Ebaengineering.com listed on Chaos ransomware leak site

• Ransomware group: Chaos
• Country: United States
• Sector: Manufacturing
• Announcement date: October 7, 2025

The threat actor known as Chaos has officially listed the organization ebaengineering.com on its dedicated leak site. According to the announcement made by the group, the attackers claim to have successfully exfiltrated a significant volume of data from the company's internal systems.

Details of the claimed attack

The announcement regarding the alleged breach was published on October 7, 2025. In the post, the Chaos group claims to have obtained 450 GB of data from the organization's systems. This claim was made on the same date as the reported attack. While the group has taken responsibility for the incident on their platform, there is no detailed information available regarding the specific content of the allegedly exfiltrated data. Furthermore, the provided screenshot associated with the claim indicates that the relevant leak page is currently inaccessible to observers.

Data involved in the claim

Regarding the specifics of the information stolen, the listing does not provide details on the exact file types or the nature of the contents. The listing names no specific data types.

Organization profile

EBA Engineering is a multidisciplinary engineering firm based in the United States. The company provides a wide range of professional services, including construction management, civil site engineering, geotechnical engineering, and asset management. EBA Engineering focuses on offering client-centered engineering solutions for various infrastructure and construction projects.

Risk assessment and implications

This claim may pose a significant risk to the organization's operational continuity. Depending on the nature of the alleged data, several secondary risks may emerge, such as identity theft or targeted phishing attacks directed at the company's employees and clients. Because the organization is based in the United States, any potential data breach may be subject to various state-level privacy regulations.

Ransomware attacks often involve a strategy known as double extortion. In these scenarios, threat actors do not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to leak the stolen data on public forums or leak sites, attackers aim to pressure the victim into paying a ransom to prevent the public disclosure of sensitive corporate or personal information.

Public information regarding the Chaos group remains limited, making it difficult to determine their specific tactics, techniques, and procedures. For organizations facing such claims, it is often advisable to conduct a thorough forensic investigation of their systems to identify any potential data exfiltration and to confirm the extent of the incident. Defensive measures typically include implementing robust monitoring, ensuring regular backups, and maintaining strict access controls to mitigate the impact of such breaches.