Yource Bulgaria & Greece data listed on crypto24 leak site

• Ransomware group: crypto24
• Country: Bulgaria
• Sector: Professional Services
• Announcement date: January 21, 2026

The crypto24 ransomware group has claimed to have compromised data belonging to the professional services provider Yource Bulgaria & Greece. According to an announcement made on a leak site, the threat actor alleges they have gained access to sensitive information related to the company's operational processes. This claim suggests a potential breach involving various datasets associated with the organization's client engagements.

Details of the alleged attack

On January 21, 2026, the crypto24 group listed data belonging to Yource Bulgaria & Greece on their dedicated leak site. The threat actor alleges that they possess sensitive data related to the company's operational processes. The announcement indicates that various datasets associated with the company's client engagements are included in the alleged leak. While the group has made these claims, public information regarding the specific identity and activities of the crypto24 group remains limited.

The claim of a data breach often follows the pattern of double extortion, a common tactic used by modern ransomware groups. In these scenarios, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage. By threatening to release this information on a public leak site, the attackers aim to pressure the organization into paying a ransom to prevent the exposure of confidential files. This method increases the pressure on the victim, as the threat of reputational damage and regulatory scrutiny becomes a powerful motivator.

Claimed data and affected information

The announcement made by the crypto24 group claims that the stolen information includes HR, customer, financial, and project-related information. Furthermore, the group alleges that the data includes datasets associated with several third-party clients, specifically naming Eneco Belgium, bofrost, essent.be, Media Compentence, Sodexo, and Spotzer. It is important to note that no screenshots were provided by the group to substantiate their claims. No information was provided regarding the total size of the data or the specific file count involved in the alleged incident.

The specific types of data mentioned in the claim include:

• HR data
• Customer data
• Financial data
• Project information

The presence of such diverse data types suggests a broad reach into the organization's internal systems, potentially affecting multiple departments from human resources to finance and project management.

Organization profile

Yource Bulgaria & Greece is a customer experience and contact center services provider serving international clients. The company manages large-scale customer and business data through its operations in Bulgaria and Greece.

Potential risks and industry implications

These claims may pose significant risks, such as identity theft or targeted phishing attacks, for the company's employees and customers. Because the organization manages large-scale customer and business data, the potential impact of a verified leak is substantial. Given the company's operations in Bulgaria and Greece, the leak could lead to legal consequences under the EU General Data Protection Regulation (GDPR).

Furthermore, the presence of data belonging to third-party clients may trigger secondary security risks through the supply chain. When a service provider is compromised, their clients often become targets as well, as the leaked information can be used to launch highly convincing social engineering attacks against those third parties. If the data is verified, it is possible that the company could face reputational damage and disruptions to its operational processes.

For organizations operating within the professional services and customer experience sectors, maintaining robust security postures is critical. This typically involves implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to recognize phishing attempts. Additionally, organizations often employ continuous monitoring and incident response plans to mitigate the impact of potential breaches and ensure compliance with regional data protection regulations.