Deadlock claims data breach against Bulgarian logistics firm bERS

• Ransomware group: Deadlock
• Country: Bulgaria
• Announcement date: July 10, 2026

Deadlock claims to have leaked data belonging to bERS

The ransomware group known as Deadlock has officially listed the Bulgarian logistics company bERS on its dedicated leak site. According to the announcement made on July 10, 2026, the threat actor group claims to have successfully compromised the company's data. This development follows a pattern often seen in modern cyberattacks where groups use public-facing leak sites to pressure victims by threatening the exposure of sensitive information.

At this stage, the claims made by the group remain unverified. While the group has listed the organization, the actual presence of stolen data on the site is currently unclear. Technical analysis of the provided evidence shows that the directory associated with this listing appears to be empty and returns an HTTP 403 error when accessed. Furthermore, public information regarding the specific tactics, techniques, and procedures of the Deadlock group remains limited in the public domain.

Details regarding the alleged data breach

Regarding the content of the alleged breach, there is currently no information available concerning the specific nature or types of the data that may have been targeted. The listing does not provide details regarding the volume of files involved or the specific file count. Furthermore, there is no information available regarding a ransom demand or the specific amount requested by the attackers.

The listing names no specific data types.

About bERS

bERS is a logistics company based in Bulgaria. The organization provides a range of logistics services, including high-quality 3PL outsourcing of integrated logistics services. As a provider in the logistics sector, the company plays a role in the movement and management of goods through integrated supply chain solutions.

Risk assessment and industry implications

Given the nature of the services provided by bERS, it is assessed that if the claims made by Deadlock are verified, both operational data and customer information could be at risk. Because the company operates within Bulgaria, it is subject to the regulatory framework of the European Union, meaning it may face obligations under the General Data Protection Regulation (GDPR) in the event of a confirmed data exposure.

The potential publication of sensitive information could create secondary risks for the company's various supply chain partners. In modern cyber warfare, ransomware groups frequently employ a method known as double extortion. In a double extortion scenario, attackers do not merely encrypt a victim's systems to disrupt operations; they also exfiltrate sensitive data to use as leverage, threatening to leak the information on public forums if the ransom is not paid. This approach increases the pressure on organizations by targeting their reputation and their relationships with clients and partners.

For organizations operating in the logistics and supply chain sectors, maintaining robust security postures is critical. Common defensive strategies often include implementing multi-factor authentication, maintaining rigorous patch management schedules, and ensuring comprehensive offline backups are available. Furthermore, because logistics companies are deeply integrated into larger supply chains, a breach in one organization can potentially create downstream risks for many other entities. Organizations are encouraged to monitor for signs of unauthorized access and to maintain clear incident response plans to mitigate the impact of potential data exfiltration or encryption events.