Lamashtu ransomware group claims data breach at CNAOC

• Ransomware group: Lamashtu
• Country: France
• Sector: Energy & Utilities
• Announcement date: April 13, 2026

Lamashtu claims to have leaked data from CNAOC

The threat actor known as Lamashtu has published an announcement on its leak site claiming to have breached the French organization CNAOC. According to the group's claims, the incident involved the theft of a significant amount of data, which has since been made available to the public via a torrent link. The group alleges that the breach occurred on April 11, 2026, and the announcement was subsequently posted on their leak site on April 13, 2026.

Ransomware groups often employ a strategy known as double extortion, where they not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to use as leverage. By threatening to release stolen information on public leak sites, these actors aim to pressure victims into paying a ransom to prevent the exposure of confidential records. This tactic shifts the pressure from operational downtime to significant reputational and legal risks.

Details of the alleged data theft

The claims made by Lamashtu suggest a massive exfiltration of information, totaling approximately 52.6 GB of data consisting of 41,000 files. The stolen dataset is said to span a wide historical range, covering documents and records dating from 1994 to 2025. This long-term access suggests that the threat actor may have had presence within the network for an extended period to collect such a vast archive of administrative and financial history.

The group alleges that the leaked information includes a variety of sensitive documents that could impact various stakeholders. The specific types of data claimed to be included in the leak are:

• Financial records
• Employee salary bulletins
• Bank transfer records
• Vendor invoices
• Board meeting minutes
• Personal contact information

The inclusion of personal contact information and salary details highlights the sensitive nature of the breach, as such data is highly prized by cybercriminals for subsequent malicious activities.

The organization involved

The target of this alleged attack is CNAOC (Confédération Nationale des Producteurs de Vins et Eaux-de-Vie de Vin à Appellations d'Origine Contrôlée). This organization serves as a national body representing French wine producers. Since its establishment in 1924, CNAOC has been dedicated to protecting the interests of producers of wine, brandy, and liqueur, while providing essential support to the French viticulture industry.

Potential impact and risks

The alleged exposure of CNAOC's data carries several significant risks. For the employees and stakeholders whose information has been compromised, the leak could lead to secondary threats such as identity theft and highly targeted phishing attacks. When personal contact details and financial records are leaked, attackers can craft convincing social engineering campaigns to deceive individuals into revealing even more sensitive information or transferring funds.

Furthermore, because CNAOC is an organization based in France, this incident may result in serious data protection violations under the General Data Protection Regulation (GDPR). The exposure of corporate financial data and strategic administrative documents, such as board meeting minutes, could potentially damage the organization's commercial operations and overall reputation within the viticulture sector. The loss of strategic documentation can undermine the competitive standing of the organization and its members.

In response to such threats, organizations in the energy and utilities or agricultural representation sectors often focus on strengthening their defensive postures. Common defensive steps include implementing robust multi-factor authentication, maintaining rigorous patch management schedules to close vulnerabilities, and conducting regular network segmentation to limit lateral movement by attackers. Additionally, continuous monitoring of network traffic and employee awareness training are essential components of a modern cybersecurity strategy to mitigate the risk of data exfiltration.

At this time, information regarding the Lamashtu group remains limited. Their specific methods and motives are not fully understood, and their activities should be monitored closely by security professionals and stakeholders.