Mimori  (Back to overview)

Mimori is a data-extortion / ransomware group first observed on 2026-10-20, when it launched a leak site and listed its first two claimed victims: OpenText (Canada, technology) and AVEVA (UK, industrial software), claiming 177,234 files from AVEVA. A third claimed victim, St. James's Place (UK, financial services), was reported on 2026-10-21. The leak site, mimori.group, is a clearnet domain fronted by Cloudflare that publishes victim pages under /organizations/<victim> and threatens to publish stolen data unless victims make contact. None of the claims has been independently verified. AVEVA and OpenText have each disclosed a separate security incident (unauthorized access to AVEVA's corporate SharePoint, and to an OpenText employee account through social engineering), but neither has attributed it to Mimori. No ransomware sample, encryptor or affiliate program has been publicly linked to the group, and its operators and any links to earlier groups are unknown.

Associated Families

There are currently no families associated with this actor.

References