Ingka Group (IKEA) Targeted in Alleged Lapsus$ Data Theft: Ransomware Claim — What’s Alleged & What To Do

Ingka Group, the largest franchisee of IKEA stores, was named in claims by the group lapsus$ that it had stolen and was offering for sale approximately 180 GB of the organisation’s internal data. The claims were reported on 2 June 2026 and include assertions that source code and technical documents were taken. Ingka Group stated that it is investigating the matter; the number of individuals affected, if any, has not been disclosed.

The incident is one of several recent claims by the same group against large organisations. Its significance lies in the potential exposure of internal systems and documents belonging to a major retail operator that processes customer, supplier and operational information on a global scale.

What happened

On 2 June 2026, lapsus$ listed Ingka Group on its leak site and stated that it had obtained roughly 180 GB of data. The material was described as including source code, technical documents and other internal records. Ingka Group confirmed it was examining the claims. No independent verification of the data’s authenticity or volume has been made public, and the number of people whose information may be involved remains unknown.

The group behind it: lapsus$

Lapsus$ is a threat actor that has previously claimed responsibility for intrusions at technology and telecommunications companies. Public reporting has associated the group with tactics that include social-engineering of employees and contractors, followed by the publication or sale of stolen material on its own sites. In this case the group claims to possess Ingka Group data and to be offering it for sale; that claim has not been independently confirmed.

Ingka Group and its sector

Ingka Group operates the majority of IKEA stores worldwide under franchise agreements. Like other large retailers it maintains extensive internal systems for supply-chain management, product design, customer service and staff administration. A successful intrusion that yields source code or technical documentation can reveal how those systems are built and secured, information that may be of interest to other threat actors even if customer records are not involved.

The information in question

The claims refer to source code, technical documents and internal data. The precise contents of the material have not been published or verified. Organisations of this type routinely hold customer contact details, purchase histories, employee records and supplier contracts; however, the facts released so far do not confirm whether any of these categories are present in the claimed dataset.

The real-world impact

If the material proves genuine, Ingka Group faces the task of reviewing its internal controls and notifying regulators or affected parties where required by law. Individuals whose data appears in any released files could encounter increased risk of targeted phishing or account misuse. At present, no evidence has been presented that the data has been used in further criminal activity.

Were you affected?

Ingka Group has not released details on the scope of any exposure. Individuals concerned about their information can check whether their email address appears in known breach datasets through a free exposure scan offered by services that aggregate public breach records. If notified by the company or by a data-protection authority, follow the specific instructions provided for resetting passwords or monitoring accounts.

AICompiled with AI assistance from public sources and published under our editorial standards.