Apple is facing a ransomware demand after a group of cybercriminals stole confidential plans for the company’s upcoming products from a supplier. The “Sodin” group, which makes and runs a piece of ransomware called REvil, says it stole the plans from Quanta Computer, a Taiwanese company that assembles a number of Apple laptops. Like normal ransomware, REvil encrypts victims’ files and demands payment to receive the encryption key and recover the data. But Sodin has gone one step further, attempting to steal the files themselves and extort payment from those who have backups by threatening to publish confidential data. According to a statement posted on the criminals’ dark web site – which they call the “Happy Blog” – Quanta refused to pay the ransom, leading the hackers to begin threatening the company’s customers. “In order not to wait for the upcoming Apple presentations, today we, the REvil group, will provide data on the upcoming releases of the company so beloved by many,” the blog says. “Tim Cook can say thank you Quanta. From our side, a lot of time has been devoted to solving this problem.” The hackers claim that among the stolen documents are plans for a pair of Apple laptops, a new Apple Watch and a new Lenovo ThinkPad. To back up their assertions, they have posted a set of blueprints for some products, including schematics for the new iMacs that the company launched on Tuesday. The ransomware demand was initially posted just hours before the company’s launch event, and the hackers say they will release more documents every day, adding: “We recommend that Apple buy back the available data by 1 May.” A similar extortion attempt from the same group, aimed at Acer, demanded $50m in exchange for deleting the files. Already, internet users have begun to pore over the details of the leaks, noting differences with the current models on sale: a new version of the MacBook Pro is shown without the company’s controversial “Touch Bar”, for instance, and a potential return of HDMI ports, SD card readers and MagSafe connectivity to the machine. Apple did not respond to a request for comment.