Stellar Listed by spacebears Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On June 2, 2026, the spacebears ransomware group listed Stellar on its leak site, stating that internal files had been exfiltrated during a ransomware operation. Public information about the incident remains limited to this listing. The number of individuals affected has not been disclosed, and no independent confirmation of the data’s contents or the attack’s technical details has been made available. The incident highlights how organizations providing critical connectivity services continue to appear in ransomware disclosures, even when specific operational impacts are not yet public.

Inside the incident

Stellar was added to the spacebears leak site on the reported date of June 2, 2026. The group’s listing refers to internal files taken during a ransomware attack. No further details on the timing of the intrusion, the volume of data involved, or the encryption status of systems have been released by either the organization or the group.

Stellar has not issued a public statement confirming or disputing the claims. The exact method of initial access and whether data was encrypted remain undisclosed at this time.

The group behind it: spacebears

Spacebears is a ransomware group that maintains a leak site to publish names of organizations from which it claims to have obtained data. Such groups typically combine file encryption with data exfiltration to pressure victims. Their listings represent the group’s own assertions rather than independently verified events.

In this case, spacebears claims to have taken internal files from Stellar. No additional statements from the group about this specific victim have been documented beyond the leak-site entry.

Who is Stellar?

Stellar Telecommunications SAS is a European company founded in 2021 and headquartered in Bordeaux, France, with additional operations in Luxembourg. Its stated mission is to deliver resilient network connectivity by integrating terrestrial technologies such as cellular, Wi-Fi, and fiber with satellite systems for use in mobility, enterprise, and government environments.

Organizations in the telecommunications and satellite-services sector routinely manage network configurations, customer account information, and operational data required to maintain service continuity across multiple jurisdictions.

What was likely exposed

The only data category named in the listing is internal files exfiltrated during the ransomware attack. A reference to database and production configuration information appears in connection with the incident, but the precise contents of any exfiltrated material have not been published or independently verified.

Companies of this type commonly hold records related to network infrastructure, customer subscriptions, and service configurations. Without a confirmed inventory, the specific data elements involved cannot be stated as fact.

What's at stake

Exposure of internal files and configuration data can reveal details about network architecture that may be useful to other threat actors. For individuals and organizations relying on Stellar’s services, the primary concerns are potential follow-on targeting and any downstream effects on service availability.

For the company, the incident adds to the operational and reputational pressures that follow public listings by ransomware groups, regardless of whether further data releases occur.

Were you affected?

Individuals who have accounts or contracts with Stellar should monitor official communications from the company for any notifications. Standard protective steps include changing passwords for any associated services, enabling multi-factor authentication, and reviewing account activity for unusual access.

Readers can also run a free exposure scan of their email address against known breach data sets to check for prior appearances in public listings.

AICompiled with AI assistance from public sources and published under our editorial standards.