Noega and Esnova listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Spain
• Sector: Technology
• Announcement date: July 10, 2026

Deadlock claims data breach against Noega and Esnova

The Deadlock ransomware group has listed the Spanish organizations Noega and Esnova on its dedicated leak site. According to the group's announcement, the threat actors claim to have successfully exfiltrated a significant amount of internal data from the targeted entities. This development follows a pattern observed in modern cyberattacks where groups use public platforms to pressure victims by threatening the release of sensitive information.

The incident was officially announced on the group's leak site on July 10, 2026. The group alleges that the breach occurred on the same day, July 10, 2026. While the listing serves as a public claim by the ransomware group, the full extent of the impact on the organizations' internal systems remains to be verified through independent investigation.

Details of the claimed data theft

The Deadlock group claims to have obtained a substantial volume of information during the alleged attack. Specifically, the group asserts that they have possession of 130 GB of internal data belonging to the organizations. This volume of data suggests a potentially wide-reaching intrusion into the companies' digital environments.

Although the group has claimed a specific data size, the listing does not provide a detailed breakdown of the specific file types or the exact nature of the content stolen. However, the group provided a screenshot as evidence of the breach. This visual evidence displays a directory structure that includes several specific folders, namely:

• Compartida
• Comun
• Foro
• ForoAdministradores

While these directory names are visible in the provided screenshot, the exact scope and the specific contents within these folders remain unspecified by the attackers. The presence of these folders indicates that the group has accessed various internal directories, but the full breadth of the compromised information is not yet known.

Organization profiles

The targeted entities, Noega and Esnova, are established companies based in Gijón, Spain. These organizations specialize in the design, manufacturing, and installation of industrial shelving, warehouse storage solutions, and intralogistics services. Given their focus on industrial and warehouse infrastructure, their operations are deeply integrated into the supply chain and logistics sectors.

Potential risks and broader implications

This incident highlights the ongoing risk that organizations face regarding the exposure of operational data and internal communications. When a ransomware group claims to have stolen data, the primary concern is the potential for double-extortion tactics. In such scenarios, attackers not only encrypt a victim's systems but also threaten to leak sensitive information on public forums to maximize leverage during ransom negotiations.

Because Noega and Esnova are based in Spain, any confirmed compromise of personal data could trigger significant legal consequences and mandatory notification requirements under the General Data Protection Regulation (GDPR). Beyond the immediate legal and regulatory landscape, secondary risks often emerge following such claims. These include the potential for identity theft or the launch of targeted phishing campaigns directed at the companies' employees and customers.

For organizations operating in the technology and logistics sectors, maintaining robust cybersecurity posture is essential to mitigate these risks. Common defensive strategies often include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training to defend against social engineering. As the public information regarding the Deadlock group remains limited, the potential for impact on the commercial reputation of the organizations remains a significant concern if the claimed data is indeed published.