An AVEVA ransomware claim appeared on a data-leak site associated with a newly observed group calling itself Mimori on 20 October 2026. The allegation remains unconfirmed, with no evidence of access, data theft or encryption publicly available.
What the AVEVA ransomware claim alleges
Mimori reportedly added AVEVA to its data-leak site and claimed it intended to publish files allegedly taken from the UK industrial software supplier. The listing was captured by third-party cyber threat intelligence services that monitor and copy information from criminal leak sites.
The available metadata claimed that 177,234 files were involved. CTIWatch recorded a planned publication time of 19:09:39Z on 23 October 2026, three days after the allegation first became public.
That file count and publication time are claims originating from adversary-controlled content. They have not been supported by screenshots, sample documents, file listings or other evidence that would demonstrate Mimori accessed an AVEVA environment.
The AVEVA ransomware claim also contains no date for the alleged intrusion. It does not say when access may have occurred, how long an attacker may have been present or whether any information was successfully removed.
Tracker coverage is inconsistent
Ransomware.live recorded AVEVA as a newly claimed Mimori victim on 20 October 2026. Its United Kingdom country view also displayed an entry linking AVEVA with Mimori and marked the discovery date as 20 October 2026.
CTIWatch separately captured a victim card attributing the claim to Mimori. Its record included the alleged file count and scheduled publication time, but it did not provide independent proof that those details were accurate.
Coverage from another monitoring service was different. RansomLook showed that Mimori had published a post concerning OpenText on 20 October 2026, with a recorded last post time of 16:47, but it did not display an AVEVA entry when checked. It also showed the Mimori site as down.
This discrepancy does not prove or disprove the AVEVA ransomware claim. Leak-site trackers can collect information at different times, encounter outages or fail to capture individual posts. Newly established criminal sites can also be unreliable, short-lived or deliberately misleading.
Ransomware.live listed both AVEVA and OpenText as newly claimed Mimori victims that day. The appearance of more than one organisation establishes that the Mimori name was active across monitored infrastructure, but it does not establish that either alleged compromise occurred.
Timeline of the Mimori allegation
- 20 October 2026: Ransomware.live recorded AVEVA as a claimed victim of Mimori.
- 20 October 2026: CTIWatch captured a card for the AVEVA ransomware claim, including a claimed total of 177,234 files.
- 20 October 2026: RansomLook displayed a Mimori post concerning OpenText, but no corresponding AVEVA entry.
- 23 October 2026 at 19:09:39Z: The time at which Mimori allegedly planned to publish AVEVA files, according to metadata captured by CTIWatch.
As of 20 October 2026, AVEVA had not published an acknowledgement of the alleged incident on its Cyber Security Updates page or through its 2026 press releases. There was also no independent confirmation that data existed or would be released at the scheduled time.
Technical evidence behind the AVEVA ransomware claim
No technical account of an intrusion has been published. The leak-site summaries do not identify an initial access method, exploited vulnerability, compromised account, phishing campaign or exposed remote service.
There is also no information about privilege escalation, lateral movement or persistence within an AVEVA network. No exfiltration tool, malware family, command and control infrastructure or encryption payload has been associated with the allegation.
No affected products or versions identified
The AVEVA ransomware claim does not name any affected software product, hosted service, customer environment or product version. There is currently no basis for concluding that a vulnerability in AVEVA software was involved, or that customer deployments were accessed.
No indicators of compromise have been released. Organisations therefore have no Mimori-specific hashes, IP addresses, domains, file paths or detection signatures to search for in connection with this listing.
A leak-site listing is not proof of compromise
Data-leak sites are commonly used to pressure organisations in double-extortion incidents. Attackers may threaten to publish stolen information, sometimes alongside the encryption of systems, to increase pressure for payment.
However, no encryption claim has been made in this case. No ransom demand or payment figure is visible, and there is no evidence confirming that Mimori deployed ransomware. Describing this as an AVEVA ransomware claim reflects the nature of the leak-site allegation, not a verified technical finding.
The reliability and lineage of Mimori are also unknown. Recent cases involving other little-known leak-site brands have demonstrated that criminal groups can fabricate victim listings to gain attention or create a false appearance of activity. That history is a reason for caution, although it is not proof that this particular claim is false.
Current exploitation status and significance
The exploitation status is unverified. At present, the only evidence is adversary-controlled information reproduced by OSINT trackers, some of which show conflicting coverage. There is no proof of access, sample data, vendor confirmation or independently verified technical activity.
Even so, the AVEVA ransomware claim merits monitoring because AVEVA is a prominent UK industrial software supplier. If a compromise were later confirmed, organisations would need to understand whether corporate information, support systems, software delivery processes or customer-facing services were affected. None of those impacts has been established.
What organisations should do now
Organisations should treat the listing as an allegation rather than a confirmed supply-chain incident. Immediate product removal or disruptive technical changes are not justified by the information currently available.
- Monitor AVEVA’s Cyber Security Updates page and official press releases for confirmation, denial or product-specific guidance.
- Review threat intelligence updates for any sample files, indicators of compromise or technical details that could substantiate the claim.
- Warn relevant staff about phishing messages that invoke AVEVA, Schneider Electric, software updates, invoices or urgent security reviews.
- Apply additional scrutiny to unusual access attempts or support requests using AVEVA-related pretexts.
- Reassess the AVEVA ransomware claim if the scheduled publication time passes, evidence appears or AVEVA issues an official statement.
Until further evidence emerges, the most accurate assessment is that Mimori has made a public claim without proving it. Continued monitoring is appropriate, but the available information does not establish a breach, ransomware deployment or impact on any AVEVA product.
Originally reported by redpacketsecurity.com.
