Dark Web Intelligence on X: " BRAIN CIPHER RANSOMWARE CLAIMS ATTACK ON ...

X • October 22, 2026

The Brain Cipher ransomware group has added Sodali & Co (formerly Morrow Sodali), the London-headquartered global shareholder-engagement and proxy-solicitation adviser, to its data-leak site.

The gang claims to hold 13,000 documents, including annual shareholders' meeting files for Swiss and German clients, a full list of issuer clients, their corporate documents, voting schedules and voting results.

The claim has not been independently verified, and Sodali & Co has not publicly confirmed an incident.

Sodali & Co advises listed companies worldwide on proxy fights, AGMs, activism defense and M&A votes. If genuine, the data could expose non-public governance and voting information its issuer clients, which would raise insider-information and targeted-phishing risks for those companies. We assess this as an unverified threat-actor claim, NOT confirmation of a breach.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Brain Cipher and Nitrogen Ransomware Groups Claim Attacks on Companies The Brain Cipher ransomware group has claimed an attack on Sodali & Co, stating it holds 13,000 documents, including sensitive corporate governance materials. This claim has not been verified, and Sodali & Co has not confirmed any incident. Separately, the Nitrogen ransomware group has listed Walbro on its leak site, claiming to have compromised the company, which has also not confirmed any incident. Both claims remain unverified, and no data samples have been provided. If true, the attacks could expose sensitive data, increasing risks of insider threats and phishing. Currently, both incidents are assessed as unverified threat-actor claims. 2 sources 34

Dark Web Intelligence on X: " BRAIN CIPHER RANSOMWARE CLAIMS ATTACK ON ...

The full story

Extracted Entities

Attack Types (1)

Ransomware Groups (1)