Yurei ransomware group lists www.midcity.lk on its leak site

• Ransomware group: Yurei
• Country: Sri Lanka
• Sector: Agriculture and Food Production
• Announcement date: September 5, 2025

Yurei ransomware group claims data breach at Midcity Marketing (Pvt) Ltd

The threat actor group known as Yurei has published a claim on their leak site involving the Sri Lanka-based food supplier Midcity Marketing (Pvt) Ltd. According to the announcement made on September 5, 2025, the group alleges that they have successfully compromised the organization's systems and exfiltrated sensitive information.

Ransomware attacks often follow a pattern of double extortion, where threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to release this data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of confidential business and personal information.

Details of the alleged data theft

The Yurei group has listed numerous internal documents on their leak site that they claim belong to www.midcity.lk. The threat actor alleges that the scope of the breach is significant, claiming that the compromised data spans the entire operational history of the company. This claim suggests that the breach was not limited to a single recent event but may encompass years of accumulated corporate information.

According to the announcement, the leaked information includes the company's supply chain structure, financial records, and employee information. Visual evidence provided by the group, such as screenshots, reportedly displays various internal documents. The specific types of data allegedly involved in this incident include:

• Financial records
• Accounting documents
• Shipping records
• Commercial agreements
• Employee data

The screenshots mentioned in the leak claim to show the company's accounting records, ledger vouchers, and financial transactions. Furthermore, the group alleges that shipping records, commercial agreements, and employee data have been leaked as part of this breach.

Implications of the exposure

The disclosure of this information carries several potential risks for the organization. The exposure of internal documents could lead to the company's trade secrets and supply chain strategies becoming accessible to competitors, potentially undermining its market position. Additionally, the leak of employee data could create a foundation for targeted phishing attacks against company personnel, as attackers often use personal details to craft convincing social engineering campaigns.

Given the company's position within the food supply chain, the disclosure of operational data may create indirect risks for national food security. Such risks often arise when critical infrastructure or essential supply providers face significant disruptions or loss of sensitive operational intelligence.

General defensive considerations

While information regarding the Yurei group remains limited, this incident highlights the ongoing risks faced by organizations in the food production and supply sectors. Organizations facing similar threats often need to review relevant regulations in their jurisdiction regarding data breach notification obligations and potential legal sanctions. Defensive measures typically involve maintaining robust monitoring of network traffic, implementing strict access controls, and ensuring that all employees are trained to recognize phishing attempts.