ThreeAM ransomware group lists safescaffolding.net on its leak site

• Ransomware group: ThreeAM
• Country: United Kingdom
• Sector: Manufacturing
• Announcement date: September 28, 2026

The ThreeAM ransomware group has listed safescaffolding.net on its leak site, claiming that a data breach has occurred. This announcement marks a new addition to the group's public list of targets, signaling a potential compromise of the organization's digital infrastructure.

The details of the claim

According to the announcement made on September 28, 2026, the ThreeAM group has added safescaffolding.net to its dedicated leak site. The group claims that it will publish the organization's data. While the threat actor has made this claim, public information regarding the specific identity, tactics, or background of the ThreeAM group remains limited in the public domain.

Ransomware groups often utilize leak sites as a form of double extortion. In such scenarios, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive information. The threat of releasing this stolen data on a public platform is used to pressure the victim into paying a ransom. By hosting these listings, ransomware groups attempt to maximize the reputational damage to their targets and increase the likelihood of a successful extortion attempt.

Data involved in the incident

At this stage of the incident, the leak announcement has not provided specific details regarding the scope of the breach. The listing names no specific data types, and no data samples or specific file contents were shared in the initial announcement.

In many ransomware incidents, the lack of immediate information regarding file counts or the volume of data stolen is common during the early stages of a leak. Organizations often face significant challenges in determining the exact extent of a breach until a full forensic investigation is completed. The absence of specific data samples in a leak site announcement does not necessarily mean that no data was taken, but rather that the group has not yet provided evidence to support their claims.

The organization profile

Safe Scaffolding is a British company operating in the commercial and residential construction sector. The firm provides a variety of essential services, including scaffolding infrastructure, material supply, and equipment installation services.

Impact and industry implications

The potential leakage of organizational data may lead to significant disruptions in business operations and can cause damage to various operational processes. Because the organization is based in the United Kingdom, any potential data breach may be subject to UK GDPR requirements, which could result in legal sanctions for the entity involved.

Furthermore, the exposure of employee or customer data may create serious risks for identity theft and the execution of targeted phishing attacks. When sensitive information is leaked, attackers often use it to craft more convincing social engineering campaigns, targeting specific individuals within or connected to the organization.

Given the methods employed by groups like ThreeAM, the publication of data could negatively impact the organization's reputation and pose significant risks to supply chain security. In the construction and manufacturing sectors, where many partners and subcontractors are interconnected, a breach in one company can create ripple effects throughout the supply chain.

To mitigate these risks, organizations in similar sectors typically focus on robust defensive measures. This includes implementing multi-factor authentication, maintaining rigorous patch management schedules, and conducting regular security awareness training for employees. Additionally, maintaining offline backups and implementing network segmentation can help limit the lateral movement of attackers and ensure that operations can be restored more effectively in the event of a successful intrusion.