MONTCAU Data Breach

The majinahanashi ransomware group has claimed responsibility for a data breach impacting MONTCAU, a manufacturing company based in Spain. The claim was published on the group’s leak site on August 30, 2026. SOCRadar CTI identified this listing. While the claim has not been independently verified, manufacturing companies, particularly those operating in technologically advanced economies like Spain, are often targeted by ransomware operations due to the critical nature of their operations and the potential for significant financial disruption if production is halted. The presence of sensitive operational data and intellectual property can also make them attractive targets for extortion. Over the past 60 days, majinahanashi has claimed 21 victims, with a notable concentration in Malaysia (MY), Colombia (CO), and the United States (US). Their primary sector focus has been on “Other” and “Hospitality” industries. The targeting of MONTCAU, a manufacturing entity, suggests a slight expansion or diversification of the group’s usual operational scope, as Spain is not a country they have heavily targeted according to recent activity, and manufacturing is not their most frequently claimed sector.

SOCRadar CTI’s analysis of stealer-log data for MONTCAU resulted in a “no_exposure_in_sample” verdict. This indicates that no credential records directly associated with the company’s domain (montcau[.]com) were found within the currently queried infostealer datasets. It is important to note that this result does not definitively clear MONTCAU of compromise, nor does it refute the claims made by the majinahanashi group. The absence of identified credentials in stealer logs means that while this specific attack vector has not been confirmed by SOCRadar’s telemetry, other initial access methods remain plausible. These could include phishing attacks, exploitation of vulnerabilities in public-facing services, or the use of compromised credentials obtained through other, unmonitored means. Further monitoring for any new claims or evidence related to MONTCAU by the majinahanashi group is advised. Organizations are encouraged to maintain vigilance regarding their security posture, including proactive credential hygiene and monitoring for any signs of unauthorized activity.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.