Deadlock ransomware group lists Grupolider | Grupo Actual on its leak site

• Ransomware group: Deadlock
• Country: Angola
• Sector: Professional Services
• Announcement date: July 10, 2026

Deadlock claims data breach against Grupolider and Grupo Actual

The threat actor known as Deadlock has listed Grupolider and Grupo Actual on its leak site, claiming a successful data breach. This announcement suggests that the group has gained unauthorized access to the digital infrastructure of these organizations. According to the claim, the stolen data was organized into various folders and was scheduled to be made available for download on May 10, 2026.

Ransomware groups frequently utilize leak sites to increase pressure on their victims through a tactic known as double extortion. In these scenarios, attackers not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The threat of releasing this data publicly serves as leverage to coerce the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the presence of the organizations on a leak site is a hallmark of this extortion method.

Details of the alleged data theft

The group's announcement indicates that the stolen information is contained within several specific directories. Based on the screenshots provided by the threat actor, the folders identified include AMI, Digitaliza (which contains subfolders such as Compras, Despensa, FIN, MRK, Picking, RH, and Vendas), and Novagrolider.Dados. The naming conventions of these folders suggest that the breach may have compromised a wide range of internal information.

The data potentially involved in this incident includes:

• Financial data
• Human resources data
• Operational data

The exposure of such diverse datasets can have significant implications for the internal management and external reputation of the affected entities. The presence of folders related to procurement, sales, and human resources suggests that the scope of the breach could extend into the core administrative functions of the companies.

Organizational profiles

The organizations targeted in this alleged attack represent different geographic regions and business models. Grupolider is an Angolan conglomerate that has been in operation since 1999. The group maintains a diversified investment portfolio, with interests spanning sectors such as agriculture, construction, and furniture.

The other entity, Grupo Actual, is a Portugal-based human resources agency. This organization specializes in providing temporary work solutions and various recruitment services. The involvement of a human resources agency is particularly significant in the context of data privacy, as these firms handle large volumes of sensitive personal information belonging to job seekers and temporary staff.

Potential impact and security implications

This alleged leak may pose significant risks to the operational processes and the integrity of employee data for the targeted organizations. The exposure of human resources and financial records can facilitate various secondary attacks, such as identity theft or highly targeted phishing campaigns directed at employees. When attackers possess detailed organizational and personal information, they can craft more convincing social engineering attacks to further penetrate a network.

Furthermore, because Grupo Actual operates in Portugal, the breach may lead to legal consequences under the General Data Protection Regulation (GDPR). Such regulatory frameworks impose strict requirements on how personal data must be protected and how breaches must be reported. Failure to secure sensitive data can result in substantial fines and legal liabilities.

The impact of such an attack may also extend beyond the immediate victims. The supply chain partners of these organizations may be indirectly affected by the breach. In modern digital ecosystems, a compromise in one organization can create ripple effects across its network of collaborators. Additionally, victims of such breaches may face secondary extortion attempts, where attackers attempt to exploit the same data multiple times or target the organization's partners to maximize their gains.

To defend against such threats, organizations in the professional services and diversified investment sectors typically implement layered security strategies. These include robust access controls, continuous monitoring of network traffic, and comprehensive employee training to recognize phishing attempts. Maintaining regular, offline backups and ensuring strict adherence to data protection regulations are also critical components of a modern cybersecurity posture.