ONE Contact listed on Deadlock ransomware leak site

• Ransomware group: Deadlock
• Country: Sweden
• Sector: Professional Services
• Announcement date: July 10, 2026

The Deadlock ransomware group has listed the professional services organization ONE Contact on its dedicated leak site. Through this announcement, the threat actor group alleges that a data breach has occurred involving the company's systems.

The alleged attack event

According to the announcement made on July 10, 2026, the threat actor known as Deadlock claims to have successfully gained unauthorized access to the internal systems of ONE Contact. This claim was publicized on the group's leak platform, which is a common tactic used by ransomware operators to pressure victims.

In modern cyberattack scenarios, ransomware groups often employ a strategy known as double extortion. In this model, attackers do not merely encrypt a victim's files to disrupt operations; they also exfiltrate sensitive data. The threat actors then threaten to publish this stolen information on a public leak site if the ransom demands are not met. This method significantly increases the pressure on an organization, as the threat of public exposure can cause lasting damage to reputation and legal standing.

Despite the claim of access, the evidence provided by the group remains minimal. The screenshot associated with the listing does not contain any samples of actual data. Instead, the provided imagery shows only an access error message, which fails to provide visual confirmation of the breach or the contents of the alleged stolen files.

Data involved in the claim

At this stage, there is no information available regarding the specific nature of the alleged leaked data. The threat actor has not provided details concerning the volume of information or the specific types of files involved in the incident. Furthermore, the provided screenshot does not provide any evidence of data content.

• No specific data types have been identified in the listing.

Organization profile

ONE Contact is a contact center based in Barcelona, Spain. The company specializes in providing a variety of customer service solutions, including customer service, telemarketing, and retention strategies. Their services are specifically targeted at the Scandinavian market. Additionally, the organization offers both first and second-line support, as well as digital customer service solutions to its clients.

Risk assessment and industry implications

This incident may pose significant operational continuity and reputational risks for ONE Contact. Given the organization's operational footprint in Spain and its management based in Sweden, a potential breach of data protection obligations under the General Data Protection Regulation (GDPR) may be considered. If the alleged leak is confirmed, the exposure of customer data could lead to secondary risks such as identity theft and targeted phishing attacks against the affected parties.

For organizations operating in the professional services and customer support sectors, such incidents highlight the critical importance of robust cybersecurity frameworks. When a company manages sensitive client interactions and digital support, they become a high-value target for threat actors. To mitigate these risks, organizations typically must initiate forensic processes to investigate the potential data breach and determine the scope of the intrusion. Furthermore, notifying relevant regulatory authorities is a necessary step to remain compliant with regional data protection laws.

Defensive strategies for companies in this sector often involve implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular employee training to prevent initial access via phishing. Once an incident is suspected, rapid containment and a well-documented incident response plan are essential to minimize the impact on business operations and client trust.