Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotRansomEXX claims to have exfiltrated 34.1MB of data from SOGO Auction, publishing a leak page on the group's v2 onion site on 17 April 2026 and showing a single archive named sogo_backup_20260313.zip. The archive is password-protected, with the password provided as Vm14a2QxVXlVbGhVYWxwU1lteEtUMVJXWkc5WFp3. The leak page identifies the victim as SOGO Auction via an onion domain and describes the sector as construction machinery and heavy equipment auctions in Japan.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
What was taken
SOGO Auction - 951MB leaked. SOGO Auction is a prominent Japan-based, specialized auctioneer with over 30 years of experience in trading used construction machinery and heavy equipment. Operating since the 1990s, they provide both on-site and online, high-volume auctions for items like excavators and bulldozers.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- The password for each archive is
- Vm14a2QxVXlVbGhVYWxwU1lteEtUMVJXWkc5WFp3
Leak-site images (1)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.