England Hockey investigating a major ransomware attack on its systems

The AiLock ransomware group claimed that it stole about 129 gigabytes of data from England Hockey’s network and has threatened to leak the data online if a ransom isn’t paid.

 

The ransomware group made the claim on Friday but did not share a sample of the stolen data and did not state whether the stolen data contained personal information or intellectual property.

 

England Hockey, the national governing body that manages, develops and markets field hockey through competitions, events and coaching programmes across men’s and women’s disciplines, did not announce suffering a cyber security incident at the time of reporting.

 

The governing body, however, shared a statement with BleepingComputer, stating that it was aware of the ransomware group’s claims and is investigating the incident. 

 

"We are aware of an incident involving England Hockey and are currently investigating the matter as a priority. As part of this investigation, we recently became aware of a post from the group claiming to be responsible for this incident," a spokesperson from England Hockey said.

 

"We are working with external specialists to help understand what this means. We are also cooperating with all relevant authorities, including law enforcement," they added.

 

England Hockey is a large governing body that manages a vast network of more than 800 hockey clubs, more than 150,000 club-level players and about 15,000 coaching and officiating staff. The organisation generates around £10 million in annual revenue, with most of the money coming from annual player registration fees and sponsorships. 

 

The organisation likely holds personal and professional information of hundreds of thousands of current and former players, including minors, coaches, officials, and other individuals associated with the sport in various capacities. It is unclear what data was accessed by the AiLock ransomware group, but England Hockey’s website and apps are functional as of Tuesday.

 

AiLock is a relatively new ransomware group whose emergence was first observed in early 2025. The group routinely targets organisations worldwide with the double extortion method to force victims to pay a ransom to regain access to their data and avoid publication. 

 

The group primarily uses phishing attacks, credential theft or vulnerability exploitation to gain access to enterprise networks, uses privileged access to move laterally within networks undetected, exfiltrates stored data and deploys ransomware code to encrypt targeted systems.