ThreeAM ransomware group lists aceforwarding.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Transportation
• Announcement date: May 1, 2026

ThreeAM claims data breach at Ace Forwarding

The threat actor known as ThreeAM has listed aceforwarding.com on its leak site, announcing that it has made various file archives accessible. According to the group's announcement, the data was published on November 24, 2025. The group claims to have released approximately 37.54 GB of data, which is stated to belong to the company's logistics operations.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat actors then threaten to publish this stolen data on public leak sites if the ransom demand is not met. This pressure tactic aims to maximize the impact of the attack by threatening the target's reputation and legal standing.

Details of the alleged data leak

Based on the file names provided in the announcement, it is assessed that several types of sensitive information may have been leaked. The available information suggests that the breach may involve:

• Financial records (QuickBooks)
• Scanned documents
• Personal or corporate file archives (ALundgren.rar)

The specific contents of the archives and the full extent of the exposure remain to be determined, as the group has not provided further details regarding the specific files included in the 37.54 GB cache.

About Ace Forwarding

Founded in 1994, Ace Forwarding is a logistics and transportation company based out of the Detroit airport, specializing in time-critical shipments. The company serves as a logistics operation focused on fulfilling urgent delivery requirements for its customers.

Analysis and potential impact

The allegedly leaked data may contain sensitive information regarding the company's financial processes and operational details. This could lead to the exposure of trade secrets and secondary risks that may result in the disclosure of employee or customer data. As the company is based in the US, data breach notification obligations under relevant state laws and federal regulations may arise. Furthermore, it is possible that the leaked data could be utilized for identity theft or targeted phishing attacks.

Public information regarding the ThreeAM group is limited, making it difficult to assess their specific methodologies or long-term objectives. In many such cases, the disclosure of corporate files and financial records provides a roadmap for subsequent social engineering attacks. For example, attackers may use leaked financial data to craft highly convincing phishing emails directed at employees or business partners.

Defensive considerations for the logistics sector

Organizations operating in the transportation and logistics sector are often targets for cybercriminals due to the high volume of time-sensitive data and the critical nature of their operations. Maintaining business continuity is essential, as even brief disruptions can have significant ripple effects across supply chains.

To mitigate the risks associated with ransomware and data exfiltration, organizations typically implement a multi-layered defense strategy. This includes robust backup solutions that are stored offline or in immutable environments to ensure data can be restored without paying a ransom. Additionally, implementing strict access controls and multi-factor authentication (MFA) can help prevent unauthorized access to sensitive file archives and financial systems.

Continuous monitoring of network traffic and the use of endpoint detection and response (EDR) tools are also vital for identifying suspicious activity before large volumes of data can be exfiltrated. As the threat landscape evolves, staying informed about the tactics, techniques, and procedures used by groups like ThreeAM is a fundamental component of a proactive cybersecurity posture.