SPG Construction listed on securotrop leak site

• Ransomware group: securotrop
• Country: Switzerland
• Sector: Manufacturing
• Announcement date: July 22, 2025

Securotrop claims data breach against SPG Construction

The threat actor group known as securotrop has listed the Swiss-based organization SPG Construction on its leak site. According to the announcement made on July 22, 2025, the group claims to have exfiltrated a significant amount of data from the company. The group alleges that the attack occurred around June 14, 2025, and they have published a notice regarding the breach because the company reportedly failed to contact them following the initial incident.

The threat actor group, securotrop, has a limited presence in the public domain, with very little information available regarding their specific tactics, techniques, or overall operational history. This lack of public information is common among emerging or specialized ransomware groups that operate with a high degree of discretion to avoid detection and attribution by security researchers and law enforcement agencies.

Details of the alleged data leak

The claim made by securotrop involves a substantial volume of information. The group asserts that they have stolen 118 GB of data, which reportedly consists of 110,789 files. The announcement suggests that the leak is a direct result of the organization's failure to engage in negotiations or communication with the attackers. This tactic is a hallmark of modern ransomware operations, where the threat actors use the threat of public disclosure to exert pressure on the victim.

Based on the screenshots provided by the group, the stolen information is highly sensitive and covers various aspects of the company's operations and personnel. The leaked data reportedly includes:

• Customer lists
• Project lists
• Employee names
• Employee dates of birth
• Payroll records
• Accident investigation reports

The exposure of such diverse datasets indicates a deep intrusion into the organization's internal file systems, reaching from administrative human resources records to operational project documentation.

About SPG Construction

SPG Construction is a company based in Switzerland that operates within the construction and building sector. The organization is involved in various construction projects and provides structural solutions as part of its core business operations. As a firm operating in the manufacturing and construction space, the company manages a wide array of sensitive project details, client information, and workforce data necessary for large-scale structural developments.

Potential impact and security implications

The alleged leak of this data carries significant risks for both the organization and the individuals involved. The exposure of personal employee data, such as names and dates of birth, significantly increases the risk of identity theft and makes employees targets for highly specific, targeted phishing attacks. When attackers possess such granular personal information, they can craft much more convincing social engineering campaigns to further compromise the network or defraud individuals.

Furthermore, the disclosure of sensitive business documents, including payroll and accident investigation reports, represents a major breach of corporate confidentiality. Such information can lead to a loss of competitive advantage and may cause significant reputational damage. From a regulatory perspective, since the company is based in Switzerland, this incident may lead to compliance issues under the Federal Act on Data Protection (FADP), which governs how personal data must be handled and protected.

The group's actions appear to follow the pattern of double extortion. In this tactic, attackers do not just encrypt a company's files to disrupt operations; they also steal sensitive data to use as leverage. By threatening to release the data publicly, the attackers aim to maximize the pressure on the organization to pay the ransom. In such scenarios, organizations often face the difficult task of notifying affected parties and communicating with relevant data protection authorities to comply with legal obligations and mitigate the impact of the breach.