The Barracuda ransomware group claims it has compromised ADG Blatt, a German firm providing planning, design and programme management services, and is offering the stolen data for sale for $50,000. The listing appeared on the group's leak site on 8 November 2026 and was discovered at 22:50 UTC the same day.

According to the report, the attackers claim they exfiltrated all files from the company's main file server. The material is said to include blueprints, schematics, coordinates and a full list of architectural and construction projects, as well as contracts and agreements with clients containing confidential information. The incident is listed as "selling" on the group's leak site, meaning the data is being offered to buyers rather than published openly.

ADG Blatt is based in Germany, and a second threat-intelligence record confirms the 8 November listing date. Barracuda is a comparatively small operation, with 18 victims recorded in that database, but it follows the double-extortion model used by many ransomware groups: data is taken before files are encrypted, so the victim faces pressure both to restore its systems and to keep stolen material unpublished.

What has not been confirmed

No technical details of how the attackers got in have been disclosed, and the specific data taken has not been independently verified. The listing date is the date the victim appeared on the leak site, which may differ from the date of any initial intrusion. Neither report carries confirmation that systems were encrypted, and no ransom demand beyond the $50,000 sale price has been reported.

For a firm in the planning and design sector, the alleged haul is sensitive. Blueprints, schematics and client contracts can carry intellectual property, pricing and project details that competitors could exploit, and their exposure could bring legal and reputational problems for the firm and its clients. Clients and partners of ADG Blatt have been advised to watch for phishing attempts or fraudulent messages linked to their dealings with the firm.

The claim underlines a wider pattern in Germany, which ranks second worldwide for ransomware disclosures, with 1,048 victims recorded in the same threat-intelligence database. Defenders in the architecture and design sector are urged to lock down file servers with strict access controls, use data loss prevention tools, encrypt sensitive project documentation, and monitor for unusual volumes of data leaving the network.