ROXU listed on Space Bears leak site following claimed data breach

• Ransomware group: Space Bears
• Country: Spain
• Sector: Manufacturing
• Announcement date: October 9, 2025

The threat actor group known as Space Bears has listed the Spanish organization ROXU on its leak site. According to the announcement made on October 9, 2025, the group claims to have successfully executed a cyberattack against the company, resulting in the acquisition of sensitive information. This listing follows a pattern often seen in modern cyber extortion, where threat actors use public leak sites to pressure victims into meeting their demands by threatening to release stolen data.

The claimed attack and extortion tactics

The Space Bears group has stated that the incident leading to this data leak occurred on October 5, 2025. In their announcement, the group alleges that the breach was facilitated through the involvement of certain third-party companies, which they identified as business partners of the target organization. This claim highlights a growing trend in the cyber threat landscape where attackers exploit vulnerabilities within a supply chain to gain access to a primary target.

By publishing the organization's name on a dedicated leak site, the group intends to exert significant pressure on ROXU. This tactic is a hallmark of double extortion, a method where attackers not only encrypt an organization's systems but also steal sensitive data to use as leverage. The threat of public disclosure is used to coerce the victim into paying a ransom to prevent the release of the stolen information, which could lead to severe reputational and legal consequences for the company.

Compromised data types

While the specific volume of the stolen data and the exact ransom amount have not been disclosed by the group, the announcement specifies several categories of information that have allegedly been compromised. The group claims to have acquired a variety of sensitive files and databases that could be highly damaging if released publicly.

The data types mentioned in the claim include:

• Database
• Employee personal information
• Client personal information
• Financial documents

The nature of this stolen information suggests that the attackers have targeted both internal corporate records and the private details of the people who interact with the business, including its workforce and its customer base.

About ROXU

ROXU is a specialized company based in Asturias, Spain, that has been in operation since 1978. The company operates within the manufacturing and industrial services sector, providing essential heavy machinery and logistics solutions. Their expertise includes the rental of cranes, heavy transport services, and industrial assembly. As a group, they specialize in providing mobile cranes, personnel lifting platforms, and various specialized transport solutions to meet industrial needs.

Risk assessment and organizational implications

The breach, as claimed by Space Bears, poses substantial risks to the organization, particularly regarding the privacy of its employees and clients. The theft of personal information increases the likelihood of secondary attacks, such as identity theft and targeted phishing campaigns, where the stolen data is used to deceive individuals or gain further access to corporate systems. Furthermore, because the company operates in Spain, it is subject to the General Data Protection Regulation (GDPR). Failure to uphold strict data protection obligations under this framework could result in significant administrative sanctions and legal penalties.

The mention of third-party partners in the leak announcement underscores the critical importance of supply chain security. Organizations must recognize that their security posture is often tied to the security of their business partners. A vulnerability in a partner's network can serve as a gateway to the primary organization's data. This highlights the need for robust vendor risk management and continuous monitoring of all interconnected entities.

To mitigate such risks, organizations in the manufacturing and industrial sectors should prioritize comprehensive security strategies. This includes implementing strict access controls, conducting regular audits of third-party access, and maintaining a strong incident response plan. While the technical proficiency of the Space Bears group remains a subject of discussion among analysts, their focus on data exfiltration and the subsequent use of leak sites necessitates a high level of caution for organizations managing sensitive industrial and personal data.