fasadeconsult.no Listed by m3rx Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

People whose information appears in internal business records can face downstream risks when those records are taken and later circulated. In this case, the Norwegian company fasadeconsult.no has been listed by a ransomware group that states it obtained a large volume of the firm’s files. The listing appeared on 11 June 2026. The group claims to have removed 84 GB of data comprising roughly 390 000 files. No figure has been published for the number of individuals whose personal information may be included, and the company has not issued a public statement confirming or denying the claims.

What happened

The incident is described only as a ransomware attack in which internal files were allegedly exfiltrated. The precise date of the intrusion, the initial access method, and whether any systems were encrypted have not been disclosed. The sole public indication of the event is the group’s listing of the company on its leak site.

Who is m3rx?

m3rx is a ransomware operation that has been publicly tracked for several years. Like similar groups, it typically gains access through remote services or compromised credentials, deploys encryption on target networks, and then lists victims on a dedicated site to pressure them into paying. The appearance of fasadeconsult.no on that site constitutes the group’s claim that it possesses the data; independent confirmation of the claim has not been reported.

fasadeconsult.no and its sector

fasadeconsult.no operates as fasadeConsult Aluminium AS, a Norwegian firm with more than 45 years of activity in the design, production and installation of aluminium and glass building components. Its work includes doors, windows, facades and glass roofs, some of which incorporate fire, bullet or burglary resistance. Companies in this sector routinely maintain records on clients, suppliers, project specifications and internal operations.

The information in question

The only details released state that 84 GB of internal files, totalling approximately 390 000 items, were removed. The exact categories of data within those files have not been published. Organisations of this type commonly store customer contact details, project documentation, supplier agreements and employee records, but it remains unconfirmed whether any of those categories are present in the exfiltrated material.

Why it matters

Even without a confirmed count of affected individuals, the volume of files taken creates the possibility that personal or commercial information could be used for fraud, targeted phishing or competitive intelligence. For the company, the incident adds the costs of investigation, potential regulatory notification under Norwegian data-protection rules, and any measures required to restore secure operations.

If your data was in this claimed breach

Begin by monitoring bank and credit accounts for unusual activity and consider placing a fraud alert with credit agencies. Change passwords for any accounts that may have been referenced in company correspondence. Readers can also run a free exposure scan of their email address against known breach data sets to see whether their information has appeared in previously published leaks.

AICompiled with AI assistance from public sources and published under our editorial standards.