ThreeAM ransomware group lists fleetworksinc.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Transportation
• Announcement date: October 9, 2026

ThreeAM claims data breach against Fleetworks Inc.

The threat actor known as ThreeAM has targeted Fleetworks Inc. by listing the entity on its leak platform. According to the announcement made on October 9, 2026, the group claims that data belonging to the organization has been acquired. The threat actor has indicated that the relevant data will be made available in the near future.

Ransomware attack patterns often involve a technique known as double extortion. In these scenarios, threat actors do not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive information to use as leverage. By threatening to publish stolen data on a public leak site, attackers aim to pressure the victim into paying a ransom to prevent the exposure of proprietary or personal information. This method increases the pressure on the victim, as the threat of a data leak can cause significant reputational and legal damage even if the organization can restore its systems from backups.

Details regarding the alleged leaked data

At this stage, the group has not provided specific details regarding the nature of the information they claim to have stolen. There is currently no information or sample files provided regarding the nature of the alleged leaked data. Furthermore, the group has not disclosed the total size of the data or the specific number of files involved in the incident.

• No specific data types have been named in the listing.

When a group lists a victim without providing immediate samples, it often serves as a warning to the organization that the breach has occurred and that the threat of exposure is imminent. The lack of immediate data samples makes it difficult for the victim to assess the exact scope of the compromise until the attackers decide to release the files.

About Fleetworks Inc.

Fleetworks Inc. is a company providing heavy-duty truck repair and fleet services across California. They offer comprehensive technical services, including diesel engine repair and fleet maintenance, at their locations in Oakland, Santa Fe Springs, and Riverside.

Impact and organizational risks

This incident may negatively impact the organization's operational continuity and customer trust. As the company operates in the US, a potential data breach could lead to legal consequences under state-level data protection laws and regulations. Depending on the content of the compromised data, secondary risks such as identity theft and targeted phishing attacks may emerge if employee or customer information is involved.

Information regarding the ThreeAM group is limited; therefore, the group's methods and motivations remain uncertain. In such cases, organizations are often advised to initiate a comprehensive forensic investigation to determine the scope of the breach. Such investigations are critical for identifying the initial entry point, the extent of lateral movement within the network, and exactly which datasets were accessed or exfiltrated.

For organizations operating in critical service sectors like transportation and maintenance, maintaining robust cybersecurity posture is essential. Common defensive steps include implementing multi-factor authentication, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Furthermore, monitoring for unauthorized data exfiltration and maintaining a clear incident response plan are vital components of a modern defense-in-depth strategy. As seen in this case, the uncertainty surrounding the threat actor's motivations adds another layer of complexity to the risk assessment process.