Eiffage Listed by lapsus$ Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On March 1, 2026, the ransomware group lapsus$ listed Eiffage on its leak site and claimed responsibility for a ransomware attack that resulted in the exfiltration of internal files. The number of people affected remains unknown, and no further details on the volume or specific contents of the data have been made public. The incident adds to a pattern of claims by ransomware operators targeting large infrastructure and construction firms.

Breaking down the breach

The only confirmed public information is the listing itself and the group's assertion that internal files were taken during a ransomware operation. No date of the intrusion, no attack method, and no confirmation of data volume or encryption have been disclosed. Eiffage has not issued a public statement detailing its response or the scope of any investigation.

Inside lapsus$

Lapsus$ is a ransomware group that has publicly claimed multiple intrusions against high-profile organizations. Its typical approach involves gaining initial access, exfiltrating data, and then listing victims on a leak site to pressure them into payment. The group has previously targeted technology, telecommunications, and government-linked entities. In this case the listing of Eiffage stands as an unverified claim by the group.

About Eiffage

Eiffage is a French publicly listed construction and civil-engineering company founded in 1993. It operates across five main segments—Construction, Infrastructure, Real Estate Development, Metal, and Concessions & Energy—and maintains projects in more than fifty countries. Organizations of this type routinely handle project documentation, supplier contracts, employee records, and operational data tied to large-scale infrastructure work.

What data was at risk

The listing refers only to “internal files exfiltrated in ransomware attack.” No inventory of file types or categories has been released. Exact contents therefore remain unconfirmed. Companies in the construction and infrastructure sector commonly store design documents, financial records, personnel information, and correspondence with public-sector clients; whether any of these categories were involved cannot be verified from available information.

Why it matters

Even without Reported Details, the exposure of internal files from a major infrastructure contractor can affect project timelines, commercial relationships, and the privacy of individuals whose records are held by the company. For Eiffage the incident may require extended forensic review and coordination with clients and regulators. For individuals, any personal data that was present could increase the risk of targeted follow-on activity such as phishing or identity misuse.

If your data was in this claimed breach

Because the exact data types remain undisclosed, individuals cannot yet determine whether their information was involved. Practical first steps include monitoring financial and email accounts for unusual activity and enabling multi-factor authentication wherever possible.

• Review recent statements from Eiffage or official notifications for any guidance on affected individuals.
• Run a free exposure scan of your email address against known breach data to check for prior appearances of your information.
• Remain alert for unsolicited messages that reference Eiffage or related projects.

AICompiled with AI assistance from public sources and published under our editorial standards.