Lamashtu ransomware group lists H-W-G & Acros Sport on its leak site

• Ransomware group: Lamashtu
• Country: Germany
• Sector: Retail & E-Commerce
• Announcement date: May 26, 2026

Lamashtu claims data breach against H-W-G and Acros Sport

The Lamashtu ransomware group has officially listed the German entities H-W-G and Acros Sport on its dedicated leak site. According to the threat actor, the breach involves a significant volume of sensitive information, with the group claiming to have obtained approximately 30 GB of data. This announcement, made on May 26, 2026, marks a potential major security incident for the targeted organizations.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption phase. The threat of releasing this stolen information publicly serves as additional leverage to pressure the victim into paying a ransom. While the specific ransom demand for this incident has not been disclosed, the presence of the companies on the leak site indicates that the attackers are moving forward with their extortion tactics.

Details of the alleged data theft

The Lamashtu group claims that the breach occurred on May 26, 2026, and that the stolen information spans a wide timeframe. The threat actor asserts that the 25,000 files they have allegedly acquired cover the operational history of both H-W-G and Acros Sport from 2020 through 2026. To support their claims, the group has shared sample images that allegedly represent the companies' financial records and technical documentation.

The scope of the data allegedly compromised is extensive, covering various aspects of business operations, from administrative tasks to core engineering intellectual property. The leaked content reportedly includes:

• Personnel files
• Payroll records processed through DATEV
• Annual financial statements
• Customer data sheets
• Manufacturing drawings
• Measurement protocols
• SolidWorks CAD files
• Assembly models
• Production tooling specifications

The targeted organizations

The two organizations targeted in this alleged attack represent different but interconnected segments of the industrial and logistics supply chain. H-W-G is a German-based manufacturer specializing in the production of bearings and mechanical components designed for industrial machinery and automation systems.

The second entity, Acros Sport (also referred to as Acros Components), operates as a distributor and supplier of electronic components. Their business model involves providing essential logistics and technical support to their clients. Together, the compromise of these two entities could impact various levels of the manufacturing and electronic supply chain.

Potential risks and organizational impact

The alleged leak of such a diverse dataset poses multifaceted risks to the affected companies. From a regulatory standpoint, because the entities are based in Germany, a confirmed data breach involving personal information could lead to significant legal sanctions and administrative fines under the General Data Protection Regulation (GDPR). The exposure of personnel files and payroll records—specifically those processed through DATEV—creates secondary risks for the individuals involved, such as the potential for identity theft or highly targeted phishing attacks directed at employees and customers.

Beyond the administrative and personal data risks, the theft of technical documentation represents a severe blow to intellectual property. The inclusion of SolidWorks CAD files, manufacturing drawings, and production tooling specifications suggests that the attackers may have gained access to the core engineering secrets of the companies. Such a leak can result in a direct loss of competitive advantage and the exposure of proprietary manufacturing processes.

In the retail and industrial sectors, organizations can mitigate these risks by implementing robust defensive measures. This includes maintaining strict access controls to prevent unauthorized movement within a network, ensuring all software and systems are patched against known vulnerabilities, and conducting regular backups that are stored offline or in immutable environments. Furthermore, monitoring for unusual data exfiltration patterns can help detect an attack in its early stages before large volumes of data are moved off-site.