Spacemanic Listed by fog Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target specialised technology firms across Europe, treating even smaller engineering outfits as sources of leverage through data theft and public pressure. In this climate, listings on criminal leak sites have become a routine way for attackers to claim success and force negotiations, often before independent verification is possible.

On 12 February 2025, the Czech nanosatellite company Spacemanic was named by the fog ransomware group as a victim. Public reporting indicates that internal files were exfiltrated during a ransomware attack. The number of people affected remains unknown, and many operational details have not been disclosed. The listing itself is a claim by the group rather than a confirmed, independently verified account of the full scope of the incident.

Inside the incident

According to available public information, Spacemanic appeared on the fog ransomware group's leak site on or around 12 February 2025. The reported summary associated with the listing references an extract from Gitlabs that also names other entities, including INGV and Squeezer-software, alongside Spacemanic. The facts state that internal files were exfiltrated in a ransomware attack. No confirmed figures have been released for the volume of data taken, the precise date of initial access, the encryption status of systems, or any ransom demand. The number of individuals whose information may have been involved is listed as unknown. Method of entry, dwell time, and whether systems were restored from backups or offline copies remain undisclosed in the public record. As with many such listings, the group's claim of compromise stands as an assertion pending further confirmation from the organisation or independent investigators.

Who is fog?

Fog is a ransomware operation that has been documented in open-source reporting as using double-extortion tactics: encrypting systems while also stealing data and threatening to publish it if payment is not made. Like other groups in this category, fog maintains a leak site where it posts victim names and, in some cases, samples of stolen material to increase pressure. Public analyses of prior fog activity describe relatively opportunistic targeting across multiple sectors rather than exclusive focus on any single industry, with listings used to advertise claimed breaches. The group has been observed claiming responsibility for incidents involving various organisations, though individual claims require separate verification. In the present case, fog's listing of Spacemanic constitutes the group's claim that it conducted a ransomware attack involving exfiltration of internal files; no additional statements attributed specifically to fog about this victim appear in the provided facts.

Spacemanic and its sector

Spacemanic is a Czech start-up that develops nanosatellite solutions and CubeSat components. Its services span design and development through to launch support and ground-station operations. The small-satellite and CubeSat sector has grown rapidly as universities, research institutes, and commercial operators seek lower-cost access to space for Earth observation, communications experiments, and technology demonstration. Companies in this field typically handle engineering drawings, flight software, component specifications, supplier contracts, and mission-planning documents. Because the work sits at the intersection of aerospace engineering and dual-use technology, a breach can raise questions about intellectual property protection, supply-chain integrity, and the security of technical data that may be sensitive even if not classified. For a start-up of this type, the reputational and operational consequences of a claimed ransomware incident can be significant, particularly when customers and partners rely on the firm for critical hardware and support services.

What data was at risk

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of file types, categories of personal data, or volume has been disclosed. Organisations that design and support nanosatellites commonly hold technical documentation, source code or configuration files, employee and contractor records, customer correspondence, and commercial agreements. Whether any of those categories were among the files taken in this incident is unconfirmed. Public detail on exact contents remains limited; the only named category is internal files. Readers should treat any more specific characterisation as speculative until Spacemanic or competent authorities provide additional information.

What's at stake

For individuals whose contact or employment details may have been present in internal systems, the practical risks include targeted phishing, social-engineering attempts that reference the company, or misuse of any personal identifiers that happened to be stored alongside technical material. For Spacemanic itself, the stakes include potential exposure of proprietary designs, disruption of ongoing projects, and the need to reassure customers and partners that mission-critical data remains protected. Because the people-affected count is unknown and the precise data set is undisclosed, the full extent of individual impact cannot yet be quantified. The organisation faces the ordinary operational costs of incident response, forensic review, and any required notifications under applicable European data-protection rules, regardless of whether the fog claim is later fully substantiated.

What to do if you're exposed

If you have a past or present relationship with Spacemanic—as an employee, contractor, customer, or partner—monitor accounts associated with that relationship for unusual activity. Enable multi-factor authentication where available, and treat unsolicited messages that reference the company or the incident with caution. Change passwords on any accounts that may have reused credentials linked to work email. Consider placing fraud alerts with relevant credit or identity services if personal financial data could have been involved, though that has not been confirmed here. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Official updates should be sought from Spacemanic or from national cybersecurity authorities rather than from unverified secondary sources.

AICompiled with AI assistance from public sources and published under our editorial standards.