FuG-Gruppe listed on Lamashtu ransomware leak site

• Ransomware group: Lamashtu
• Country: Germany
• Announcement date: October 21, 2026

Lamashtu claims data breach at FuG-Gruppe

The ransomware group known as Lamashtu has listed the German IT systems integrator FuG-Gruppe on its leak site. According to the group's announcement, the breach involves a significant volume of stolen information, specifically an archive totaling 50 GB. This archive is reported to contain approximately 75,000 files, which the attackers claim were exfiltrated from the organization's network.

The listing, which was posted on the group's leak site on October 21, 2026, includes a countdown timer that was set to expire on October 28, 2026, at 12:00. The attackers claim that the stolen data consists of several thousand files spanning the years 2023 to 2026, which were taken from multiple network shares. While the listing includes sample images, only two of the four provided images successfully loaded; these two images appear to show scanned documents that resemble German invoices and correspondence.

Details of the claimed stolen data

The contents of the stolen archive, as described by the Lamashtu group, involve a wide range of sensitive organizational and personal information. The group asserts that the data includes not only administrative records but also highly sensitive technical and personal materials. The specific categories of data mentioned in the claim include:

• Accounting records
• Client contracts
• Employee documentation
• Cryptographic material
• Client correspondence
• System configurations
• Credentials

The presence of a dedicated credentials tab on the leak site, which shows a count of ninety-three entries, suggests that specific account details may have been exposed, although the actual contents of these credentials were not visible in the listing. The group also mentioned that the data includes the names of several individuals.

About FuG-Gruppe

FuG-Gruppe is an IT systems integrator and general contractor located in Halver, Germany. Founded in 1950, the company has a long-standing history in the industry. The organization specializes in providing IT/EDP integration and enterprise resource planning (ERP) solutions, specifically catering to industrial businesses and companies involved in steel trading.

Risk assessment and implications

The severity of this incident is heightened by FuG-Gruppe's role as an IT service provider. Because the company specializes in system integration and ERP solutions, the theft of system configurations, access details, or cryptographic material poses a significant supply chain risk. If such technical data is compromised, it could potentially be used to launch secondary attacks against the company's clients.

Furthermore, the inclusion of employee documentation and data pertaining to named individuals indicates that personal data has been involved. Under the EU General Data Protection Regulation (GDPR), such a breach may trigger mandatory notification duties to the relevant authorities and affected individuals. While the authenticity of the claim has not been independently verified, the presence of sample documents suggesting real German invoices indicates the claim has some basis in reality.

In scenarios involving ransomware and double extortion—where attackers both encrypt data and threaten to leak it—organizations often face complex recovery and legal challenges. For companies in the IT service sector, the exposure of credentials and configuration data necessitates immediate defensive actions. This typically includes rotating passwords, updating security certificates, and conducting thorough audits of network access to mitigate the risk of unauthorized lateral movement or secondary breaches. As public information regarding the Lamashtu group remains limited, the full scope and impact of this incident remain to be confirmed.