Ransomware victim disclosure
← All victimsBHS Bau- und Handelsgruppe GmbH & Co. KG
listed as BHS Bau · Claimed by Akira · listed 2 months ago
Status timeline
- Listed
Mar 27, 2026
- Data leaked
At a glance
- Group
- Akira
- Status
- Data leaked
- Country
- Germany
- Sector
- Construction
- Listed on leak site
- Mar 27, 2026
- Data size
- 10 GB
About the victim
AI dossier — public-source company profileBHS Bau- und Handelsgruppe GmbH & Co. KG is a Dresden-based construction company with extensive experience in the extraction of building materials and asphalt production. The company provides comprehensive services for deep and road construction projects. It operates as a combined construction and trading group (Bau- und Handelsgruppe).
- Industry
- Construction Materials, Asphalt Production & Civil Engineering
- Address
- Dresden, Germany
Attack summary
Severity: high — Confirmed exfiltration of significant business data including employee PII, financial records, client files, and confidential contracts/NDAs at 10 GB scale, with data publication imminent.Akira claims to have exfiltrated approximately 10 GB of corporate data from BHS Bau- und Handelsgruppe GmbH & Co. KG, with planned publication of employee personal documents, project files, financial documents, contracts and agreements, client files, and NDAs.
Data the group says was taken
AI dossier — extracted from the leak post- Employee personal documents
- Project files
- Financial documents
- Contracts and agreements
- Client files
- NDAs
What the group claims
Based in Dresden, BHS Bau- und Handelsgruppe GmbH & Co. KG has ex tensive experience in the extraction of building materials, aspha lt production, and civil engineering. The company offers a compre hensive service package for deep and road construction. We will upload 10gb of corporate data soon. Employee personal doc uments, project files, financials docs, contracts and agreements, client files, NDAs.
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
