American Vanguard
osiris listed this organization on its leak site on Jan 9, 2026.
- Listing date
- Jan 9, 2026
- Attack date
- Jan 9, 2026
Listing text
American Vanguard Corporation is a U.S.-based company specializing in agricultural chemicals, primarily focused on crop protection products like herbicides, insecticides, fungicides, and fumigants. Founded in 1969 and headquartered in Newport Beach, California, the company markets products under its AMVAC brand and other specialized labels, serving global agricultural markets. Through a combination of research and development, strategic acquisitions, and a focus on sustainable practices, American Vanguard aims to enhance crop yields while minimizing environmental impact. It invests in greener alternatives to traditional chemicals and emphasizes innovation in pest control solutions. As a publicly traded company (NYSE: AVD), its financial performance is closely tied to agricultural trends and regulatory changes within the industry.
About the group
osiris posted its first listing on Dec 18, 2025 and has listed 2 organizations to date.
Osiris is a ransomware-as-a-service operation first observed in November 2025 that uses a Bring Your Own Vulnerable Driver (BYOVD) technique to disable endpoint detection tools before deploying hybrid ECC + AES-128-CTR encryption; Symantec researchers linked its operators to former INC ransomware affiliates.
Learning center
What does this listing mean?
Ransomware groups move data out of the organization before encrypting systems and threaten to publish it if the ransom is not paid. This method is called double extortion.
The listing shows that the group claims to have targeted the organization. Whether the data was published is shown by the later status of the listing.
What should you do if your organization is listed on a leak site?
- Record the listing and any published sample files; do not visit the leak site from the corporate network.
- Isolate affected systems and preserve logs without deleting them.
- Determine which data left the organization; if personal data is involved, review notification obligations with your legal team.
- Make any decision about the ransom demand together with legal, management and incident response.
- Do not bring systems back online before the attacker’s entry point is closed.
Is your organization mentioned?
Search with your domain to check whether your organization appears in ransomware listings, leaked records, forums and Telegram channels.
Search your domainIntelligence 360
Customer intelligence on top of Infostealer Detection: leaked accounts of end users who sign in to your site.