Mecanizados y Montajes Aeronáuticos (mymgroup.es) Listed by incransom Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 23, 2026, the ransomware group incransom listed Mecanizados y Montajes Aeronáuticos on its leak site, stating that it had taken 100 GB of internal files. The number of individuals whose information may be involved remains unknown, and the company has not confirmed the incident or released details on the contents of the data. For employees, suppliers, and clients connected to the firm, the practical concern is whether personal identifiers, employment records, or contract-related information appear among the claimed files.

Inside the incident

The listing appeared on the group’s site on the reported date. The only confirmed elements are the claimed volume of 100 GB and the description of the material as internal files exfiltrated during a ransomware operation. No timeline for the intrusion itself, no confirmation of encryption or data deletion on company systems, and no verified list of file categories have been made public. The organisation has not issued a statement, and independent verification of the claim is not available from the facts provided.

Who is incransom?

Incransom is a ransomware operation that maintains a public leak site where it lists victims and posts samples of claimed data. Groups of this type typically gain initial access through phishing, remote-desktop vulnerabilities, or compromised credentials, then move laterally to locate and copy files before deploying encryption. Their public listings serve as pressure tactics in extortion attempts. The current entry for Mecanizados y Montajes Aeronáuticos constitutes the group’s claim; no independent confirmation of the data’s authenticity or completeness has been established.

Who is Mecanizados y Montajes Aeronáuticos?

Mecanizados y Montajes Aeronáuticos is a Spanish SME that manufactures metallic components and subassemblies for aerospace programmes. It supplies Tier-1 contractors and original equipment manufacturers including Airbus, Boeing, Embraer, and Leonardo. Companies in this sector routinely handle technical drawings, quality-assurance records, supplier contracts, and employee data tied to regulated production environments. A breach therefore touches both commercial confidentiality and the personal information of staff working under strict traceability requirements.

What data was at risk

The listing refers only to “internal files.” No further breakdown of file types or data categories has been disclosed. Organisations of this kind commonly store personnel records, payroll information, customer and supplier contact details, and engineering documentation. The precise contents of the 100 GB claim remain unconfirmed.

Why it matters

Even without a confirmed count of affected individuals, exposure of internal files can lead to follow-on fraud, targeted phishing, or misuse of professional contact information. For the company, the incident adds regulatory scrutiny under aerospace-sector and data-protection rules. For people whose records may be included, the main risks are identity-related misuse and unsolicited contact rather than immediate large-scale fraud.

What to do if you're exposed

Individuals who have worked with or for the company can take the following steps:

• Review recent bank, email, and benefits statements for unusual activity.
• Enable or strengthen multi-factor authentication on work-related and personal accounts.
• Request a copy of any personal data held by the company under applicable data-protection rules.
• Run a free exposure scan of their email address against known breach datasets to check for additional appearances.

AICompiled with AI assistance from public sources and published under our editorial standards.