TORMAX Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target manufacturers and industrial suppliers, treating operational firms as sources of internal documents that can be leveraged for extortion. Listings on criminal leak sites have become a routine pressure tactic, often appearing before any independent confirmation of what was taken or how systems were reached. In that environment, a September 2023 claim against a global automatic-door manufacturer fits a familiar pattern: an unverified assertion of data theft paired with the threat of public release.

On 26 September 2023, the ransomware group known as losttrust listed TORMAX, stating that internal files had been exfiltrated. The number of people affected remains unknown, and public detail beyond the group’s claim is limited. For customers, partners, and employees of a company whose systems sit in airports, hospitals, offices, and residential buildings worldwide, even an unconfirmed listing raises practical questions about what may have left the organisation’s control.

What happened

According to the available record, TORMAX was listed by the losttrust ransomware group on 26 September 2023. The group claimed that internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of individuals affected has been published, and the precise timing of any intrusion, the initial access method, and the full scope of systems involved have not been disclosed in the public summary. The listing itself constitutes the group’s assertion; independent verification of the volume or sensitivity of any stolen material is not part of the reported facts.

What is stated is limited to the claim of internal-file exfiltration. No ransom demand amount, no sample file inventory, and no statement from TORMAX confirming or denying the incident appear in the provided record. In short, the incident is known principally through the threat actor’s leak-site entry dated late September 2023.

Inside losttrust

Losttrust is a ransomware operation that has followed the double-extortion model common among contemporary groups: encrypting systems where possible while also copying data and threatening to publish it if payment is not made. Like other actors in this category, the group maintains a dark-web leak site on which it names victims and, in some cases, posts samples or larger archives to demonstrate possession of material. Public reporting on losttrust has described it as one of several groups that emerged or rebranded in the wave of ransomware activity that intensified after 2020, often focusing on mid-sized and larger commercial organisations rather than solely on high-profile consumer brands.

Typical tactics associated with such groups include phishing or exploitation of exposed remote-access services to gain an initial foothold, followed by lateral movement, privilege escalation, and staged exfiltration before ransomware deployment. Losttrust’s listings are claims made by the actors themselves; they do not automatically constitute proof that every named organisation suffered a claimed breach of the scale asserted. In the TORMAX case, the public record contains only the group’s assertion that internal files were taken.

Who is TORMAX?

TORMAX is a manufacturer of automatic door systems and a division of the LANDERT Group, a privately owned collection of companies. The firm traces its history to the installation of Europe’s first automatic door in 1951 and today operates with roughly 25 group companies and more than 500 distributors. Its products appear in office buildings, shopping malls, hotels, restaurants, department stores, airports, train stations, ships, and apartment buildings—essentially in hundreds of thousands of structures worldwide.

Organisations of this type typically hold engineering drawings, supplier and distributor contracts, employee records, customer project data, maintenance documentation, and internal financial or operational files. Because automatic doors are safety- and access-critical components in public and commercial spaces, a compromise of internal systems can carry implications beyond ordinary corporate data loss, touching supply-chain trust and the confidentiality of project-specific information shared with building owners and contractors.

What was likely exposed

The facts name the exposed material only as “internal files exfiltrated in a ransomware attack.” No further breakdown—such as whether the files included personal data, technical schematics, credentials, or commercial contracts—has been disclosed. Exact contents therefore remain unconfirmed.

Companies in the automatic-door and building-systems sector commonly store design and configuration data, customer and project lists, employee and HR information, supplier pricing, and internal correspondence. Any of these categories could fall under a broad description of “internal files,” yet it would be inaccurate to treat them as verified contents of this incident. Until TORMAX or an independent investigation publishes a fuller inventory, the public can only note the group’s general claim and the ordinary data holdings of a manufacturer of this kind.

The real-world impact

For individuals, the primary risks associated with exfiltrated internal files are secondary misuse: phishing that references real project or employment details, identity fraud if personal data were included, or social-engineering attempts against staff and partners. Because the number of affected people is unknown and the precise data types are undisclosed, the scale of personal exposure cannot be quantified from public information alone.

For TORMAX and the LANDERT Group, consequences may include operational disruption if systems were encrypted, costs of investigation and remediation, potential contractual notifications to customers or distributors, and reputational pressure arising from the public listing itself. Even when a ransom is not paid and files are not released in full, the mere assertion of theft can erode confidence among building owners, facility managers, and supply-chain partners who rely on the integrity of the manufacturer’s systems and documentation. The absence of confirmed counts or file lists means these impacts remain potential rather than measured.

Were you affected?

If you are a current or former employee, distributor, customer, or contractor of TORMAX or the wider LANDERT Group, treat the September 2023 listing as a prompt to review your own exposure rather than as proof that your personal data was taken. Monitor financial and email accounts for unusual activity, be cautious of unsolicited messages that reference automatic-door projects or company internal matters, and consider changing passwords on any accounts that may have been used in business dealings with the firm. Where appropriate, you may also enquire directly with TORMAX through official channels about any notifications they have issued.

Readers can run a free exposure scan of their email address to check whether that address has already appeared in known breach data sets. Such a check does not confirm involvement in this specific incident, but it provides a practical starting point for understanding whether credentials or personal details have circulated more broadly.

AICompiled with AI assistance from public sources and published under our editorial standards.