Stuf Storage data allegedly listed by fulcrumsec on leak site

• Ransomware group: fulcrumsec
• Country: United States
• Sector: Retail & E-Commerce
• Announcement date: May 8, 2026

Fulcrumsec claims to have breached Stuf Storage

The threat group known as fulcrumsec has listed data allegedly belonging to Stuf Storage on their leak site. According to the announcement made on May 8, 2026, the group claims to have successfully targeted the organization, resulting in a significant data leak involving approximately 221 GB of information.

The threat actor claims to have gained unauthorized access to the company's cloud storage infrastructure. By targeting this specific environment, the group asserts they were able to acquire a massive dataset containing a wide variety of sensitive information. The announcement suggests that the stolen data is not limited to simple records but encompasses a broad spectrum of files, ranging from customer-related documentation to technical infrastructure configurations.

Details of the claimed data theft

The volume of the data claimed by fulcrumsec is substantial, totaling 221 GB and consisting of 78,000 files. Based on the group's announcement, the leaked dataset is highly diverse and contains information that could impact multiple stakeholders within the organization. The breach reportedly includes a mix of personal, operational, and technical data.

The specific items identified in the leak include:

• Customer contracts
• Audio recordings
• GPS location data
• Unit access codes
• Digital signatures
• Employee HR data
• AWS configuration files

The presence of such varied data types, particularly audio recordings and access codes, indicates a deep level of access into the company's operational and communication channels.

About Stuf Storage

Stuf Storage is a technology-driven storage company that provides urban self-storage solutions. The organization offers flexible storage spaces designed to meet the needs of both individual and commercial users in urban environments.

Security implications and industry context

This alleged breach carries significant risks for the affected parties. The exposure of specific data types, such as unit access codes and GPS location data, could create direct security vulnerabilities for individuals regarding their private spaces. Furthermore, the inclusion of customer contracts and digital signatures increases the potential risk of identity theft for the individuals involved.

From a legal and regulatory perspective, the company may face scrutiny and investigations under state-level data protection regulations, such as the CCPA and the SHIELD Act. The nature of the leak suggests the group may be employing double-extortion tactics. In such scenarios, threat actors not only encrypt an organization's data to demand a ransom but also steal the data and threaten to publish it on a leak site to damage the company's reputation and force payment.

While public information regarding the specific activities of the fulcrumsec group remains limited, this incident highlights the ongoing risks faced by technology-driven service providers. Organizations in the storage and retail sectors often rely heavily on cloud infrastructure, making the security of AWS and other cloud configurations a critical priority. To defend against such threats, organizations typically implement multi-factor authentication, rigorous access controls for cloud environments, and continuous monitoring of their digital infrastructure to detect unauthorized access before large-scale data exfiltration can occur.