Freelom Listed by spacebears Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On August 22, 2026, the ransomware group known as spacebears listed Freelom — identified in connection with Freelom.net s.r.o., a Czech internet service provider — on its leak site. The listing is an accusation published by the group itself. It has not been publicly confirmed by the company, by a regulator, or by an independent breach index as of writing, and it may be incomplete, recycled, or inaccurate.

Public detail is limited. The number of people who might be affected is unknown, and the listing does not supply a verified inventory of what, if anything, was taken. For customers and contacts of a regional ISP, the practical question is what such a claim implies if it later proves partly or wholly true — and what cautious steps are reasonable while the picture remains unconfirmed.

What the listing says

According to the spacebears listing, Freelom.net s.r.o. appears as a named target. The group’s material describes the organisation as a Czech internet service provider and IT company based in Lomnice nad Popelkou, operating since 2009, focused on wireless internet access over its own network, with services described as available around the clock. The listing also names two managing directors, Jiří Plichta and Petr Malý, and repeats company-facing language about speed, reliability, quality of service, and an aim to resolve technical issues within a maximum of 24 hours. A related web address referenced in connection with the claim is freelom.cz.

On data, the listing’s own wording points to “SQL Data” and characterises it as all client personal data. That description is the attacker’s claim and marketing, not a confirmed forensic inventory. How many people might be involved, whether any files were actually exfiltrated, what systems were touched, and whether encryption or other disruption occurred are not established in the available record. Method of intrusion, ransom demand, and any proof package beyond the leak-site entry are undisclosed in the facts provided. The company has not publicly confirmed the claim as of writing.

Inside spacebears

Spacebears is presented publicly as a ransomware and extortion crew that uses leak-site pressure: victims are named, and the group threatens or stages publication of stolen data to force payment. Like other actors in this category, such groups typically claim network access, assert that databases or file stores were copied, and use countdown-style listings. Those patterns are how the ecosystem works in general; they do not prove that every named organisation was in fact compromised in the way the listing describes.

For this incident, only what appears on the listing should be attributed to spacebears. The group claims Freelom belongs on its site and claims client personal data in SQL form is involved. No independent confirmation of those claims is included in the available facts. Leak-site posts can exaggerate scope, mix old material with new claims, or name firms for leverage. A listing establishes that an extortion crew chose to publish an accusation — not that every technical detail is settled.

Who is Freelom?

Freelom.net s.r.o. is described in the listing and in ordinary public terms as a Czech ISP and IT firm serving customers with wireless internet over infrastructure it operates, based in Lomnice nad Popelkou and active since 2009. Regional providers of this kind sit between households, small businesses, and the wider internet. They commonly handle account identity, service addresses, contact channels, billing relationships, and the operational data needed to keep access working.

A claimed incident at an ISP matters because connectivity providers often hold steady, long-lived customer records and sit on paths that carry everyday traffic. Even when a specific breach is unproven, the sector’s role explains why customers pay attention to leak-site names: disruption or misuse of account-related information can affect billing, support trust, and fraud risk. That is a statement about sector consequences in general, not a finding that Freelom’s defences failed or that any particular system was reached.

What data was at risk

The facts do not confirm a verified list of exposed fields. spacebears’ listing claims SQL data described as all client personal data. Exact tables, field names, volume, and whether any copy left the environment remain unconfirmed.

If client databases at a firm of this type were ever taken, organisations in the ISP and regional IT sector typically hold some mix of the following — stated here only as sector norms, not as proof of what happened in this case:

• Customer names and service or billing addresses
• Phone numbers, email addresses, and account or contract identifiers
• Payment or invoicing references (sometimes partial card or bank-related metadata, depending on how billing is run)
• Technical service details such as installation locations, plan types, or support tickets
• Credentials or reset material only if poorly isolated — not something the listing proves here

None of that inventory is established for this listing. Readers should treat “all client personal data” as the group’s phrase, not as a completed audit.

The real-world impact

Until there is confirmation, impact is conditional. If personal client data were copied and later published or sold, affected people could face phishing that references a real ISP relationship, SIM-swap or account-takeover attempts that abuse known emails and phones, and fraud that cites genuine-looking service details. Identity-adjacent misuse is more plausible when names, addresses, and contact data travel together; financial harm depends on whether payment data was truly in scope — which is unconfirmed.

For the organisation, a public extortion listing can mean reputational strain, customer queries, and the cost of investigation whether or not the crew’s full story holds. A leak-site entry does not by itself establish negligence, encryption of production systems, or the quality of any response. It establishes pressure and an unverified claim. People affected figures remain unknown, so scale cannot be stated.

If your data was involved

If you are a Freelom or Freelom.net customer or contact and you want to act cautiously while nothing is confirmed, focus on containment and verification rather than panic. Treat unexpected messages that mention your ISP, invoices, or “data recovery” as suspect until you verify them through official channels you already trust. Use unique passwords on email and any customer portals; enable multi-factor authentication where available; and watch bank and card statements if you pay for service electronically. Do not assume your data is “out” solely because a crew published a name — and do not ignore basic hygiene if you are in the customer base either.

Practical first steps if you believe your information might be involved:

• Change passwords on email and related accounts and avoid reusing them elsewhere
• Turn on multi-factor authentication for email, banking, and any ISP or cloud logins
• Be sceptical of calls, SMS, or mail that pressure you to pay, install software, or “confirm” identity after a breach rumour
• Document suspicious contact and report clear fraud attempts to your bank and local authorities as appropriate
• Prefer official company status pages or known support numbers over links in unsolicited messages

You can also run a free exposure scan of your email to check whether your address has already appeared in known breach datasets elsewhere. That kind of check does not prove or disprove the spacebears listing about Freelom, but it can show whether your credentials or contact details are already circulating from other incidents and whether further password changes are overdue.

AICompiled with AI assistance from public sources and published under our editorial standards.