JOSO listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Norway
• Announcement date: July 10, 2026

Deadlock claims JOSO in latest leak site listing

The threat actor known as Deadlock has listed the Norwegian organization JOSO on its dedicated leak platform. This announcement, made on July 10, 2026, marks the latest instance of the group targeting industrial entities. At this stage, the listing serves as a claim by the ransomware group, though the full extent of the impact remains to be determined by further investigation.

Ransomware leak sites are frequently utilized by cybercriminals as a method of psychological pressure. In many modern ransomware campaigns, threat actors employ a strategy known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of releasing this stolen data on a public platform is used to coerce the victim into paying a ransom. By listing a company on a leak site, the attackers aim to damage the victim's reputation and create legal or regulatory pressure.

Details of the claimed event

According to the information available on the Deadlock leak platform, the organization JOSO has been added to their list of victims. However, the current state of the leak page provides very little concrete information. Currently, there is no file content or data sample visible on the associated leak page. The page appears to be empty, providing no immediate evidence of the specific files that may have been targeted during the alleged intrusion.

Publicly available information regarding the Deadlock group remains limited. There is a lack of extensive documentation in the public domain concerning their specific tactics, techniques, and procedures. This lack of transparency makes it difficult for security researchers to attribute the attack or predict the group's next moves. The absence of a visible file list or specific data content on the leak site could suggest several possibilities. It may indicate that a negotiation process between the threat actor and the victim is currently ongoing, or it could simply be a result of a technical issue on the leak site itself.

Data involved in the claim

The listing currently names no specific data types or file contents.

About JOSO

JOSO is a Norwegian industrial engineering and manufacturing company. The company specializes in the production of high-quality mechanical components and hardware. Given its role in the industrial sector, the company's operations are central to manufacturing processes that require high precision and technical expertise.

Potential risks and implications

The listing of an organization on a ransomware leak site indicates a potential risk of a data breach. Because JOSO operates within Norway, any confirmed data leak may be subject to the General Data Protection Regulation (GDPR). Such regulations impose strict requirements on how personal data is handled and how breaches are reported to authorities and affected individuals.

The potential exposure of data carries significant risks for various stakeholders. Employees of the company may face risks such as identity theft or targeted phishing attacks if their personal information is compromised. Furthermore, business partners of the company may also be exposed to these risks, as a breach in one part of a supply chain can often lead to secondary threats for connected entities.

To mitigate such risks, organizations in the industrial and engineering sectors often implement various defensive measures. These include robust backup strategies to ensure operational continuity, multi-factor authentication to secure access to sensitive systems, and continuous monitoring of network traffic to detect unusual activity. Additionally, maintaining strict access controls and conducting regular security awareness training for employees are fundamental steps in defending against the types of threats posed by ransomware groups like Deadlock.