rhysida ransomware claims to have compromised Electro Heat Sweden AB in Sweden (SE) by exfiltrating 1,723,527 files totaling 2.55 TB, including SolidWorks CAD intellectual property and critical engineering and business records such as Visma/SCPS accounting and payroll databases. The group further alleges theft of legally sensitive documents, employee passport and visa data, and signed contracts/acceptance certificates. #Sweden
Incident Details
- Victim: Electro Heat Sweden AB
- Sector: Energy & Utilities
- Country: SE
- Actor: rhysida
- Source: http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=279
- Discovered: 2026-10-02T18:04:03.468529+00:00
- Published: 2026-10-02T18:03:41.086723+00:00
Information
- Industrial furnaces used in manufacturing industries worldwide
- 1,723,527 files
- 2.55 TB of data
- All intellectual property, including SolidWorks CAD designs for every product and backups of the PDM drawing vault
- Accounting and payroll data, including Visma databases and SPCS payroll databases for four legal entities
- Legally sensitive material, including a confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, and cost-pricing calculations
- Employee personal data, including passport details, visa applications, addresses, phone numbers, dates of birth, and insurance policies
- Contracts and acceptances, including signed agreements and acceptance certificates with Hitachi, ABB, Scania, and other customers
Disclaimer: This post is based on public claims made by the ransomware group "rhysida". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.