A101 listed on CRPxO ransomware leak site

• Ransomware group: CRPxO
• Country: Türkiye
• Sector: Retail & E-Commerce
• Announcement date: July 31, 2026

A101 listed on CRPxO ransomware leak site

The major Turkish discount supermarket chain A101 has been listed on the leak site associated with the ransomware group known as CRPxO. According to an announcement made on July 31, 2026, the group claims to have compromised the institution's data, marking a potential security incident for the large-scale retailer.

Details of the claimed attack

The CRPxO group issued an announcement on their leak site regarding the alleged breach. The group claims that they have successfully compromised the data belonging to A101. This claim was officially announced on July 31, 2026, the same day the group asserted the attack took place. While ransomware groups often employ double extortion tactics—where they not only encrypt an organization's systems but also threaten to leak sensitive information to pressure the victim into paying a ransom—the specific details of the demand in this instance remain unknown.

In many such cyberattacks, threat actors target high-profile organizations to maximize their leverage. By publishing a victim's name on a dedicated leak site, these groups aim to cause reputational damage and operational disruption. At this stage, the incident remains an allegation made by the CRPxO group through their public announcement.

Data involved in the alleged leak

Regarding the specifics of the data involved in this incident, the information provided by the threat actor is limited. The group has associated this claim with the release of data estimated to be approximately 0.2 GB in size. However, no detailed information regarding the specific nature of the leaked data has been provided by the group, and no screenshots were shared to verify the contents of the files.

The listing names no specific data types that have been compromised.

About A101

A101 is a major discount supermarket chain in Turkey. The organization operates thousands of stores across the country and is a significant player in the retail sector, selling food and essential consumer goods to a vast customer base.

Security implications and industry context

This incident may indicate potential vulnerabilities in the institution's data security processes. Depending on the nature of the leaked data, obligations for data breach notifications under local regulations, such as the Personal Data Protection Law (KVKK), may arise. The publication of such data could lead to secondary risks, including identity theft or targeted phishing attacks against employees or customers.

In the retail and e-commerce sectors, maintaining robust cybersecurity posture is critical due to the high volume of sensitive consumer information processed daily. When a breach is suspected, organizations typically need to initiate forensic investigations to verify the alleged breach and inform the affected parties. Common defensive steps for organizations facing such threats include strengthening network monitoring, implementing multi-factor authentication, and conducting regular vulnerability assessments to mitigate the risk of unauthorized access.

Information regarding the CRPxO group remains limited, making it difficult to attribute the attack or understand the group's specific methodologies. As with many modern ransomware operations, the lack of transparency from the threat actor complicates the ability of the victim to assess the full scope of the compromise immediately.