Deadlock ransomware group claims data breach against FIRESTA

• Ransomware group: Deadlock
• Country: Czechia
• Sector: Manufacturing
• Announcement date: July 10, 2026

Deadlock ransomware group claims data breach against FIRESTA

The Deadlock ransomware group has published a claim on its leak site involving the Czech construction company FIRESTA. According to the announcement made on July 10, 2026, the threat actor alleges that they have successfully exfiltrated a significant volume of data from the organization's network.

Details of the alleged attack

The threat actor known as Deadlock has listed data allegedly belonging to FIRESTA on its leak platform. The announcement indicates that the group has claimed to have obtained approximately 371.42 GB of data from the company's network. This information is presented as being shared across 26 compressed files. The group claims that this data has been made accessible on their platform. It is important to note that public information regarding the specific activities and background of the Deadlock group remains limited.

In many modern ransomware campaigns, threat actors utilize a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information before the encryption phase. The goal is to pressure the victim into paying a ransom by threatening to release the stolen data publicly. This method increases the leverage held by the attackers, as the threat of a data leak can cause lasting damage to a company's reputation and legal standing, even if the organization can restore its systems from backups.

The visual evidence provided in the leak listing shows compressed archive files that begin with the naming convention 'firesta.zip'. These archives consist of a total of 26 parts. However, the group has provided no specific description regarding the actual content contained within these files.

The affected organization

FIRESTA, specifically identified as Firesta-Fišer, a.s., is an established Czech construction company that has been in operation since 1990. The company specializes in complex transport infrastructure projects, including the construction of bridges, roads, and railways. While headquartered in the Czech Republic, the organization maintains a significant regional presence, operating in Slovakia, Poland, and Romania. The company employs a workforce of over 600 people.

Potential impacts and industry considerations

The claim of a data leak poses several significant risks to the organization. Such an event can threaten the company's operational continuity and its commercial reputation. Because FIRESTA is based in the Czech Republic, any leaked data may fall under the scope of the European Union's General Data Protection Regulation (GDPR). This regulatory framework imposes strict requirements on data handling, and non-compliance or successful breaches can lead to substantial administrative fines for the organization.

Furthermore, if the leaked data contains sensitive information belonging to employees or business partners, secondary risks may emerge. These include the potential for identity theft or the execution of targeted phishing attacks against the individuals involved. For a company operating within the construction and infrastructure sector, the stakes are particularly high regarding proprietary information. If the stolen data contains trade secrets or specific project details, it could lead to negative impacts on the company's competitive advantage.

To mitigate such risks, organizations in the infrastructure sector often implement various defensive measures. These include robust network segmentation to prevent lateral movement by attackers, comprehensive encryption for data at rest and in transit, and rigorous access controls to ensure that only authorized personnel can reach sensitive project files. Additionally, continuous monitoring and employee training programs are essential components of a modern cybersecurity posture designed to detect and prevent unauthorized data exfiltration.