Illustration: JMiks | Shutterstock

A new ransomware gang called Arkana Security claims to have attacked US telecom provider WideOpenWest (WOW!). The cybercriminals claim to have stolen customer data and taken control of critical systems on the company’s network.

The breach was first discovered by vx-underground, claiming that Arkana has accessed over 403,000 customer accounts and taken control of systems like AppianCloud and Symphonica. This data includes usernames, passwords, security questions, and service package details. The group even posted a video demonstrating their access to the systems.

Arkana ransomware group claims to have compromised "Wide Open West – WOW!", one of the largest Internet Service Provider's in the United States.

First and foremost: we have never heard of Arkana ransomware group. We've seen some researchers mention them via their onion domain —… pic.twitter.com/lpA3MKlCHk
— vx-underground (@vxunderground) March 25, 2025

Security firm SOCRadar did a technical analysis of the breach and found that the ransomware group specialised in exploiting vulnerabilities in corporate systems. They also seem financially motivated, as their focus is clearly on extorting any data they can get their hands on.

According to the group’s Tor website, the operations run on a three-phase model, with the group first demanding a ransom. If a ransom isn’t paid, they try to sell off the data, and if they fail, they release it to the public. The group hasn’t been assigned any concrete affiliations yet, but SOCRadar’s report claims the language used on their website and the video shared by vx-underground suggest the group originated in Russia or is affiliated with a Russian state-sponsored threat actor.

This is an image of arkana website — *Arkana Security’s dark web website. | Source: SOCRadar*

WideOpenWest seems to be Arkana’s first victim, as no other compromised companies are listed on its website. What’s more worrying is the ransomware group’s alleged unrestricted access to the firm’s Symphonica system, which they claim can be used to spread malware onto customer devices.

WOW! hasn’t officially confirmed the breach. SOCRadar’s report claims it could cause “significant reputational damage and potential legal regulatory repercussions. ” Exposing sensitive customer data undermines the company’s trust, not to mention the heavy financial investments required to fix the breach and upgrade security systems.

In the News: Chinese hackers remained undetected in Asian telco’s network for 4 years