Performance Data Solutions Listed by CRPxO Ransomware Group: What Was Exposed & What To Do

When a company that handles motorsport and data-acquisition work appears on a ransomware group’s leak site, the immediate concern is not abstract cybersecurity theatre. It is whether internal files that may contain employee details, client information, technical records, or commercial data have left the organisation’s control and could be misused. Public reporting on 27 July 2026 stated that Performance Data Solutions had been listed by the group known as CRPxO, with a claimed volume of exfiltrated data. How many people are affected remains unknown, and the precise contents of those files have not been fully itemised in available accounts.

For anyone who has worked with, contracted, or been employed by such a firm, the practical stakes are straightforward: internal material taken in a ransomware incident can later surface in secondary leaks, phishing campaigns, or fraud attempts. Until the organisation or independent investigators publish clearer confirmation, affected individuals are left to treat the claim seriously and take basic protective steps.

Breaking down the breach

According to the reported listing, Performance Data Solutions was named by the CRPxO ransomware group on or around 27 July 2026. The available summary places the organisation in the motorsport and data-acquisition sector and states that internal files were exfiltrated in a ransomware attack, with a claimed data volume of 12.8 GB. The number of people affected is unknown. Public detail does not describe the initial access method, the duration of any intrusion, whether systems were encrypted as well as copied, or whether negotiations took place. Those elements remain undisclosed.

What is on record is the group’s claim that data was taken and listed, together with the stated size of the package. No independent confirmation of the full scope, the exact file inventory, or successful restoration of operations has been included in the facts available for this account. Readers should therefore treat the leak-site entry as an unverified claim by the threat actor unless and until the organisation or regulators provide further verified detail.

The group behind it: CRPxO

CRPxO is presented in public reporting as a ransomware operation that follows the familiar double-extortion pattern used by many modern groups: encrypt or disrupt systems while also copying data, then pressure the victim by threatening to publish or sell the material on a dedicated leak site. Groups of this type typically advertise victims with brief descriptions, claimed data volumes, and countdown-style pressure, and they often specialise in opportunistic intrusion rather than highly tailored long-term espionage. Their listings are marketing and coercion tools; they are not independent audits.

For this incident, the facts state only that Performance Data Solutions was listed and that internal files were said to have been exfiltrated, with 12.8 GB claimed. No further statements attributed specifically to CRPxO about this victim—such as sample file names, ransom demands, or proof packages—are included in the provided record. Any broader reputation CRPxO may have from other campaigns should not be read as confirmed detail about what happened inside Performance Data Solutions’ environment.

Who is Performance Data Solutions?

Performance Data Solutions is identified in the reporting as operating in motorsport and data acquisition. Organisations in this sector commonly support racing teams, vehicle development, telemetry, sensor systems, performance analytics, and related engineering or commercial services. They may hold technical datasets, calibration and logging material, project files, supplier and client correspondence, and ordinary business records such as HR and finance documents.

A breach at a firm in this niche is consequential because motorsport and high-performance engineering sit at the intersection of competitive intellectual property, specialist contractors, and personal data belonging to staff and partners. Even when the public headline focuses on “internal files,” the business context means those files can mix proprietary technical work with identities and contact details that matter to real people. Public detail on the company’s exact size, client list, or security posture in this incident is limited.

What was likely exposed

The facts name the exposed material as internal files exfiltrated in a ransomware attack, with a claimed leak size of 12.8 GB. They do not publish a full inventory of file types, nor do they confirm whether customer databases, employee records, financial documents, source code, telemetry archives, or credentials were included. Exact contents therefore remain unconfirmed.

Organisations in motorsport and data acquisition typically hold a mix of engineering and operational data—test results, configuration files, logs, drawings or models, project schedules—alongside standard corporate information such as emails, contracts, invoices, and personnel records. It is reasonable to expect that a haul described only as “internal files” could touch several of those categories, but it would be inaccurate to state any specific category as proven fact for this incident. Until a fuller disclosure appears, the responsible position is that internal material was claimed stolen and that individuals connected to the firm should assume their information might be among it.

Why it matters

For people whose data may be involved, the risks are concrete rather than cinematic. Internal files can enable targeted phishing that references real projects or colleagues, account-takeover attempts if credentials or recovery information appear, and identity misuse if personal details such as names, addresses, or national identifiers were stored in HR or contractor folders. Competitive or technical material can also create secondary harm for clients and partners if proprietary work is published or sold.

For the organisation, a ransomware listing brings operational disruption, potential regulatory notification duties depending on jurisdiction and data types, contractual obligations to customers, and lasting trust costs even when the full technical picture is still incomplete. Because the count of affected people is unknown and the file-level detail is thin, both individuals and counterparties are left managing uncertainty—which itself is a form of harm that careful communication and verification steps can only partly reduce.

What to do if you're exposed

If you have a past or present connection to Performance Data Solutions—as staff, contractor, client, or supplier—treat the claim as a prompt to tighten basics. Change passwords on work-related and personal accounts that may have shared credentials or recovery emails, enable multi-factor authentication where it is available, and watch for unexpected messages that reference motorsport projects, invoices, or internal names. Monitor financial and credit activity if you have reason to believe identity documents or banking details could have been stored with the firm. Prefer official channels from the company or relevant authorities for breach notices rather than links arriving unsolicited.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach datasets. That check will not prove or disprove inclusion in this specific 12.8 GB claim, but it can show whether your address appears in other circulated dumps and help you prioritise which accounts to secure first. Keep records of any suspicious contact, and update protections as more verified detail, if any, becomes public.

AICompiled with AI assistance from public sources and published under our editorial standards.