Bender Tribunenbau Data Breach

lamashtu has listed Bender Tribunenbau, a German company specializing in the construction of grandstands and tribunes for sports venues and event infrastructure, on its dark web leak site on October 5, 2026. The ransomware group claims to have exfiltrated sensitive corporate data and threatens to publish it. This incident aligns with lamashtu’s ongoing campaign targeting European industrial organizations, with Germany being a frequent target. The nature of Bender Tribunenbau’s business, involving project documentation, client contracts, and structural designs, makes its data valuable for extortion purposes. Over the past 60 days, lamashtu has actively targeted manufacturing and industrial companies across Germany, Spain, and Mexico. Notable victims within this period include Grupo Industrial Tauro, Altmannshofer Sicherheits-Videotechnik, Wilhelm Kühne, and Astidental di Sabbione, all operating within manufacturing or specialized industrial sectors. The group’s focus on German industry is likely driven by the high concentration of industrial targets in the country and the sector’s dependence on operational technology, which often presents known security vulnerabilities.

SOCRadar’s investigation into the domain bender-tribuenen[.]de did not yield any matching credential records. However, the absence of stealer log data does not conclusively indicate that Bender Tribunenbau is unaffected. Threat actors like lamashtu employ various initial access vectors, including spear-phishing, vulnerability exploitation, and the use of compromised third-party credentials. Therefore, the lack of direct stealer log exposure suggests that lamashtu may have utilized an alternative method to gain unauthorized access to the company’s network. Engineering and construction firms possess a wealth of sensitive data, such as project documentation, client contracts, structural designs, and CAD files. This information is highly sought after on dark web markets and is valuable for extortion. These companies also often maintain extensive remote access infrastructure to support contractors and remote sites, thereby increasing their attack surface. Organizations within this sector are advised to conduct rigorous backup restoration tests, meticulously audit their remote access configurations, and ensure an incident response plan is readily available and prepared for activation.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.