Ransomware victim disclosure
← All victimsvouch.co.uk
Claimed by stormous · listed 19 days ago
Status timeline
- Listed
May 2, 2026
- Data leaked
At a glance
- Group
- stormous
- Status
- Data leaked
- Country
- GB
- Sector
- Financial Services
- Listed on leak site
- May 2, 2026
About the victim
AI dossier — public-source company profileVouch (vouch.co.uk) is a UK-based tenant referencing and rental services company, operating within the residential lettings market. The public site resolves to Goodlord, a platform offering tenant referencing, rent protection insurance, tenant payments, guarantor services, and PEPs & sanctions checks to letting agents, landlords, and tenants across the UK. The company handles significant personal and identity verification data as part of its KYC-driven referencing process.
- Industry
- Tenant Referencing & Rental Property Services
Attack summary
Severity: critical — The exfiltrated data includes KYC records and government-issued UK ID card information, which constitutes regulated personally identifiable information (PII) at scale. Identity document data combined with contact details represents a high-risk exposure for identity fraud, and the data has already been published, confirming exfiltration of sensitive regulated data.The Stormous ransomware group claims to have exfiltrated approximately 3 GB of data from Vouch, including KYC information, UK ID cards, email addresses, phone numbers, and full names of users. No encryption is mentioned; the disclosure status indicates the data has been published.
Data the group says was taken
AI dossier — extracted from the leak post- KYC information
- UK ID card scans/data
- Email addresses
- Phone numbers
- Full names
What the group claims
Vouch does not protect its customers' data at all and stores it poorly. Many users' data, including KYC information, UK ID cards, email addresses, phone numbers, full names, and more, have been extracted. Approximately 3GB of data was collected.
Sources
- Victim sitevouch.co.uk
Source
Indexed 19 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
