THREAT WATCH · September 26, 2026 · RANSOMWARE LISTING

M3RX Records US IT Firm cipher.systems on Leak Tracker

cipher.systems, a US-based IT company, has been recorded on the leak tracker operated by the ransomware group M3RX. The listing appeared on September 26, 2026. The company employs between 51 and 100 people and operates in the information technology sector. As of this writing, cipher.systems has not made any public statement about the listing. A leak-site entry is a strong indicator of a possible intrusion but does not by itself confirm that data was stolen or that systems were compromised.

Key takeaways

• cipher.systems appears on the M3RX ransomware leak tracker as of September 26, 2026
• The company is a US-based IT firm with 51-100 employees
• No public disclosure has been made by cipher.systems
• A leak-site listing is a strong signal but does not confirm a breach

What the listing shows

• The organization cipher.systems appears on the M3RX tracker.
• The domain cipher.systems is associated with the listing.
• The company is based in the United States and operates in the IT sector.
• The entry was recorded on September 26, 2026.
• No public disclosure has been made by the company.

About M3RX

M3RX is a ransomware group that maintains a public leak tracker where it lists organizations it claims to have targeted. The group publishes entries over time and has been active in recording victims across multiple sectors and geographies. A listing on such a tracker typically means the group alleges it holds data from the organization, though the accuracy of these claims is not independently verified. Organizations listed on leak sites sometimes confirm incidents later, while in other cases the claims prove to be exaggerated or false.

What this means for cipher.systems

• The company may be dealing with a ransomware incident that has not yet been publicly acknowledged.
• Customers, partners, and employees should watch for any official communication from the company in the coming days.
• If the listing is accurate, sensitive data associated with the organization could be at risk of exposure.
• The company's silence so far is not unusual. Some organizations take days or weeks to confirm incidents while they investigate internally.

What other organizations should do

• Review your own exposure to third-party IT providers of similar size and sector.
• Confirm that your incident response plan covers scenarios involving supply-chain compromise.
• Monitor for any downstream effects if cipher.systems serves as a vendor in your environment.
• Treat the listing as a signal to verify your own security posture rather than a reason for panic.
• Check whether your contracts with IT vendors include breach-notification obligations and response-time requirements.

Bottom line

The M3RX listing against cipher.systems is a notable signal for the IT sector and for US-based mid-size technology firms. It does not confirm a breach, but it warrants attention from anyone who relies on the company's services. Intel128 will continue to track this entry and update if the company issues a disclosure or if additional details emerge from the tracker.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.