What Happened

Ransomware group n0n has posted a leak-site claim against Dediserve Ltd, a cloud infrastructure provider linked to the iomart group. The group says it exfiltrated the complete FRA1 cloud customer register — 167 tenant accounts with infrastructure details — along with disk images of tenant servers, including a regulated forex broker's portal, a payment services provider's systems, and a production real-estate platform.

n0n also claims access to Dediserve's internal operations mailbox and monitoring configuration. The group states all 46 FRA1 servers and backups have been removed, making the stolen disk images the only restore path. The leak page is in countdown status, indicating an active negotiation window.

Who Is Affected

Dediserve Ltd, headquartered in Ireland with FRA1 cloud operations in Dublin and Frankfurt DC, is the direct target. Parent company iomart is also implicated as the group links the victim to the iomart group.

Affected downstream parties include the 167 tenant accounts in the FRA1 cloud register, specifically a regulated forex broker (payment gateway configuration, trading-account records), a payment services provider (internal password vault), and a production real-estate platform.

Market Impact

This breach exposes sensitive customer data and critical infrastructure credentials, with potential regulatory and reputational consequences for Dediserve and its tenants.

• Exfiltration of payment gateway configs and password vaults elevates fraud and downstream attack risk.
• Loss of all servers and backups creates operational urgency for tenants relying on FRA1 cloud.
• Countdown status signals a finite window for negotiation or disclosure, driving immediate buying intent for incident response and forensics services.

What to Watch

Monitor the leak page for countdown progression or publication of the stolen data. If no settlement is reached, n0n says it will publish the full customer register, tenant disk images, and internal operations data.

Watch for official statements from Dediserve or iomart, and for tenant notifications that may trigger compliance requirements. Sales teams should track this account for urgent managed detection and response (MDR) and recovery solution needs.

Related coverage

• AHEAD — Chicago IT consulting firm claimed by incransom ransomware group
• HBPro targeted by SafePay ransomware
• Free real-time ransomware threat monitoring tool tracks 11,194 victims