TUAN LE Construction Company Limited targeted by radar ransomware group

• Ransomware group: radar
• Country: Vietnam
• Sector: Manufacturing
• Announcement date: December 1, 2025

The threat actor known as radar has listed TUAN LE Construction Company Limited on its leak site, claiming to possess files belonging to the organization. This announcement, which appeared on December 1, 2025, indicates that the group has gained access to data that they claim is confidential. The threat actor has asserted that these files are accessible via an external platform.

The details of the claim

According to the announcement made by the radar group, the organization's data has been compromised. The threat actor claims to have obtained files that are specifically marked as confidential. While the group has published this information on their leak site, it is important to note that the exact nature and scope of the data cannot be determined at this time because no screenshots were provided to verify the contents of the leak.

In modern cyberattack scenarios, ransomware groups often employ a strategy known as double extortion. In this model, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive information. The threat of leaking this data on a public or semi-public leak site serves as additional leverage to pressure the victim into paying a ransom. By hosting the data on an external platform, the group aims to maximize the visibility of the breach and increase the pressure on the target organization.

Data involved in the incident

The leak announcement claims that files marked as confidential are included in the breach. However, as there is no screenshot available, the exact scope and nature of the data cannot be determined. The listing does not specify the volume of the data or the specific file types involved.

• No specific data types were named in the listing.

About TUAN LE Construction Company Limited

TUAN LE Construction Company Limited is a Vietnam-based construction and engineering firm. It specializes in industrial facilities, commercial buildings, and infrastructure projects.

Risk assessment and organizational implications

This incident suggests that the organization's sensitive data may have been exposed to unauthorized parties. Depending on the content of the data, the disclosure of employee or customer information could lead to secondary risks such as identity theft and targeted phishing attacks. When sensitive corporate or personal information is leaked, it often becomes a tool for subsequent social engineering campaigns where attackers impersonate trusted entities to deceive employees or clients.

Information regarding the radar group is limited, making it difficult to attribute the attack to a specific known entity or to understand their long-term objectives. For organizations operating in the construction and engineering sector, such breaches can pose significant risks to project blueprints, contract details, and client information.

To mitigate such risks, organizations typically need to review their data security processes and evaluate their legal notification obligations. Common defensive steps for companies include implementing robust access controls, maintaining regular offline backups, and conducting thorough security audits to identify vulnerabilities in their network perimeter. Furthermore, monitoring for unauthorized data exfiltration and enhancing employee awareness training regarding phishing attempts are essential components of a modern cybersecurity posture.