PROJAHN listed on lamashtu ransomware leak site

• Ransomware group: lamashtu
• Country: Germany
• Announcement date: September 30, 2026

The German manufacturing company PROJAHN has been listed on the lamashtu ransomware group's leak site. The threat actor group claims to have successfully breached the organization, resulting in a significant data leak involving a large volume of sensitive corporate information.

The alleged data breach

According to the announcement made by the lamashtu group on September 30, 2026, the attackers claim to have obtained a dataset consisting of 50 GB of data. This dataset reportedly contains approximately 75,000 files. The group states that the data was extracted directly from the company's central network storage system.

The claims made by the group suggest that the stolen information covers a wide range of business operations. Specifically, the group asserts that the data encompasses financial, legal, HR, and manufacturing operations spanning the period between 2025 and 2026. This timeframe indicates that the stolen data may contain recent and highly relevant operational details regarding the company's activities.

Details of the claimed stolen data

The lamashtu group has identified several categories of sensitive information that they claim to have exfiltrated from PROJAHN. The contents of the alleged leak include a variety of documents critical to the company's internal and external operations. The specific types of data mentioned in the claim include:

• Financial data
• HR data
• Employee records
• Supplier information
• VPN configurations
• Compliance documentation

The inclusion of VPN configurations and associated certificates is particularly noteworthy, as such technical details can be utilized by threat actors to facilitate further unauthorized access to a network infrastructure.

About PROJAHN

PROJAHN is a German company that specializes in the manufacturing and distribution of professional precision and hand tools. Their industrial product catalog is extensive, offering a wide range of items including drill bits, measuring tools, wrenches, and screwdrivers to various industrial sectors.

Potential impact and security implications

This alleged breach may pose a significant risk of exposure for the personal data of PROJAHN employees and sensitive trade secrets. The disclosure of sensitive information regarding supplier and customer relationships could lead to reputational damage and a competitive disadvantage for the company. Furthermore, as the entity operates in Germany, the incident may result in legal sanctions and administrative fines under GDPR.

The exposure of VPN configurations and certificates might increase the risk of secondary attacks targeting the company's network infrastructure. In modern cybercrime, ransomware groups often employ a "double extortion" tactic, where they not only encrypt a company's systems but also threaten to leak sensitive data to pressure the victim into paying a ransom. This approach increases the pressure on organizations to comply with demands to prevent the public disclosure of proprietary or personal information.

For organizations in the manufacturing sector, such incidents highlight the importance of robust security measures. Protecting central network storage systems and securing remote access points, such as VPNs, are critical components of a modern defense strategy. While information about the lamashtu group remains limited, the nature of this claim demonstrates the ongoing threat posed by ransomware groups targeting industrial entities with high-value operational and personal data.