LGM listed on termite ransomware leak site

• Ransomware group: termite
• Country: France
• Sector: Manufacturing
• Announcement date: May 5, 2025

French engineering firm LGM targeted by termite ransomware group

The French manufacturing and engineering firm LGM has been listed on a leak site operated by the ransomware group known as termite. According to the announcement made by the threat actors, the organization has fallen victim to a data breach involving a significant volume of information. The claim was posted on May 5, 2025, though the group alleges that the actual compromise of the data occurred around April 29, 2025.

Details of the alleged data breach

The termite group has claimed to have successfully obtained a substantial amount of data belonging to LGM. While the group has not provided a detailed list regarding the specific content of the allegedly leaked data, the announcement suggests that the stolen information is related to the company's core business operations. Specifically, the group alleges that the compromised data pertains to the organization's design, production, and maintenance operations.

According to the claims made by the threat actors, the stolen dataset is quite extensive. The group asserts that the breach involves:

• A total data size of 550 GB
• Approximately 700,000 files

Publicly available information regarding the termite group remains limited, making it difficult to ascertain their specific methodologies or ultimate motivations for targeting the organization.

About LGM

LGM is a French engineering and consulting firm that provides specialized services focused on performance improvement. Their expertise covers the entire lifecycle of industrial systems, including design, production, operation, and maintenance. The company offers technical support and project management solutions across a variety of critical sectors, such as defense, aerospace, transportation, and energy.

Potential risks and industry implications

The claim made against LGM poses several significant risks to the organization. First and foremost, the potential exposure of sensitive information could jeopardize the company's operational processes and its intellectual property rights. Because LGM operates in highly technical sectors like aerospace and defense, the disclosure of trade secrets could lead to negative consequences for commercial competition.

Furthermore, as the company is based in France, a confirmed data breach could trigger legal sanctions and mandatory notification obligations under the General Data Protection Regulation (GDPR). Beyond the direct impact on LGM, there are secondary risks for the company's clients and business partners. These include the possibility of targeted phishing attacks or more complex supply chain attacks stemming from the leaked information.

In the broader context of cybersecurity, ransomware groups often employ a strategy known as double extortion. In these scenarios, attackers not only encrypt an organization's data to disrupt operations but also steal sensitive information to use as leverage. By threatening to publish the data on a public leak site, the attackers aim to pressure the victim into paying a ransom to prevent the disclosure of trade secrets or sensitive client information.

For organizations operating in the manufacturing and engineering sectors, maintaining robust security postures is essential to protect intellectual property and maintain client trust. Common defensive measures include implementing strict access controls, maintaining regular offline backups, and conducting thorough employee training to recognize social engineering attempts. As the threat actor's next steps remain uncertain due to the lack of data on their methods, organizations are encouraged to remain vigilant against potential follow-on attacks.