A relatively new ransomware group known as Hyflock has listed Australian company TCA Accountants & Bookkeepers (tcadarwin.com.au) on its dark web leak site, claiming the organisation as its latest victim.
Hyflock has only been active since 13 October 2026, making it a relatively new addition to the ransomware threat landscape. This latest listing represents the group’s 15th known victim claim and its first identified victim in Australasia.
Given the group’s short operational history, caution should be exercised when assessing its claims. A listing on a ransomware leak site does not independently confirm that an organisation has been compromised or that data has been successfully exfiltrated.
Hyflock
Hyflock Ransomware Group is an active ransomware actor. In October 2026, it released Hyflock Ransomware 2.0 and launched an extortion blog. Reporting through November 1, 2026, linked the group to victims in India, Türkiye, the United States, Gabon, Vietnam, Ecuador and other countries across manufacturing, healthcare, hospitality, government, and technology.
The group operates a ransomware-as-a-service model and was supposedly observed advertising for affiliates in March and May 2026.
About TCA Darwin
TCA Accountants & Bookkeepers is a Darwin-based professional services firm in the Northern Territory, Australia. Established in 2011, the company provides accounting, taxation, bookkeeping and business advisory services to individuals, small and medium-sized businesses, and other organisations.
Its services also include business process improvement, automation and data analytics.
At the time of writing, there has been no independent verification of Hyflock’s claims or confirmation of the extent of any potential data exposure.
We will continue monitoring the group’s activities and any further developments relating to this alleged incident.
