Joso Listed by Deadlock Ransomware Group: Ransomware Claim — What’s Alleged & What To Do
Joso was listed by the Deadlock ransomware group on July 10, 2026, after internal files were exfiltrated in the attack. Affected individuals should check whether their information was exposed and take any recommended protective steps.
Inside the incident
The incident involves a ransomware attack in which internal files were allegedly exfiltrated. The listing appeared on July 10, 2026. No further details on the timing of the intrusion, the volume of data taken, or the method of initial access have been disclosed publicly.
Inside Deadlock
Deadlock is a ransomware operation that typically encrypts victim systems and then posts claims of data theft on a dedicated leak site. The group has been observed targeting organizations across multiple sectors and using the threat of publication to pressure payment. Its listing of Joso constitutes the group’s own claim; independent confirmation of the data’s contents or scope has not been reported.
Who is Joso?
Joso is an industrial engineering and manufacturing company located in Lonevåg, Norway. It produces high-quality mechanical components and hardware used in various industrial applications. Companies of this type routinely maintain records on suppliers, production specifications, client orders, and internal operations.
The information in question
The only data type named in connection with the listing is internal files exfiltrated during the ransomware attack. The precise categories of information contained in those files have not been disclosed. Organizations in the industrial manufacturing sector commonly hold technical drawings, contract details, employee records, and correspondence with partners, but the exact contents in this case remain unconfirmed.
Why it matters
For the company, exposure of internal files can complicate relationships with customers and suppliers and may require additional security reviews of production systems. For individuals whose details appear in those files, the main concern is the potential for targeted follow-on contact or misuse of any personal or financial information that was stored alongside operational records. The absence of a confirmed data volume leaves the scale of these risks undetermined.
Were you affected?
Begin by checking any recent communications from Joso or its partners for official notifications. Review bank and account statements for unusual activity and consider placing fraud alerts with credit agencies if personal identifiers were likely stored by the company. Readers can also run a free exposure scan of their email address against known breach data sets to determine whether their information has appeared in previously published collections.
AICompiled with AI assistance from public sources and published under our editorial standards.
How this breach connects
More recent breaches
FBC Listed by Deadlock Ransomware GroupUfoc Listed by Deadlock Ransomware GroupFiresta Listed by Deadlock Ransomware GroupUFL Listed by Deadlock Ransomware GroupLatest breaches
Read GalaxyWarden’s full analysis of the Joso Listed by Deadlock Ransomware Group →
Publicly posted by deadlock — unverified claim, pending independent verification
Breach listings — particularly those originating from ransomware or leak sites — are third-party claims that may be unverified, incomplete, or inaccurate. A listing does not by itself confirm that a breach occurred or that any specific data was exposed. Severity is an automated assessment, not a definitive rating. Verification status is shown where available.
Attributions to threat groups and methods reflect public reporting and, in some cases, unverified claims made by the groups themselves; they may be incomplete or later revised. Recent Breaches and GalaxyWarden are independent and are not affiliated with, and do not endorse, any company or group named on this page. This information is aggregated from public sources for awareness only and is not legal, security, or investment advice.