Elliott-Lewis targeted by Interlock ransomware group

• Ransomware group: Interlock
• Country: United States
• Sector: Professional Services
• Announcement date: March 11, 2026

Interlock group claims data breach at Elliott-Lewis

The Interlock ransomware group has listed data on its leak site that it claims belongs to Elliott-Lewis. This announcement, made on March 11, 2026, marks a recent addition to the group's list of victims. In such cyberattacks, threat actors often employ a strategy known as double extortion, where they not only encrypt an organization's systems to disrupt operations but also steal sensitive information to use as leverage for ransom demands.

According to the group's claims, the attack occurred on the same day the announcement was made, March 11, 2026. The attackers claim to have obtained approximately 57 GB of data from the organization's systems. The provided evidence includes screenshots displaying folder structures that allegedly contain various types of sensitive information. While the group has posted this information on its leak site, the details regarding the specific ransom demand remain unknown.

Details of the claimed data theft

The information provided by the Interlock group suggests a significant breach of internal documentation. Based on the screenshots shared by the attackers, the stolen data is organized into several folders and files. The content allegedly includes accounting records, human resources (HR) and marketing data, mechanical construction projects, user profiles, and various database backup files, specifically mentioning Dynamics, RESCOXRM, and NexGenFMS.

The listing identifies several categories of potentially sensitive information that may have been compromised. The affected data types claimed by the group include:

• Accounting records
• HR data
• Marketing data
• Customer data
• Employee data
• Project contracts

The presence of database backups and project-specific files suggests that the breach may have targeted core operational and administrative systems within the organization.

About Elliott-Lewis

Elliott-Lewis is a company based in the United States that operates within the professional services sector. Founded in 1905, the organization provides a wide range of solutions, including facility management, maintenance, repair, engineering, design, and energy consumption solutions. The company offers operational support and facility management services specifically tailored for commercial and industrial facilities.

Potential impact and risks

This breach may lead to the exposure of sensitive customer and employee information within Elliott-Lewis. Given the nature of the organization's sector, the disclosure of contracts and operational data could result in a loss of commercial reputation and a competitive disadvantage. Because the organization is a US-based entity, it may be subject to state-level data protection laws and potential notification requirements.

Secondary risks associated with such a leak include the potential use of the stolen data for identity theft or targeted phishing attacks against employees or clients. In the professional services sector, maintaining the confidentiality of project contracts and client information is vital for maintaining trust and competitive standing.

To defend against such threats, organizations typically implement a multi-layered security approach. This often includes robust backup strategies, regular security audits, and strict access controls to limit the exposure of sensitive data. Monitoring for unauthorized data exfiltration and maintaining an incident response plan are also common defensive steps used to mitigate the impact of ransomware and data leaks.

Summary of the incident

Information regarding the Interlock group remains limited, as is common with many ransomware collectives. The incident highlights the ongoing risks faced by established professional services firms in the face of evolving cyber threats targeting sensitive corporate and personal data.