On IT listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: Belgium
• Sector: Technology
• Announcement date: April 11, 2025

Termite claims to have stolen data from On IT

The threat actor known as Termite has listed the Belgian technology services provider On IT on its leak site. According to the announcement, the group claims to be in possession of a significant volume of data belonging to the organization, totaling 760 GB. This claim was made on April 11, 2025, following an alleged attack that occurred on April 10, 2025.

Ransomware groups often utilize leak sites to exert pressure on their victims. In many modern cyberattacks, particularly those involving double extortion, threat actors not only encrypt an organization's systems but also exfiltrate sensitive information. If the ransom is not paid, the attackers threaten to publish the stolen data on these public platforms to damage the victim's reputation or force compliance through the threat of public exposure.

Details of the alleged data breach

The announcement published by the Termite group includes a list of files that allegedly contain sensitive information. The threat actor asserts that the exfiltrated data consists of technical documentation and client-related information pertaining to the company's digital transformation services. While the total volume of the data is claimed to be 760 GB, the specific number of files has not been disclosed by the group.

A review of the provided evidence, such as screenshots of the directory structure, shows various PDF and document files. The names of these files suggest that the stolen information includes:

• Client data
• Technical project documents
• Corporate process documentation

The presence of such diverse file types suggests that the breach may have touched upon various operational aspects of the company's internal and client-facing workflows.

About On IT

On IT is a company based in Belgium that provides information technology services with a specific focus on digital transformation for enterprises. The organization specializes in a wide range of managed services for small and medium-sized enterprises (SMEs). Their expertise includes data analysis using Power BI, digital project management, technical training, and various IT support services.

Potential risks and industry implications

The alleged breach of On IT carries significant implications, particularly regarding supply chain risks. Because On IT provides managed services and digital transformation expertise to other enterprises, a compromise of their data could potentially impact the security posture or privacy of their clients. When a service provider is targeted, the breach can create a ripple effect across their entire client base.

Furthermore, since the organization is based in Belgium, the incident may fall under the regulatory scope of the European Union's General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on how personal data must be protected and how breaches must be reported to authorities and affected individuals. The publication of such data could lead to secondary risks, such as targeted phishing attacks or identity theft directed at the affected clients.

While information regarding the Termite group remains limited—leaving their specific motivations and operational methods uncertain—this incident highlights the ongoing risks faced by technology service providers. Organizations in this sector often implement defensive measures such as multi-factor authentication, regular security audits, and robust data encryption to mitigate these threats. In the event of a confirmed breach, organizations typically fulfill data breach notification requirements to ensure transparency and compliance with legal standards.