Mpr Lifts Listed by noescape Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 31 October 2023, the Swedish lift company Mpr Lifts appeared on a listing associated with the noescape ransomware group. Public detail is limited: the number of people affected is unknown, and the only description of what was taken refers to internal files said to have been exfiltrated in a ransomware attack. For customers, partners, employees, and others whose details may sit in those systems, the practical stakes are straightforward—uncertainty about whether personal or business information has left the organisation’s control, and what that could mean for privacy, fraud risk, and trust.

This article sets out only what has been reported, places the claim in context, and outlines concrete steps people can take while the full picture remains incomplete.

Inside the incident

According to the available record, Mpr Lifts was listed by the noescape ransomware group on or around 31 October 2023. The listing characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figure has been published for how many individuals were affected. Timing beyond the report date, the precise method of initial access, the volume of data, and any ransom demand or negotiation outcome are undisclosed in the material provided.

Because the primary public signal is a threat-actor leak-site listing, the claim that Mpr Lifts was breached and that internal files were taken should be treated as an assertion by the group rather than as independently verified fact. Organisations named in such listings sometimes confirm incidents later; sometimes they do not. At the time of the reported listing, public detail on confirmation, containment, or notification to regulators or affected parties is limited.

Who is noescape?

noescape was a ransomware operation that became publicly visible in the ransomware ecosystem in 2023. Like several contemporaneous groups, it was associated with a double-extortion model: encrypting systems to disrupt operations while also claiming to steal data and threatening to publish it if demands were not met. The group maintained a leak site on which it named alleged victims and, in some cases, posted samples or larger archives of stolen material. Public reporting has described noescape as operating in a ransomware-as-a-service style arrangement, in which affiliates carried out intrusions and shared proceeds with operators.

noescape’s listings, including the one naming Mpr Lifts, are claims made by the group. They do not by themselves prove the full scope of any intrusion, the sensitivity of every file involved, or the current status of negotiations. The group’s broader activity and later reported wind-down are matters of public cybersecurity reporting; none of that background should be read as adding unverified specifics to this particular case beyond the fact of the listing and the description of internal files exfiltrated in a ransomware attack.

About Mpr Lifts

Mpr Lifts is described in the reported summary as the leading lift company in Sweden, with nationwide coverage. Its stated mission centres on adapting Swedish society for disabled people in both private and public surroundings—work that typically involves the supply, installation, and maintenance of lifts, platform lifts, and related accessibility equipment for homes, housing associations, public buildings, and commercial sites.

Companies in this sector routinely hold operational and customer-facing records: contact and contract details for private clients and property managers, site addresses, service histories, invoices, employee and contractor information, and sometimes health- or accessibility-related notes needed to specify equipment. A breach involving internal files at such an organisation is consequential because those records can link real people to real addresses and needs, and because disruption to lift service and maintenance can affect mobility and safety for users who depend on the equipment.

What data was at risk

The facts name the exposed material only as internal files exfiltrated in a ransomware attack. No further breakdown—such as customer databases, HR files, financial records, or technical drawings—has been disclosed in the material available. The number of people affected remains unknown.

Organisations of this kind typically hold names, addresses, phone numbers, email addresses, contract and billing data, service schedules, and employee or supplier details. Some may also store notes related to accessibility requirements. None of those categories should be treated as confirmed contents of this incident. Exact contents are unconfirmed; only the general claim of internal-file exfiltration has been reported.

The real-world impact

For individuals, the main risks when internal business files are stolen are misuse of contact and address data for phishing or social engineering, possible exposure of financial or contractual details, and, in accessibility-related work, sensitivity around personal circumstances tied to home or workplace adaptations. Without a confirmed inventory of what left the network, people cannot know whether they are affected; that uncertainty itself is a burden.

For the organisation, a ransomware incident that includes claimed exfiltration can mean operational disruption, recovery costs, regulatory notification duties under applicable Swedish and EU rules, and reputational harm with customers who rely on the company for essential mobility equipment. Public detail does not establish whether systems were encrypted, how long any outage lasted, or what remediation steps were taken.

If your data was in this claimed breach

If you have been a customer, employee, or partner of Mpr Lifts, treat the listing as a reason for caution rather than as proof that your own records were taken. Practical first steps include:

• Watch for unexpected emails, calls, or messages that reference lifts, service visits, invoices, or accessibility work; verify any request through a known official channel before responding or paying.
• Review bank and card statements for unfamiliar charges if you have paid the company directly.
• Change passwords on accounts that reused credentials connected to work or service emails, and enable multi-factor authentication where available.
• Keep records of any suspicious contact and report clear fraud attempts to the relevant Swedish authorities.
• Run a free exposure scan of your email address to check whether it has already appeared in known breach datasets elsewhere, which can help you prioritise further monitoring.

Public information on this incident remains limited. Further clarity, if it comes, will depend on official statements from the organisation or regulators rather than on threat-actor claims alone.

AICompiled with AI assistance from public sources and published under our editorial standards.