Ransomware: Global Secret Group claims One Plus Capital (CY) — Financial Services

A new ransomware incident has been publicly claimed by a global secret group, targeting One Plus Capital, a financial services entity based in Cyprus. The claim was published on the ransomware monitoring platform ransomware.live on July 26, 2026, under the BREACH framework. This indicates that sensitive data may have been exfiltrated and is at risk of exposure or sale, though the full scope of the breach is not yet confirmed.

This event directly affects One Plus Capital and its clients, but also signals a broader risk to financial services firms operating in Cyprus and across the EU. Any organization handling client funds, personal data, or regulated financial instruments should consider this a sector-wide alert. The use of a ransomware group with a global reach suggests that similar attacks may target other firms in the near term.

Compliance teams should immediately verify whether their organization has any exposure to One Plus Capital or similar entities, and review incident response plans for ransomware scenarios. They should also ensure that breach notification obligations under GDPR and relevant financial regulations are understood and ready to be triggered. Finally, teams should monitor ransomware.live and other threat intelligence sources for updates, and reinforce employee training on phishing and credential security.