Gammax ransomware group lists MTCO (Mahmoud Altaheni & Partners Trading Co) on its leak site

• Ransomware group: Gammax
• Country: Saudi Arabia
• Sector: Professional Services
• Announcement date: August 1, 2026

Gammax claims to have stolen data from MTCO

The threat actor known as Gammax has listed MTCO (Mahmoud Altaheni & Partners Trading Co) on its dedicated leak site. According to the claims made by the group, the breach occurred on August 1, 2026. The threat actor alleges that they have successfully exfiltrated a significant amount of information from the organization's network, totaling 197 GB of data.

The group has initiated a countdown process regarding the publication of the mentioned dataset. This tactic is a common feature of modern ransomware operations, often used to exert pressure on the victim. In such scenarios, the threat actor typically uses the threat of releasing sensitive information to demand payment, a method often referred to as double extortion. By setting a timer, the attackers create a sense of urgency, hoping to force the organization into a quick decision regarding a ransom demand, although no specific ransom amount has been disclosed in this instance.

Details of the alleged data theft

The Gammax group claims to have obtained a total of 2,267 files during the alleged intrusion. Based on the screenshots shared by the attackers, the stolen information appears to consist of various commercial documents. These files are intended to demonstrate the validity of the breach and the sensitivity of the stolen content.

The specific types of data identified in the leaked samples include:

• Commercial purchase orders
• Invoices
• Order forms

The presence of these documents suggests that the attackers have gained access to internal business processes and financial records. While the exact nature of all 2,267 files remains unverified, the visible samples point toward a significant compromise of commercial documentation.

About MTCO

MTCO (Mahmoud Altaheni & Partners Trading Co) is a trading and professional services company. The organization has a significant presence in the region, operating within Saudi Arabia and the GCC countries. With over 15 years of industry experience, the company is an established player in its sector, providing various professional and trading services across the Middle East.

Potential impact and organizational risks

This alleged data leak may pose significant risks to the organization's commercial operations and its ongoing customer relationships. Because the leaked documents may contain sensitive information regarding the organization's supply chain and financial processes, the incident could create secondary risks for third parties who interact with MTCO. When a company's commercial data is exposed, it can lead to a loss of trust among partners and clients who rely on the confidentiality of their transactions.

Furthermore, as the organization is operating in Saudi Arabia, it may face specific legal obligations under local data protection regulations following such an event. Organizations facing similar threats are generally advised to initiate a comprehensive investigation to determine the full scope of the leak and to notify all relevant stakeholders and affected parties.

In the professional services and trading sectors, maintaining the integrity of financial and order-related data is critical. Common defensive steps for organizations to mitigate such risks include implementing robust network monitoring, enforcing strict access controls, and conducting regular security audits. As information about the Gammax group remains limited in the public domain, the incident highlights the ongoing challenge posed by evolving ransomware groups that target commercial entities to disrupt their business continuity and reputation.