The Osiris ransomware group claims it stole 84.18GB of data from Audio Note UK Ltd, the British high-end audio equipment maker, in an alleged attack first listed on a ransomware tracking site on 11 November 2026. The group has threatened to release the data unless the company opens negotiations, according to threat intelligence reports based on the leak-site listing.

The incident was logged by the tracking platform Ransomware.live at 08:18 UTC on 11 November, which reported that Osiris had published data allegedly stolen from the company. The estimated date of the initial attack was 26 October 2026, and the listing’s status is shown as “Published”. No details have been disclosed about how the attackers gained access, and the specific attack vector remains unknown.

What the trackers report

According to the intelligence brief, Audio Note UK Ltd is a small company with 11 to 50 employees and estimated annual revenue of about $5.4 million. Its domain, audionote.co.uk, is listed as the target, and the group’s statement describes the incident as a published data theft, with negotiations demanded before any release of the stolen material.

The reported theft of 84.18GB of data raises the prospect of sensitive corporate or customer information being exposed. Security analysts warn that even a relatively small business can hold valuable data, including customer records, supplier details, designs and financial information, and that ransomware groups increasingly target smaller firms precisely because they often have fewer defences than large enterprises.

Claim remains unverified

It is important to stress that the incident, as reported so far, is a claim by a ransomware group rather than a confirmed breach. No public statement from Audio Note UK confirming a security incident had been reported at the time of publication, and the available public record does not by itself establish the scope of any intrusion, what data was taken, or whether the company’s systems were disrupted. The claim should therefore be treated as unverified until the company or investigators confirm the details.

That caution matters because ransomware leak sites are also used to exaggerate or misrepresent attacks, and security researchers note that a listing alone is a signal to verify, not proof of a breach. Anyone with a connection to the company should nonetheless take the report seriously and watch for follow-up information.

Who is Osiris?

Osiris is a comparatively new ransomware operation, first documented by researchers in January 2026 after an attack on a major food service franchise operator in Southeast Asia in November 2025. Security researchers have described it as a double-extortion operation: attackers steal data before encrypting systems, then threaten to publish the stolen files if no ransom is paid.

Reports on earlier Osiris attacks describe the group using legitimate administrative tools and living-off-the-land techniques to move through victim networks, disabling security software and deleting backups before deploying the ransomware, which appends the “.Osiris” extension to encrypted files and leaves a ransom note. The group has been linked to data exfiltration using the Rclone tool to move stolen files to cloud storage before encryption begins.

What customers should do

Threat intelligence analysts advise customers and employees of Audio Note UK to be alert for phishing attempts that could exploit any stolen information, to monitor their accounts for suspicious activity, and to use strong, unique passwords with multi-factor authentication where possible. Organisations in general are advised to keep offline, immutable backups, to review access logs for signs of unauthorised data transfers, and to make sure internet-facing systems are patched and secured.

Security teams also recommend that any organisation facing a ransomware claim should involve incident response professionals and legal counsel before engaging with the attackers, and should not assume that paying a ransom guarantees the return or deletion of stolen data. For now, the Audio Note UK listing is one more reminder that ransomware groups continue to hunt smaller targets, and that a claim on a leak site can carry real consequences long before the facts are fully established.