Ingka Group listed on lapsus$ leak site

• Ransomware group: lapsus
• Country: Sweden
• Sector: Retail & E-Commerce
• Announcement date: June 13, 2026

Lapsus$ claims data breach against Ingka Group

The threat actor known as lapsus$ has listed data they claim belongs to INGKA GROUP on their leak site. This announcement, made on June 13, 2026, marks a significant potential security incident for the major retailer. The group has published a leak announcement targeting the organization, claiming to have successfully exfiltrated sensitive information from the company's digital environment.

The incident involves a claim of unauthorized access to various critical systems. According to the announcement published by the threat actor, the group has obtained data related to the company's global e-commerce architecture and internal coworker platforms. This type of claim is common in modern cyberattacks, where threat actors use the threat of leaking sensitive information to pressure organizations. While the group's claims have been made public on their leak site, the full extent of the breach and the veracity of the stolen data remain subject to investigation.

Details of the claimed data theft

The information allegedly stolen by the lapsus$ group is extensive and covers multiple layers of the organization's digital operations. The group claims that the leaked data includes highly sensitive technical and operational information. Specifically, the announcement specifies that the following types of data are included in the leak:

• Corporate e-commerce architecture data
• Internal coworker platform data
• Supply chain logistics data
• Cloud infrastructure data
• AI and MLOps repository data

In addition to these categories, the group has provided a small sample of the alleged data to demonstrate the breach. A screenshot displays a 205 KB file named 'tree.txt' which is available for download on the leak site. The specific contents of this file or the total volume of the stolen data have not been fully disclosed in the initial announcement.

About Ingka Group

Ingka Group is the largest IKEA franchisee, operating the vast majority of IKEA stores worldwide with a focus on retail and e-commerce. The company maintains a global operational network in the furniture and home goods sector, making it a critical component of the global retail landscape.

Potential impact and security implications

This alleged leak may pose risks to INGKA GROUP regarding operational continuity and intellectual property security. The compromised cloud infrastructure and supply chain data could potentially facilitate secondary attacks against the organization's digital assets. When an organization's cloud environment or logistics data is exposed, it can provide attackers with a roadmap for further exploitation or allow them to target the company's partners and vendors.

Furthermore, given that the company is based in Sweden, the incident may trigger legal and administrative sanctions under the GDPR. Such regulations require organizations to protect personal data and report breaches within specific timeframes to avoid significant penalties. The technical content shared by the group may indicate that unauthorized access to the organization's internal systems has occurred, which could lead to long-term challenges in maintaining trust with customers and partners.

In the retail and e-commerce sector, organizations often face sophisticated threats aimed at disrupting supply chains or stealing customer information. To defend against such risks, companies typically implement multi-layered security strategies. These include robust identity and access management to prevent unauthorized entry, continuous monitoring of cloud environments to detect anomalies, and strict controls over intellectual property and MLOps repositories. Additionally, securing the supply chain through rigorous vendor risk management is a common defensive step to prevent secondary attacks that leverage compromised logistics data.