SolidCAM LEAK Listed by handala Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 11 June 2024 a ransomware group known as handala listed SolidCAM on its leak site and claimed to have taken internal files during an attack. The number of people affected remains unknown, and public detail on the full scope is limited. For anyone whose information may sit inside those files—employees, partners, or customers—the practical stakes are straightforward: stolen internal material can enable further fraud, targeted phishing, or competitive misuse long after the initial incident.

The group has framed the listing as a response to what it describes as the company’s indifference, and it has already released a 50 GB proof-of-concept sample of unreleased software. Until independent confirmation appears, that claim should be treated as an unverified assertion rather than established fact.

Breaking down the breach

According to the leak-site entry dated 11 June 2024, handala asserts that it exfiltrated internal files from SolidCAM in a ransomware attack. The group states that it has released 50 GB of software that was still under development and had not yet been officially published, presenting the material as a proof of concept. It further claims that if the company continues to deny the incident it will publish “all the data related to SolidCAM.” No independent verification of the intrusion method, the exact date of access, or the total volume of data has been made public. The number of individuals whose records may be involved is listed as unknown.

Who is handala?

Handala is a ransomware group that operates by encrypting systems and simultaneously copying data for later publication or sale. Like other actors in this category, it maintains a public leak site where it names victims, posts samples, and sets deadlines for payment or acknowledgment. The group has previously listed organisations across manufacturing, technology and other sectors, typically combining technical extortion with public pressure. Its statements about any single victim—including the claim that SolidCAM has ignored the breach—are self-reported and should be read as such. No confirmation that handala’s assertions about this particular incident have been independently validated appears in the available record.

Who is SolidCAM LEAK?

SolidCAM develops computer-aided manufacturing (CAM) software used to program CNC machine tools. Companies in this sector routinely hold source code, product road-maps, customer project files, employee records, and commercial contracts. A breach that reaches internal development material can therefore expose both proprietary intellectual property and the personal or business data of people who work with or for the firm. Because the software is used in precision manufacturing, any compromise also raises questions about the integrity of tools that control industrial equipment. Public detail on how SolidCAM itself has responded remains limited.

What was likely exposed

The only data types named in the available facts are “internal files” said to have been exfiltrated in a ransomware attack, together with a 50 GB sample of software still under development. Organisations that produce CAM software typically store source code, design documents, customer configurations, employee directories, and financial or contractual records. Whether any of those categories were among the files taken has not been confirmed. The exact contents of the claimed 50 GB release and of any larger archive remain unconfirmed beyond the group’s own description.

The real-world impact

For individuals, the principal risks are secondary misuse of any personal or contact data that may have been present: phishing that references internal projects, credential stuffing if passwords were stored, or social-engineering attempts aimed at colleagues and partners. For the organisation, the exposure of unreleased software can erode competitive advantage and create support burdens if incomplete code circulates. Customers who rely on SolidCAM tools may also face uncertainty about whether their own project files were among the material taken. Because the number of affected people is unknown and the full inventory of files is undisclosed, the precise scale of these risks cannot yet be measured.

If your data was in this claimed breach

If you have reason to believe your information was held by SolidCAM, treat the situation as a possible exposure even while details stay limited. Practical first steps include:

• Change passwords for any accounts that may have been linked to the company and enable multi-factor authentication where available.
• Watch for unexpected emails or calls that reference SolidCAM projects or internal terminology; treat them as potential phishing.
• Review financial and credit statements for unusual activity if payment or identity data could have been involved.
• Request a free exposure scan of your email address against known breach data sets to see whether your details have already appeared elsewhere.

Continue to monitor official statements from the company and from independent researchers; new information may clarify what was actually taken. Until then, the safest course is measured caution rather than assumption that the incident does not affect you.

AICompiled with AI assistance from public sources and published under our editorial standards.