UAM listed on datacarry leak site

• Ransomware group: datacarry
• Country: Spain
• Sector: Transportation
• Announcement date: November 21, 2025

UAM listed on datacarry leak site

The threat group known as datacarry has listed the organization UAM on its leak site. According to the announcement made on November 21, 2025, the threat actor claims to have obtained access to data belonging to the organization.

Details of the alleged breach

The incident was announced by the datacarry group on November 21, 2025. While the group claims to have successfully accessed the organization's data, the announcement lacks specific details. At this stage, there is no detailed information or screenshot available regarding the content of the announcement provided by the threat actor.

Regarding the specific nature of the information involved in this incident, the listing names no data types. No information or screenshot regarding the nature of the leaked data has been provided by the group.

The target organization

UAM is an organization operating within the transportation sector. The organization is based in Spain.

Potential implications and industry considerations

This incident may lead to scrutiny regarding UAM's data security protocols. The alleged breach could potentially trigger legal processes under the GDPR regulations in Spain, where the organization operates. Because the content of the data remains unclear, the extent of secondary risks, such as the exposure of employee or customer information, cannot yet be determined.

Public information about the datacarry group is limited. In such scenarios, organizations may need to review their internal audits and notify relevant authorities regarding the potential data breach.

In the broader context of cyber threats, ransomware leak sites are used by threat actors to pressure victims. These sites often serve as a platform for double extortion, a tactic where attackers not only encrypt an organization's systems but also threaten to release sensitive data to the public to increase leverage for ransom demands. When a group lists an organization, it signifies a potential compromise of confidentiality, integrity, or availability of digital assets.

For organizations in the transportation sector, maintaining robust cybersecurity posture is critical due to the sensitive nature of logistics and operational data. Defensive strategies typically involve implementing multi-factor authentication, maintaining regular offline backups, and conducting frequent vulnerability assessments. Furthermore, adhering to regional data protection frameworks, such as the GDPR in Europe, helps organizations establish a baseline for managing data privacy and responding to potential breaches through formal notification channels.