# Four Hands LLC Listed as Ransomware Victim

Published: 2026-10-06 · Severity: high · Sectors: manufacturing, retail
Canonical: https://vorant.io/reports/ab794319-cac4-50c1-8454-e0b023f51980/four-hands-llc-listed-as-ransomware-victim

> Ransomware.live lists furniture company Four Hands LLC as a victim, with compromised credentials and employee data exposed per a leak-site entry.

This is a brief victim-notification entry from Ransomware.live, a tracking platform that aggregates publicly posted claims from ransomware operators' leak sites. The entry identifies Four Hands LLC (listed under the UmBra ransomware group's victim index) as having compromised data, including 6 compromised employees, 156 compromised users, and 2 third-party employee credential sets, along with 21 external attack surface findings and DNS records for the victim's domain.

The article itself provides no technical details about the intrusion vector, ransomware variant behavior, ransom demands, or specific data exfiltrated — it is a minimal aggregator listing rather than original research or incident analysis. No indicators of compromise, exploited vulnerabilities, or TTPs are described. The mention of Hudson Rock's infostealer intelligence tools in the sponsorship suggests credential theft via infostealer malware may be a contributing factor in the broader threat landscape of ransomware access, but this is not explicitly tied to the Four Hands incident.

Defenders at Four Hands LLC or affiliated third parties should treat this as a notification to investigate potential credential compromise, review exposed external attack surface, and monitor for data leak disclosure from the named ransomware group (UmBra). Organizations more broadly should consider infostealer-driven credential theft as a precursor risk to ransomware and ensure credential hygiene and dark web/leak monitoring are in place.

## Mentioned in this report

- Threat actors: UmBra

Source reporting: https://www.ransomware.live/id/Rm91ciBIYW5kcyBMTENAVW1CcmE=

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/ab794319-cac4-50c1-8454-e0b023f51980/four-hands-llc-listed-as-ransomware-victim.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup