on the information provided by the threat actor, the exfiltrated data includes several categories of highly sensitive documents and files.

The items identified in the group's claim include:

• Contracts
• Non-disclosure agreements (NDAs)
• Project data
• Customer master plans and blueprints
• Financial data
• Email archives
• Network user folders
• Management folders

The breadth of this data suggests that the attackers may have gained access to both high-level strategic documents and granular user-level information, potentially impacting various levels of the organization's hierarchy.

Implications and potential risks

This incident suggests that sensitive customer and operational data within OfficeWorks may be at risk of exposure. Because the firm is based in the United States, a confirmed data breach could trigger various state-level data protection regulations and lead to potential legal consequences for the organization. The exposure of such diverse data types—ranging from financial records to customer project plans—could lead to significant secondary risks. For example, the availability of email archives and management folders could facilitate highly targeted phishing attacks against employees or clients.

Furthermore, the potential leak of customer master plans and blueprints could result in significant reputational damage and a loss of trust from clients who rely on the firm for professional services. Such an exposure often leads to a cascade of consequences, including loss of intellectual property and competitive disadvantage.

While information regarding the Genesis group remains limited, the nature of this announcement aligns with the double-extortion tactics frequently employed by modern ransomware groups. In a double-extortion scenario, attackers do not merely encrypt an organization's systems but also steal sensitive data to use as leverage. The threat of publishing the data is used to exert maximum pressure on the organization to pay a ransom to prevent the public release of their proprietary and private information.

In general, organizations operating in the professional services sector can take several defensive steps to mitigate the risks associated with such attacks. Implementing robust data loss prevention (DLP) tools, maintaining strict access controls to file servers, and ensuring comprehensive encryption for data at rest and in transit are standard industry practices. Additionally, regular monitoring of network traffic for unusual data exfiltration patterns can help in the early detection of such incidents.