MTCO (Mahmoud Altaheni & Partners Trading Company) Listed by Gammax Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target commercial firms across the Middle East and Gulf region, often by listing alleged victims on leak sites after claiming to have stolen internal data. These listings form part of a wider pattern in which operators pressure organisations by threatening to publish material if demands are unmet. Against that backdrop, Mahmoud Altaheni & Partners Trading Company, also referred to as MTCO, appeared in a listing attributed to the Gammax ransomware group.

Public reporting dated 1 August 2026 states that the company was named by Gammax in connection with a ransomware incident involving the exfiltration of internal files. The number of people affected remains unknown, and many operational details have not been disclosed. For customers, partners and staff who deal with a trading firm active in Saudi Arabia and the wider GCC, even limited confirmation of stolen internal material raises practical questions about exposure and next steps.

Breaking down the breach

According to the available record, Mahmoud Altaheni & Partners Trading Company was listed by the Gammax ransomware group. The reported date associated with the listing is 1 August 2026. The facts describe the incident as a ransomware attack in which internal files were exfiltrated. No figure has been given for the volume of data, the number of systems involved, or the precise timeline of intrusion, encryption or discovery. The count of individuals whose information may have been touched is listed as unknown.

Method of initial access, duration of presence inside the network, and whether encryption was deployed alongside theft are not detailed in the public summary. What is stated is that internal files were taken as part of the attack and that the organisation was subsequently named on the group’s listing. Beyond that claim and the high-level description of exfiltrated internal files, further technical particulars remain undisclosed.

The group behind it: Gammax

Gammax is known publicly as a ransomware operation that follows the familiar double-extortion model used by many contemporary groups: operators claim to steal data before or during encryption and then threaten to publish or sell it if a payment is not made. Like peer groups, Gammax has used dedicated leak sites or similar channels to name alleged victims and, in some cases, to release samples or larger archives as pressure tactics. Public reporting on such actors typically notes opportunistic targeting of organisations that hold commercially sensitive or operationally useful records, rather than a single narrow industry focus.

In this instance, the group’s listing of Mahmoud Altaheni & Partners Trading Company should be treated as a claim by the actors themselves. The facts do not independently confirm every assertion that may appear on a leak site. No specific statements attributed to Gammax about this victim—beyond the fact of the listing and the description of internal files exfiltrated in a ransomware attack—are provided in the record, and none should be invented.

Mahmoud Altaheni & Partners Trading Company and its sector

Mahmoud Altaheni & Partners Trading Company, referred to in the breach material as MTCO, is described as operating in Saudi Arabia and the GCC, with more than fifteen years of industry experience. Trading companies of this type commonly sit between suppliers, distributors and end customers, handling procurement, logistics coordination, commercial contracts and related administrative work across regional markets.

Organisations in wholesale and general trading routinely maintain records that support day-to-day commerce: counterparties’ contact details, order and shipment information, pricing and credit arrangements, internal correspondence, and employee or contractor data needed for operations. A breach affecting such a firm can therefore touch both the company’s own staff and the wider network of businesses that rely on it. Because trading houses often interconnect with multiple partners across the Kingdom and the Gulf, disruption or exposure of internal files can have knock-on effects beyond a single office.

The information in question

The facts name the exposed material as internal files exfiltrated in a ransomware attack. No fuller inventory—such as whether the files included customer databases, financial ledgers, identity documents, credentials, or employee records—has been disclosed. The number of people affected is unknown.

Firms in this sector typically hold a mix of commercial and personal data: names and contact details of clients and suppliers, contractual and invoicing records, shipping and inventory information, and internal HR or administrative files. It is reasonable to expect that some combination of those categories could exist inside a trading company’s systems. At the same time, the exact contents of what Gammax claims to have taken from Mahmoud Altaheni & Partners Trading Company remain unconfirmed in the public record. Readers should not assume any specific document type was included unless further verified detail emerges.

Why it matters

When internal files leave an organisation in a ransomware incident, the concrete risks are straightforward. Individuals whose names, contact details or other personal data appear in those files may face phishing or social-engineering attempts that reference genuine commercial relationships. Business partners could see sensitive pricing, contract terms or logistics information misused by competitors or fraudsters. The company itself may confront operational disruption, regulatory notification duties under applicable Saudi and regional rules, and the longer task of restoring trust with counterparties.

Because the scale of the theft and the precise data types are not public, the severity for any single person or partner cannot be measured from the listing alone. Uncertainty itself is a cost: affected parties must decide how far to go in monitoring accounts, reviewing recent correspondence and tightening authentication without knowing whether their own records were among those taken. For a trading firm embedded in GCC supply chains, even a limited leak of internal material can complicate ongoing deals and invite follow-on fraud attempts that exploit knowledge of real transactions.

If your data was in this breach

If you have a past or present relationship with Mahmoud Altaheni & Partners Trading Company—as a customer, supplier, employee or contractor—treat the listing as a prompt to take basic precautions rather than as proof that your specific records were stolen. Watch for unexpected messages that reference the company or recent orders; verify any payment or data requests through a known channel before responding. Consider updating passwords on related accounts, enabling multi-factor authentication where available, and reviewing financial or commercial statements for unfamiliar activity.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step will not confirm or deny involvement in this particular incident, but it can show whether your address has surfaced elsewhere and help you prioritise further monitoring. Stay alert to official notices from the company or from relevant authorities if more verified detail is released.

AICompiled with AI assistance from public sources and published under our editorial standards.