BRIEFRansomwarelowP40
Lamashtu ransomware publishes German builder Hecker Holzsystembau
Hecker Holzsystembau
Detected22 October 2026 · 05:37 UTC
The lamashtu ransomware group has listed German timber-construction firm Hecker Holzsystembau as a victim, meaning stolen data is likely being extorted or released. Leaked corporate files can expose client contracts, project plans and internal credentials used for supply-chain and phishing attacks. The victim is outside Latin America, so this is context rather than a regional alert.
CategoryRansomware
Severitylow
Priority score40
Detected22 October 2026 · 05:37 UTC
Ransomware● 56
Ransomware Everest publica a la firma legal Linebarger Goggan Blair & SampsonThe Everest ransomware group has listed Linebarger Goggan Blair & Sampson, a US law firm that specializes in delinquent tax collection for municipalities, counties and school districts across multiple states. Such a breach could expose sensitive personal and financial data of citizens and public-entity clients, plus potentially disrupt government revenue processes. Though outside the AR-LATAM region, the public-sector data exposure warrants monitoring for downstream targeting.Ransomware● 57
IncRansom publica al bufete canadiense Bereskin Parr y Smart & BiggarThe IncRansom leak site has published Bereskin Parr / Smart & Biggar, a Canadian intellectual-property law firm, claiming theft of client case data and related files. IP firms concentrate patent, trademark and litigation material for corporate clients, so a confirmed leak can expose trade secrets and third-party confidential information well beyond the firm itself. Defenders should treat this as a live extortion case and monitor for downstream publication of client data.Ransomware● 45
Ransomware n0n publica a la proveedora sanitaria estadounidense Heritage Senior LivingGroup n0n has published Heritage Senior Living, a US healthcare support services provider, claiming to hold network security configurations, internal segmentation maps and remote access account structures, marked as unpaid and exposed. That mix of remote-access and segmentation detail is exactly what enables follow-on intrusion or lateral movement against healthcare networks. It is a live victim listing, but outside the Latin America region, so it ranks below regional incidents.Ransomware● 44
Ransomware lamashtu publica a la química WEPOS ChemieThe lamashtu group listed WEPOS Chemie, a German maker of specialized cleaning and care products. Ransomware against a chemicals manufacturer risks operational and data disruption. Part of a cluster of lamashtu listings targeting German and French industrial firms.Ransomware● 46
Ransomware lamashtu publica al fabricante MECA-PRECISThe lamashtu group listed MECA-PRECIS, a French precision-stamping and metal-components manufacturer serving automotive and appliance industries. Ransomware disruption to a manufacturing supplier can cascade to OEM production lines. Signals ongoing lamashtu activity against European manufacturers.Ransomware● 54
Ransomware lamashtu publica al integrador FuG-GruppeThe lamashtu ransomware group listed FuG-Gruppe, a German IT systems integrator (Systemhaus) and ERP provider for industrial and steel-trading firms. As a managed IT/ERP supplier, a compromise here creates supply-chain risk for many downstream industrial clients. Relevant for defenders tracking integrator exposure.