BPG Building Partners Group targeted by Inc Ransom

• Ransomware group: Inc Ransom
• Country: Germany
• Sector: Manufacturing
• Announcement date: September 14, 2025

Inc Ransom claims data compromise of BPG Building Partners Group

The Inc Ransom ransomware group has listed BPG Building Partners Group on its leak site, claiming to have compromised the organization's data. This announcement, made on September 14, 2025, follows a period of alleged unauthorized access to the organization's systems.

Details of the alleged attack

According to the claims made by the Inc Ransom group, the organization's networks were accessed and data was exfiltrated as part of this incident. The group has published a listing related to BPG Building Partners Group on its leak platform. While the announcement was made recently, the group listed files related to the organization on April 17, 2024, suggesting the initial breach or the listing of files occurred much earlier than the recent announcement.

Ransomware groups often utilize leak sites to pressure victims into paying ransoms. These sites serve as a public gallery where attackers post evidence of their successful intrusions. In many cases, these groups employ a tactic known as double extortion. In this scenario, attackers do not just encrypt a company's files to disrupt operations; they also steal sensitive information beforehand. This allows them to threaten the victim with the public release of their data if the ransom is not met, significantly increasing the pressure on the targeted organization.

Data involvement and content

Regarding the specifics of the incident, no specific details regarding the content of the leaked data have been shared by the threat actor. The available information is limited to a screenshot which displays a general listing of files, rather than a detailed inventory of the stolen information.

The listing names no specific data types.

Organization profile

BPG Building Partners Group is a construction and building services company based in Germany. The company operates in various construction projects within the manufacturing sector.

Impact assessment and industry risks

This incident may negatively impact the organization's operational continuity and commercial reputation. Because the organization is based in Germany, potential legal sanctions under GDPR may arise if the leaked data includes personal information. The use of double extortion tactics by the Inc Ransom group increases the risk of data publication or sale.

Furthermore, secondary risks may emerge for the organization's employees and business partners, such as identity theft or targeted phishing attacks. Ransomware groups like Inc Ransom, which has been known to be active since mid-2023 and employs similar methods, often target various sectors to maximize their impact through these secondary vectors.

For organizations operating in the construction and manufacturing sectors, maintaining robust cybersecurity postures is essential to mitigate these risks. Common defensive steps include implementing multi-factor authentication across all remote access points, maintaining offline backups of critical data, and conducting regular security awareness training for employees to recognize phishing attempts. Additionally, monitoring network traffic for unusual exfiltration patterns can help detect unauthorized access before data is successfully moved out of the environment.