Cyber Threat Actor: Wicked Group

Wicked Group is a threat actor thatoperates under that alias and has been identified as being based in the United Kingdom. The actor entered the public record after a security incident was reported on 17 January 2021 involving the Wentworth Club, a private golf club situated in the UK. According to the breach notification published by the club and covered by security news outlets, the intrusion consisted of unauthorized access to the club’s internal systems. The attacker succeeded in copying membership records that contained personal information of the club’s members. The incident was described as affecting more than four thousand individuals, a figure that includes several members who are noted for their public prominence. The Wentworth Club itself is characterized in reporting as an establishment known for its affluent membership base.

The club’s response to the breach included sending individual notices to all affected parties, advising them to monitor their accounts for signs of misuse and to consider additional protective measures. In a public statement, the organization expressed regret for the incident and offered an apology to those whose data had been accessed. The notification did not specify which data fields were exfiltrated, leaving the exact nature of the compromised information undisclosed. Furthermore, the club did not reveal the technical details of how the intrusion was achieved, such as the initial entry point, any malware employed, or the tools used by the attacker. No additional incidents or campaigns have been publicly linked to Wicked Group, and no further technical details about the actor’s tooling, infrastructure, or affiliations have appeared in open‑source reporting. As a result, the current public knowledge of Wicked Group is limited to the single attributed event at the Wentworth Club and the basic descriptor of its United Kingdom location.