DataCarry

DATACARRY is a ransomware/extortion group first reported in 2025. Multiple sources in the provided content describe it as an emerging ransomware operation and, more specifically, as a data-theft and leak-based extortion actor that in some cases did not deploy a ransomware locker. The group launched a leak site within weeks of several other new extortion brands and was reported as claiming victims across eight countries. One cited report states that victim companies in eight countries were disclosed and that 65,000 records of Korean individuals were leaked on a cybercrime forum. DATACARRY was also mentioned among ransomware variants observed targeting European financial institutions, alongside Akira and BlackLock. Additional reporting in the content links the group to a Volvo data breach associated with a Miljödata ransomware incident. Across the supplied material, the highest-confidence characterization is that DATACARRY is a newly emerged 2025 ransomware/extortion brand focused on data exfiltration and public leak pressure, with observed activity affecting organizations in multiple countries and mentions of targeting in the financial sector.