Bender Tribunenbau targeted by Lamashtu ransomware group

• Ransomware group: Lamashtu
• Country: Germany
• Sector: Manufacturing
• Announcement date: October 5, 2026

Lamashtu claims data breach against Bender Tribunenbau

The threat actor known as Lamashtu has published a data leak announcement on its leak site, claiming to possess a significant amount of data belonging to the German organization Bender Tribunenbau. According to the announcement made on October 5, 2026, the group asserts they have exfiltrated a large volume of sensitive information from the company.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms through a tactic known as double extortion. In these scenarios, attackers not only encrypt a company's internal systems but also steal sensitive data, threatening to release it publicly if their demands are not met. While the specific ransom demand for this incident has not been disclosed, the publication of the victim's name on a leak site is a standard method used by such groups to increase pressure on the target organization.

Details of the alleged data exfiltration

The announcement by Lamashtu claims that the breach involves a massive amount of data, specifically totaling 30 GB. This stolen information is said to consist of approximately 45,000 files. The timeline of the data involved is broad, with the threat actor asserting that the files span the years 2021 to 2026. The group claims that the stolen information encompasses various aspects of the company's business, including its general operations, personnel records, and various project-related documentation.

According to the information provided in the leak announcement, the specific types of data involved include:

• Payroll records
• Personnel files
• Structural engineering documents
• Project calculations
• Tender submissions
• Corporate correspondence

The leaked data is reported to include correspondence related to major sporting events held across Europe, indicating the broad reach of the company's business operations. At this stage, public information regarding the specific methods, motivations, or technical capabilities of the Lamashtu group remains limited.

Organization profile: Bender Tribunenbau

Bender GmbH Tribunenbau is a German-based manufacturer specializing in the production of mobile and permanent grandstands, stages, and temporary structures designed for various events. The company's service portfolio includes the design, rental, sales, and maintenance of tribunes used in a variety of settings, such as stadiums, festivals, and concerts.

Potential impacts and security considerations

The alleged leak of this data may pose significant secondary risks to both Bender Tribunenbau and its associated parties. For employees and business partners, the exposure of personnel files and payroll records could lead to risks such as identity theft or the execution of targeted phishing attacks. Such attacks often leverage stolen personal information to gain further access to corporate networks or to defraud individuals.

Furthermore, the exposure of project and tender documents could have serious commercial consequences. Given that the company is deeply involved in major sporting events across Europe, the loss of competitive documentation, such as project calculations and tender submissions, could impact the company's commercial competitiveness. Additionally, the exposure of structural engineering data could create long-term implications for the company's operational security.

Because the company is based in Germany, this incident may result in legal sanctions and data privacy violations under the General Data Protection Regulation (GDPR). Organizations operating in the manufacturing and event infrastructure sectors often face these types of risks and typically focus on defensive measures such as implementing robust encryption, maintaining strict access controls, and conducting regular security audits to mitigate the impact of potential breaches.