Shora Advisory listed by the Tengu ransomware group

Overview

The Tengu ransomware group has listed Shora Advisory, a network of accounting, consulting and auditing firms in Morocco, on its leak site. The network provides financial management consulting, accounting, legal and tax expertise. The listing appeared on 20 February 2026.

What was published

The group claims to have exfiltrated data from the advisory network. Accounting and audit firms hold client financial records, tax documents and employee information, which are the likely contents of any exfiltration. At the time of analysis, the group's leak page was not reachable.

Risks for affected individuals

• Clients' financial data may be exposed.
• Tax and accounting records could enable fraud.
• Employees' information may be included.

What remains unknown

• The volume of data exfiltrated.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

Clients should monitor financial accounts and verify any unusual requests. Shora should notify clients and staff, review its systems, and report the incident to Moroccan authorities.