A ransomware gang has tied its name to INK and the domain weareink.co.uk, yet the public record still shows a claim, not a confirmed breach.
A London creative studio has appeared in DragonForce’s extortion ecosystem, but the public breadcrumb points to a naming event, not a verified account of breach scope or data theft.
A named extortion brand, a government-adjacent web domain, and a 64-character token are enough to spark concern, but not enough to prove a breach.
An attacker-posted leak notice tied to the Council of Europe illustrates why HR and payroll data are prized by extortion crews: they combine identity, payment, and privacy risk in one place.