Ransomware victim disclosure
← All victimsTakosan Otomobil Göstergeleri San. ve Tic. A.Ş.
listed as TAKOSAN OTOMOBIL · Claimed by nightspire · listed 2 days ago
Status timeline
- Listed
May 18, 2026
- Data leaked
At a glance
- Group
- nightspire
- Status
- Data leaked
- Country
- TR
- Sector
- Manufacturing
- Listed on leak site
- May 18, 2026
About the victim
AI dossier — public-source company profileTakosan is a Nursanlar Group company and a leading Turkish automotive supplier with over 40 years of experience. The company manufactures instrument clusters, fuel sensor units, display instruments, tachographs, and plastic parts, operating across three facilities totalling 14,300 m² in Turkey and Romania with 315 employees. It supplies major OEMs including Renault, Ford, Toyota, and others, producing over one million instrument clusters annually.
- Industry
- Automotive Instrumentation & Electronic Components Manufacturing
- Address
- Taysad-Gebze (head office); Tepeören, Istanbul (plastic injection plant); Romania (instrument cluster assembly plant)
- Employees
- 315
Attack summary
Severity: high — Confirmed exfiltration and publication of significant business data including financial records, contracts, and strategic documents from an established automotive supplier with major OEM clients; no regulated personal data at scale is explicitly confirmed but business-sensitive data exposure is substantial.The Nightspire ransomware group claims to have exfiltrated data from Takosan, publishing technical documents, financial sheets, contracts and invoices, and business strategy files. No ransom amount or data volume was stated, but the disclosure status indicates data has been published.
Data the group says was taken
AI dossier — extracted from the leak post- Technical documents
- Financial sheets
- Contracts and invoices
- Business strategy files
What the group claims
- Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files
Sources
- Victim sitewww.takosan.com.tr/en
Source
Indexed 2 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
