Was Pechexport hit by ransomware?

Pechexport was listed by the cyclops ransomware operation (China), and stolen data was published on the group's leak site. Darkfield tracks this disclosure with the original leak post, screenshot and group context.

Who is the cyclops ransomware group?

cyclops is a ransomware operator tracked by Darkfield. See the full operator dossier for its known victims, sectors targeted, IOCs and leak-site infrastructure.

What data was leaked in the Pechexport breach?

cyclops published data attributed to Pechexport. Darkfield captured the leak post and a screenshot of the listing.

Ransomware victim disclosure

← All victims

Pêchexport

listed as Pechexport · Claimed by Cyclops · listed 3 years ago

36m

Age

since listed · data leaked

Status timeline

ListedJul 23, 2023
Data leakeddate unknown

At a glance

Group: Cyclops
Status: Data leaked
Country: China
Sector: Transportation & Logistics
Listed on leak site: Jul 23, 2023

About the victim

AI dossier — public-source company profile

Pêchexport is a seafood processing and export company based in Majunga (Mahajanga), Madagascar, operating across an 8,400 m² facility that includes offices, a factory, a laboratory, cold storage, and technical workshops. The company operates a fleet of eight EU- and CIQ-certified freezer trawlers, a CE-approved fish processing plant with a capacity of 5 tonnes per day, and a cold store of up to 300 tonnes. It handles its own customs and transit procedures for the export of fish products, primarily targeting European and Chinese markets.

Industry: Seafood Processing & Export (Fishing & Aquaculture)
Address: Majunga (Mahajanga), Madagascar

Attack summary

Severity: high — The group has published five data archives containing confirmed exfiltrated data including personnel records (potential PII), visa documents, and operational business data; the disclosed status is 'data_published', indicating actual release rather than mere listing.

The Cyclops ransomware group claims to have exfiltrated data from Pêchexport and has published multiple data archives, including files related to visa records, personnel information, operational tracking, fiscal/tax reporting on fish, and armament/fleet records.

high

Data the group says was taken

AI dossier — extracted from the leak post

Visa documents
Personnel records
Operational tracking/follow-up records (2023)
Fish tax/IR state programme documents
Fleet/armament records

The group's post references roughly 5 proof files.

What the group claims

Infrastructure and logistics Pêchexport is located in Majunga on a surface of 8400 m². Our premises include offices, a factory, a laboratory, storage equipment and technical workshops. We have a fleet of eight freezer trawlers, two refrigerated trucks and a fleet of vehicles transporting our products upstream.Hygiene and quality We have eight EU and CIQ (The China entry-exit Inspection and Quarantine Bureau) certified refrigerated trawlers. We have a CE-approved fish processing plant, with its HACCP (Hazard Analysis Critical Control Point) approach, a treatment capacity of 5t/day and a cold store that can store up to 300 tons. We have our own bacteriological and physico-chemical analysis laboratory approved by the Institut Pasteur. All our products are systematically tested before each shipment to guarantee the best quality to our customers.Autonomous customs procedures To facilitate the export of our products, we carry out customs procedures ourselves through our transit service autonomously and efficiently.Data:======https://anonfiles.com/d9Iemaz3z4/VISA_ziphttps://anonfiles.com/VeD7i5z8za/SUIVI_2023_ziphttps://anonfiles.com/V6Lei3zdz1/PERSONNEL_ziphttps://anonfiles.com/edN3ibzazb/PROGRAMME_ETABLIR_ETAT_IR_POISSON_ziphttps://anonfiles.com/s2Qci9z0z3/ARMEMENT_zip

Sources

Victim sitepechexport.mg

Source

Indexed 3 years ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About cyclops

Cyclops is a relatively minor ransomware group that emerged in July 2023, operating with apparent financial motivations and maintaining a low profile compared to established ransomware families. The group's origin and affiliations remain largely undocumented in public threat intelligence reporting, with limited information available regarding their operational structure or potential ties to other cybercriminal organizations. Based on available data, Cyclops has demonstrated geographically diverse targeting patterns, with documented victims spanning Australia, China, and Guatemala, though their specific attack methodologies, initial access vectors, and encryption techniques have not been extensively analyzed or reported by major security firms or law enforcement agencies. With only seven known victims documented since their emergence, the group represents a relatively small-scale operation that has not conducted any widely publicized high-profile attacks or drawn significant attention from cybersecurity researchers or law enforcement disruption efforts. Current intelligence suggests the group remains active but operates at a scale significantly below major ransomware families that typically dominate threat landscape reporting. The group has been linked to 7 public disclosures across our corpus. First observed on a leak site on July 1, 2023; most recent post July 26, 2023. The operation is currently inactive.

Timeline of this disclosure

July 23, 2023Pechexport listed by cyclopson the group's public leak site

Other recent disclosures by cyclops

cyclops has been linked to 7 public victims on Darkfield. A sample of the most recent:

See the full cyclops dossier →

Sector and geography

This disclosure adds to ransomware activity in the Transportation & Logistics sector, which has 180 disclosures indexed across all operators we track. Geographically, Pechexport is reported in China, a country with 72 ransomware disclosures in our corpus.

If your organisation is affected

A listing by cyclops means Pechexport appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
Monitor for the data appearing on cyclops's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.