ASELSAN listed on CRPxO ransomware leak site

• Ransomware group: CRPxO
• Country: Türkiye
• Sector: Government & Defense
• Announcement date: July 31, 2026

ASELSAN listed on CRPxO ransomware leak site

The Turkish defense industry company ASELSAN has been listed on the leak site of the ransomware group known as CRPxO. The threat actor claims to have successfully exfiltrated and leaked data belonging to the organization.

Details of the claimed attack

According to the announcement made on the CRPxO leak site, the group claims to have obtained data belonging to ASELSAN. The threat actor announced this breach on July 31, 2026, and asserts that the attack took place on the same date. The group's claim involves a total data volume of 4.5 GB. Information regarding this specific threat actor remains limited in the public domain, making it difficult to establish a comprehensive profile of their typical tactics or motivations.

Ransomware groups often utilize leak sites to exert pressure on their victims through a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption process begins. By threatening to release this stolen data on a public platform, the attackers aim to coerce the victim into paying a ransom to prevent the exposure of confidential information. This method increases the leverage held by the cybercriminal group, as the threat of reputational damage or legal consequences often outweighs the cost of the ransom itself.

Data involved in the incident

Regarding the specific contents of the alleged breach, there is no detailed information available. The group has not provided any screenshots or specific file lists to substantiate their claims. Consequently, the listing names no specific data types or categories of information that have been compromised.

About ASELSAN

ASELSAN is a Turkey-based defense industry company established to meet the communication needs of the Turkish Armed Forces. The organization develops and manufactures high-tech electronic systems designed for both military and civilian sectors.

Risk assessment and implications

The alleged incident may pose a significant risk to the institution's sensitive defense-related data. Until the specific content of the leaked data is clarified, it remains uncertain whether the leak involves personal data under GDPR/KVKK or corporate trade secrets. The publication of such data could lead to reputational damage and the exposure of strategic information vital to the organization's mission.

Furthermore, if the leaked data were to include employee or partner information, it could be utilized by threat actors for secondary attacks or targeted phishing campaigns. Such secondary attacks often involve social engineering techniques where attackers use stolen personal details to gain further access to corporate networks or to deceive individuals within the organization.

For organizations operating within the government and defense sectors, such incidents highlight the necessity of robust security protocols. Common defensive steps for organizations in these high-stakes sectors include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized data movement, and conducting regular security audits. Additionally, organizations may need to review their security protocols and assess potential data breach notification obligations to ensure compliance with relevant legal frameworks and to mitigate the impact of the exposure.