Carrier AB listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Sweden
• Sector: Manufacturing
• Announcement date: July 25, 2026

Deadlock ransomware group claims breach of Carrier AB

The Deadlock ransomware group has listed the Swedish logistics company Carrier AB on its dedicated leak site. According to the announcement made on July 25, 2026, the threat actor group claims to have gained unauthorized access to the organization's systems. This type of activity is a hallmark of modern ransomware operations, where attackers often employ double extortion tactics. In such scenarios, threat actors not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage, threatening to publish it on public leak sites if a ransom demand is not met.

The claim made by the Deadlock group suggests a significant breach of the company's digital perimeter. By publishing a directory of files, the group aims to demonstrate the validity of their intrusion and pressure the victim. While the specific details regarding the exact method of entry or the total volume of data stolen remain unconfirmed, the presence of the company on a leak site indicates a high-pressure situation for the targeted entity.

Details of the claimed data exposure

The announcement by the Deadlock group includes a directory of various documents and spreadsheet files that appear to relate to the company's internal operations. Based on the information provided by the group, the leaked data consists of files in .xlsx, .docx, and .pdf formats. These file types are commonly used in corporate environments and can contain a wide variety of sensitive business information.

The files identified in the leak may include various types of internal documentation. Specifically, the exposure potentially involves:

• Employee reports
• Operational plans
• Internal correspondence

The exposure of such documents poses a significant risk to the organization. Documents such as internal correspondence and employee reports can contain private information, while operational plans may reveal the strategic direction and logistical workflows of the company. The availability of these files on a public platform allows unauthorized parties to scrutinize the company's internal processes.

About Carrier AB

Carrier Transport AB is a Swedish logistics and transport company. The company operates out of Jordbro, near Stockholm. As a player in the logistics and transport sector, the company's operations are heavily dependent on the integrity and availability of its digital information and communication systems to manage supply chains and transport schedules.

Implications and potential risks

This leak may pose a risk due to the potential exposure of the company's operational data and employee information. As a Swedish-based entity, it is likely that the leaked data will be subject to GDPR regulations, potentially triggering legal and compliance processes. Organizations operating within the European Union must adhere to strict data protection standards, and a breach of this nature often necessitates formal investigations and notifications to regulatory bodies.

Furthermore, the exposed files could contain sensitive information regarding the company's supply chain and business partners. This type of information is highly valuable to malicious actors, as it might facilitate secondary attacks against the company's partners or vendors. Such a ripple effect is a common concern in the logistics sector, where interconnected digital networks mean that a breach in one company can potentially create vulnerabilities across a wider network of business associates.

Information about the Deadlock group is limited; therefore, their motivations and future actions remain uncertain. In response to such incidents, organizations typically focus on containment, eradication, and recovery. This includes identifying the root cause of the breach, securing affected systems, and fulfilling data breach notification obligations to inform the affected parties. For companies in the manufacturing and logistics sectors, maintaining robust cybersecurity hygiene, such as multi-factor authentication, regular security audits, and employee training, remains a critical defensive strategy to mitigate the impact of such threats.