The OpenText ransomware claim appeared on a Mimori leak site on 20 October 2026. Although two independent trackers recorded the listing, there is currently no evidence confirming that OpenText was compromised.
Mimori reportedly threatened to publish data allegedly taken from the Canadian enterprise software company. However, no proof-of-hack material, data samples, encryption evidence or technical details were available through the public trackers consulted.
What the OpenText ransomware claim alleges
A newly tracked extortion operation calling itself Mimori named OpenText as an alleged victim on its dark web leak site. RansomLook captured a single post titled “OpenText” at 16:47 on 20 October 2026, while CTIWatch recorded that OpenText had been listed by the same group on that date.
These records corroborate the existence of the listing, not the alleged intrusion. Threat intelligence trackers generally collect and catalogue statements made by threat actors. Their inclusion of a company in a victim catalogue does not independently establish that systems were accessed or information was stolen.
One secondary industry feed summarised the Mimori listing as claiming that 94,306 files were connected to the incident. It also attributed a threatened publication date of 29 October 2026 to the group. No primary screenshots, sample files or other supporting evidence were found to verify either detail.
The listing reportedly contained OpenText’s name and descriptive information about its business. It did not explain what the alleged files contained, whether they held personal or commercially sensitive information, or which part of the organisation they supposedly came from.
No ransom amount was disclosed. There was also no evidence showing that Mimori had encrypted systems, interrupted operations or deployed ransomware within an OpenText environment. Based on the material currently available, the OpenText ransomware claim is best understood as an unverified data-extortion allegation.
Timeline of the Mimori OpenText listing
- 20 October 2026: Mimori lists OpenText as an alleged victim on its leak site.
- 20 October 2026 at 16:47: RansomLook records its first observed capture of the post.
- 20 October 2026: CTIWatch adds a catalogue entry stating that OpenText was listed by Mimori.
- 20 October 2026: OpenText has not published an incident notice or acknowledged the alleged compromise.
- 29 October 2026: Mimori allegedly plans to publish the claimed data, according to a secondary feed. This deadline is unverified.
At the time of the RansomLook capture, the tracked Mimori site address was shown as unavailable. It remained unavailable in the latest checks conducted on 20 October 2026. This limits the ability of researchers to inspect the original post or validate the reported file count and publication threat.
OpenText’s investor newsroom, press pages and service status history contained no public communication about a Mimori incident as of 20 October 2026. Its status information showed routine maintenance rather than an incident that could be linked to the allegation.
No OpenText products or versions identified
The OpenText ransomware claim does not identify an affected product, hosted service, internal environment or software version. It also provides no evidence connecting the allegation to any current OpenText platform or legacy Micro Focus product.
This distinction is important because the listing names the company, rather than describing exploitation of a customer-facing product. There is presently no basis for concluding that organisations running OpenText software are directly exposed to a vulnerability as a result of this claim.
No security flaw, CVE identifier or vulnerable configuration has been associated with the alleged incident. There is also no indication that customer deployments, cloud services, support systems, source code repositories or software distribution channels were accessed.
Technical method remains unknown
Mimori has not disclosed how it supposedly entered OpenText’s environment. There is no information about phishing, stolen credentials, exposed remote access services, vulnerability exploitation or compromise through a third party.
Likewise, no details have been published about privilege escalation, lateral movement, persistence or data exfiltration. The trackers did not expose screenshots of internal systems, directory listings or other artefacts that might demonstrate unauthorised access.
No ransomware sample or encryption tool has been attributed to Mimori in connection with the OpenText ransomware claim. It is therefore unclear whether Mimori operates encrypting malware, focuses on data theft and extortion, or is simply presenting itself as a credible criminal operation.
No indicators of compromise available
No actionable indicators of compromise have been published for this event. There are no associated IP addresses, domains, file hashes, malicious file paths or registry keys that defenders can use to search their environments.
Mimori is a newly surfaced name with little observable operational history. Open-source reporting provides no established techniques, procedures or tooling for the group in this case. Research also found no reputable analysis specifically proving that Mimori fabricates victim claims, so the allegation should be treated as unverified rather than automatically false.
Current exploitation and verification status
There is no independently confirmed exploitation associated with the OpenText ransomware claim. The only established event is that a Mimori leak-site post named OpenText and was captured by two monitoring services.
Nothing currently confirms an intrusion, encryption event or theft of 94,306 files. OpenText has not acknowledged the allegation, and Mimori has not supplied public evidence sufficient to validate it.
Leak-site posts can contain accurate disclosures, exaggerated details or entirely unsupported assertions. A listing alone should not be treated as proof that a supplier breach has occurred, particularly when the threat actor is new and has provided no verifiable material.
Why the OpenText ransomware claim matters
OpenText and legacy Micro Focus technologies are used by organisations in the UK and internationally, both directly and through managed service providers. If a compromise were later confirmed, customers would need to understand whether corporate information, credentials, support data or shared services were affected.
The present lack of evidence means organisations should avoid assuming their OpenText products are compromised. However, the allegation may be used in targeted phishing or social engineering messages designed to create urgency around an alleged supplier incident.
What organisations should do now
- Monitor OpenText’s press, investor and service status channels for an official acknowledgement or advisory.
- Ask relevant managed service providers to communicate promptly if OpenText issues guidance affecting shared services or customer data.
- Treat emails referring to the Mimori allegation, data publication or urgent OpenText password resets with caution.
- Do not block infrastructure or initiate disruptive incident procedures based solely on the unverified listing, as no event-specific indicators are available.
- Prepare to review access credentials, integrations and supplier connections if OpenText later confirms an incident and defines the affected systems.
Until OpenText, law enforcement or independent researchers provide corroborating evidence, the Mimori listing remains an allegation. Any future data publication, technical indicators or vendor statements will be central to determining whether the OpenText ransomware claim reflects a genuine compromise.
Originally reported by redpacketsecurity.com.
