On November 10, 2026, the ransomware group Booba Project listed Computer Task Group, Inc. (CTG) on its leak site. CTG is an IT services and staffing firm based in Amherst, New York. The group says it stole 50 GB of data, according to ransomware trackers DeXpose and QPulse. QPulse cites infostealer data from Hudson Rock showing that 25 CTG employees, 35 users and 36 employees of third parties have had credentials stolen by infostealer malware. That data covers 4,728 passwords, 282 of them rated critical, and 102 session cookies.
The claim comes about six weeks after CTG reported a separate breach. CTG has told four US state attorneys general that an unauthorised party copied files from its network on September 26, 2026. CTG has not said in public whether the September incident and the Booba Project claim are the same event. No ransomware tracker or law firm has linked them either.
What Happened
There are two strands to this story, and they should be kept apart until CTG says otherwise.
The disclosed breach (September 2026). CTG's notices to regulators, as reported by the law firms Dapeer Law and Edelson Lechtzin, set out this timeline:
- September 26, 2026: an unauthorised party accessed some systems on CTG's network and copied files.
- October 2, 2026: CTG found that some of the copied files held personal information.
- October 19, 2026: CTG began mailing notice letters, about three weeks after the intrusion. In a letter dated the same day, its counsel notified the New Hampshire Attorney General. Filings were also posted by the attorneys general of Massachusetts, Texas and Vermont.
- Remediation offered: 12 months of single-bureau credit monitoring through Cyberscout. People must enrol within 90 days of the letter date.
Both firms have opened class action investigations.
The ransomware claim (November 2026). On November 10, Booba Project named CTG on its leak site. The group described the victim as "IT Services and IT Consulting" and claimed "Stolen data: 50 GB," as captured by DeXpose. QPulse logged the claim at 12:52 UTC the same day. No sample files have been described publicly. CTG has not commented on the claim, and no regulator filing mentions ransomware or Booba Project.
What Was Taken
From the disclosed breach, CTG says the copied files may include:
- Names
- Social Security numbers
- Direct deposit account information
- Driver's licence or other government ID numbers
- Health insurance member ID numbers or other health plan data
How many people are affected is unclear, and the reports disagree. Dapeer Law puts the figure reported to the Texas Attorney General at 11,962. Edelson Lechtzin says CTG reported 1,385 people in Texas, 77 in Massachusetts, 48 in Vermont and 26 in New Hampshire, which adds up to 1,536 across the four states. The two firms give different numbers for the same Texas filing: 11,962 according to Dapeer Law and 1,385 according to Edelson Lechtzin. Until the filings are checked directly or CTG publishes a total, the scale is somewhere between about 1,500 and about 12,000 people. CTG also has staff and clients outside these four states, so any full total could be higher.
From the ransomware claim, the only figure is the group's own 50 GB. Nobody has independently checked it, and Booba Project has not said what the data contains.
Edelson Lechtzin points out that CTG's business means the affected people could include current and former employees, contractors and client staff, not only CTG's own workforce.
Why It Matters
CTG places IT staff and runs technology services inside enterprise client environments. A breach at a firm like this can spread to its clients. Hudson Rock counts 36 third-party employees whose credentials appear in infostealer logs alongside CTG's. Some of those credentials could give access to client systems, not just CTG's own.
This fits a wider pattern in recent incidents. Attackers increasingly get into a supplier or an internal tool and then use the trust that comes with it:
- WorkOS: BleepingComputer reported this month that an attacker got into the developer-identity provider's internal sales application. The attacker took CRM contacts and summaries of customer conversations that could be reused for targeted phishing.
- Iris Ohyama: the Japanese manufacturer said a third-party cloud service it used exposed data on up to 7.7 million people.
- Ransomware operators going after infrastructure: Huntress found an operator on breached AhsayCBS backup servers running a command that matches NetExec's Veeam credential-theft module. Kaspersky's Securelist documented Storm-2603 trying to kill endpoint detection tools and then attempting to deploy ransomware after exploiting SharePoint.
These cases are unrelated to CTG. They show what attackers tend to do once they are inside: go after backup systems and security tooling, and use stolen relationship data to reach the next target.
If CTG is your supplier, assume that staff identities linked to your environment may be exposed until CTG tells you otherwise.
The Attack Technique
How the attackers got in has not been confirmed. CTG's notices say only that an unauthorised party "accessed certain systems" and "copied files." They do not mention ransomware, encryption or a specific way in.
The theory that infostealer credentials were the entry point comes from Hudson Rock's exposure data as reported by QPulse. QPulse itself says its information "does not confirm the specific technical method used for the initial breach beyond the detection of infostealer activity." In practice this means:
- Valid CTG and third-party credentials, and 102 session cookies, are circulating in infostealer logs.
- Stolen session cookies can let an attacker skip multi-factor authentication by replaying a session that is already logged in.
- QPulse reports that CTG's external attack surface has 66 exposed points.
These conditions are consistent with entry using stolen credentials, and it is a common route into ransomware incidents. It is still a likely explanation, not an established one.
Little is known about Booba Project's tools or methods. It has no published technical profile comparable to those for established groups.
What Organizations Should Do
- If CTG is your supplier, ask it directly whether the September 26 incident and the Booba Project claim are the same event, which systems were reached, and whether any client credentials, VPN profiles or data were in the copied files.
- Rotate credentials and end active sessions for CTG-linked accounts. This means contractor accounts, service accounts and any federated or guest identities CTG staff use in your environment. Changing passwords alone does nothing against stolen cookies, so revoke refresh tokens and active sessions as well.
- Search your logs for activity from those accounts going back to at least early September 2026. Look for logins from unfamiliar devices or ASNs, sessions without a matching MFA event, and large data transfers.
- Check your own exposure to infostealers. Look up your domains in infostealer intelligence feeds. Make sure contractors who use personal or unmanaged devices go through device-trust or conditional access checks.
- Protect backup and security infrastructure. Restrict access to backup consoles such as Veeam and Ahsay, and to EDR management, to named administrators on hardened hosts. Alert on attempts to tamper with these systems or pull credentials from them. The Huntress and Securelist cases show attackers aim for exactly these systems.
- If you received a CTG letter, enrol in the Cyberscout monitoring within 90 days. Consider freezing your credit with all three bureaus, since the monitoring covers only one. Watch for fraud involving direct deposit changes and health insurance claims.
Sources: Booba Project Ransomware Attack on COMPUTER TASK GROUP, Inc. Involv... | How to detect fileless attacks exploiting ToolShell: analyzing the... | Inside an AhsayCBS Intrusion: Hidden Webshells, a CryptoMiner, and... | WorkOS says attacker used ARTEX AI to breach internal sales app | Iris Ohyama data cloud breach exposes info of 7.7 million customers | CTG (Computer Task Group, Incorporated) Data Breach Letter | Computer Task Group Data Breach Investigation: Edelson Lechtzin LLP... | Booba Project Targets COMPUTER TASK GROUP, Inc. - DeXpose