[News](/news) Randstad victim of Egregor cyber attack [Blog](/blog)[Breaches](/breaches)[Resources](/resources)[News](/news) # Randstad victim of Egregor cyber attack ##### [Edward Kost](/team/edward-kost) December 6, 2020 Randstad, the global recruitment firm, has fallen victim to a cyber attack by the [notorious ransomware gang Egregor](https://www.upguard.com/blog/what-is-egregor-ransomware). In its [official statement,](https://tools.euroland.com/tools/pressreleases/GetPressRelease/?ID=3845464\&lang=en-GB\&companycode=NL-RAND\&pid=2) Randstad said that defensive tactics were implemented as soon as the data breach was discovered. “Prompt global action was taken to mitigate the incident while further protecting Randstad’s systems, operations, and data. As a result, a limited number of servers were impacted.” They said in their statement. Investigations carried out by the emergency response teams revealed that the ransomware group Egregor was responsible for the cyber attack. “To date, our investigation has revealed that the Egregor group obtained unauthorized and unlawful access to our global IT environment and to certain data, in particular related to our operations in the US, Poland, Italy, and France.” #### Who is the Egregor group? Egregor group operates on a ransomware-as-a-service model. They offer their services to criminal affiliates for a share of the ransom payments. The Egregor group profit to affiliate earning distribution is usually about 30% to 70%. It is speculated that the operators behind the recently dissolved ransomware group Maze formed Egregore because their victim demographics and malware signatures are very similar. This evidence is contrary to Maze’s claim that they do not have any successors. In Q4 of 2020 alone, over 71 businesses have fallen victim to the Egregor group ransomware.  Randstad is not the only high-profile victim in the past week. [Kmart was the latest victim](https://www.upguard.com/news/kmart-servers-breached-in-cyber-attack) of an Egregor ransomware assault. Ergregor operates on a double-extorsion model.  First, they encrypt all of the [sensitive data accessed in the data breach](https://www.upguard.com/product/breach-risk/threat-monitoring) and present victims with a provocative ransom note. The note demands a hefty ransom payment in exchange for a complete reversal of the malicious act. Then, they’ll begin publishing the victim's [Personal Identifiable Information](https://www.upguard.com/blog/personally-identifiable-information-pii) to the [dark web](https://www.upguard.com/blog/dark-web) and not stop until the ransom is paid. Randstad confirmed in its official statement that the Egregor group had already published some of its breached data. “They have now published what is claimed to be a subset of that data. The investigation is ongoing to identify what data has been accessed, including personal data, so that we can take appropriate action with regard to identifying and notifying relevant parties.” Egregor group victims are instructed to download a dark web browser and submit a supplied data recovery agreement via a dedicated landing page within three days. ## How secure is Randstad? Randstad provides human resources services including temporary and permanent staffing, recruitment, workforce management, and talent solutions to organizations across multiple industries. The company operates as a global employment agency connecting job seekers with employers. * View our free preliminary report on Randstad’s security posture * 13 risk factors, including email security, SSL, DNS health, open ports and common vulnerabilities [View Randstad's score](/security-report/randstad) [View score](/security-report/randstad) [https://www.randstad.com/](/security-report/randstad) ### Sign up for our newsletter UpGuard's monthly newsletter cuts through the noise and brings you what matters most: our breaking research, in-depth analysis of emerging threats, and actionable strategic insights. ## Latest news Stay up-to-date with the latest news in cybersecurity. [](/news/hugging-face-data-breach-2026-07-20) #### [Hugging Face data breach: key facts and what we know so far](/news/hugging-face-data-breach-2026-07-20) A data breach involving Hugging Face was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 20, 2026 [](/news/ey-data-breach-2026-07-19) #### [EY data breach: what happened and what's at risk](/news/ey-data-breach-2026-07-19) A data breach involving EY was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) #### [South Florida Injury & Convenient Care data breach exposes names and Social Security numbers](/news/south-florida-injury-convenient-care-data-breach-2026-07-16) A data breach involving South Florida Injury & Convenient Care was reported in July 2026. See incident details, impact on customers, and security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/park-west-psychology-data-breach-2026-07-16) #### [Park West Psychology data breach: what happened and what's at risk](/news/park-west-psychology-data-breach-2026-07-16) A data breach involving Park West Psychology was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 15, 2026 [](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) #### [Fall River Municipal Credit Union data breach: what happened and what's at risk](/news/fall-river-municipal-credit-union-data-breach-2026-07-16) A data breach involving Fall River Municipal Credit Union was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [](#) July 14, 2026 [](/news/npcil-data-breach-2026-07-16) #### [NPCIL data breach: World Leaks claims exposure of Kudankulam Nuclear Power Plant files](/news/npcil-data-breach-2026-07-16) A data breach involving NPCIL was reported in July 2026. See incident details, impact on customers, and recommended security measures. ##### [UpGuard Team](/team/upguard) July 14, 2026 [View all news](/news) ## Protect your organization Get in touch or book a free demo. [Contact sales](/demo) [Free demo](/demo) ##### Free instant security score ## How secure is your organization? Request a free cybersecurity report to discover key risks on your website, email, network, and brand. * Instant insights you can act on immediately * Hundreds of risk factors including email security, SSL, DNS health, open ports and common vulnerabilities [Free score](/instant-security-score)