SOGO Auction listed on RansomEXX leak site

• Ransomware group: RansomEXX
• Country: Japan
• Sector: Professional Services
• Announcement date: April 17, 2026

The RansomEXX ransomware group has listed the Japan-based organization SOGO Auction on its leak site. According to the group's announcement, the company's data has been compromised in a recent cyberattack.

The claimed attack event

The RansomEXX group announced the listing of SOGO Auction on April 17, 2026. The group claims to have successfully exfiltrated approximately 951 MB of data from the organization. This data set reportedly includes sensitive information such as database schemas and backup files. While the group has made these claims, public information regarding the RansomEXX group remains limited.

The evidence provided by the threat actors includes screenshots of SQL database schemas, specifically targeting the 'customer_lst' and 'users' tables. Furthermore, the group has pointed to a specific backup file identified as 'sogo_backup_20260313.zip' as part of the stolen data. The group's claim of a breach on April 17, 2026, aligns with the date the listing was made public on their platform.

Details of the compromised data

Based on the information provided by the threat actors, the breach involves several categories of sensitive information. The leaked data is claimed to include:

• Customer contact information
• User credentials
• Address data
• Company information

The presence of database schemas and backup files suggests that the attackers may have gained significant insight into the internal structure of the organization's data management systems.

About SOGO Auction

SOGO Auction is a professional services firm based in Japan. The company has over 30 years of experience in the industry and specializes in the trade of used construction machinery and heavy equipment. Operated by SOGO Corporation, the organization provides high-volume auctions for various items, including excavators and bulldozers, through both on-site and online platforms.

Analysis and potential impact

The exposure of this data carries significant risks for the affected parties. The leaked information may contain personal details belonging to both customers and employees, which could potentially expose these individuals to various threats, such as identity theft or targeted phishing attacks. In such scenarios, attackers often use stolen credentials or contact information to conduct social engineering campaigns to further compromise systems or defraud individuals.

From a regulatory perspective, the organization may face mandatory breach notification requirements under Japan's Act on the Protection of Personal Information (APPI). The exposure of database schemas is particularly concerning, as these technical blueprints could provide threat actors with a roadmap to conduct more advanced and targeted attacks against the organization's underlying infrastructure in the future.

The tactics used by RansomEXX in this instance appear to align with double extortion strategies. In a double extortion scheme, ransomware groups not only encrypt an organization's data but also steal sensitive information to use as leverage. By threatening to leak the data on a public site, the group attempts to increase the pressure on the organization to meet their demands.

For organizations operating in the professional services and auction sectors, maintaining robust security postures is essential. This typically involves implementing strict access controls, regular security audits, and comprehensive data encryption. Furthermore, organizations must be prepared to respond to such incidents by following established incident response plans and adhering to local data protection laws to mitigate the impact on their clients and stakeholders.