Ic-controls.com targeted by ThreeAM ransomware group
The ThreeAM ransomware group has published data on its leak site that it claims belongs to ic-controls.com.
- Published
- 3 min read
- 3 min read
- Ransomware group: ThreeAM
- Country: Germany
- Sector: Manufacturing
- Announcement date: May 1, 2026
ThreeAM claims data breach against ic-controls.com
The threat actor known as ThreeAM has listed ic-controls.com on its leak site, claiming to have made various file archives publicly available. According to the announcement made on the group's leak site, the data was allegedly published on November 27, 2025. This claim suggests a significant breach targeting the organization, although the group has not provided specific details regarding the nature of the files beyond the initial listing.
Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers not only encrypt an organization's internal systems to disrupt operations but also steal sensitive data to use as leverage. By threatening to release this information publicly, the attackers aim to pressure the victim into paying a ransom. While the ransom demand in this specific instance has not been disclosed, the act of publishing data on a public platform is a hallmark of this extortion tactic.
Details of the alleged data leak
The ThreeAM group alleges that it has leaked approximately 28.89 GB of data in total. Based on the information provided by the threat actor, the leak involves several specific archive files and directories. The group has claimed that the data was made available to the public following the alleged attack date. The listing includes several compressed files and specific folder names, though the full scope and exact contents of these files remain unclear.
The following items were identified in the group's announcement:
- Archive files named ICINCADMAFCO.part1-6.rar and ICINCADABOGADOLATINO.rar
- Directories labeled 'IC'
- Directories labeled 'SCAN COMPARTIDO'
Beyond these specific filenames and directory labels, there is no detailed information regarding the full scope of the content contained within the archives. The lack of specific information regarding the exact file types or the specific nature of the documents makes it difficult to determine the full extent of the exposure at this time.
About ic-controls.com
Industrial Controls SAC is a Chile-based engineering firm that has been developing and implementing projects in electricity, instrumentation, pneumatics, and industrial automation since 1994. The organization operates within the manufacturing and engineering sector, providing specialized technical services and automation solutions.
Risk assessment and industry implications
This leak claim may pose a risk to the institution's operational continuity and could lead to the exposure of trade secrets. While the content of the data is not clear, the potential presence of technical documents related to industrial control systems could increase the risk of secondary attacks. When technical specifications or automation configurations are exposed, it can provide adversaries with a roadmap for future targeted intrusions into industrial environments.
Furthermore, as the institution is based in Germany, the presence of personal data could lead to legal sanctions under GDPR. Organizations operating within the European Union must adhere to strict data protection regulations, and any confirmed breach involving personal information can result in significant regulatory scrutiny and fines. Additionally, information about the ThreeAM group is limited; however, such leaks may also pose an indirect threat to the institution's supply chain partners. In modern industrial environments, companies are deeply interconnected through digital supply chains, meaning a breach in one organization can potentially expose vulnerabilities or sensitive information related to its partners.
To mitigate such risks, organizations in the manufacturing and industrial sectors often implement defensive measures such as network segmentation, robust access controls, and continuous monitoring of their industrial control systems. Maintaining comprehensive backups and conducting regular incident response drills are also standard practices to ensure operational resilience in the face of ransomware threats.