Ransomware: Gammax claims MTCO (Mahmoud Altaheni & Partners Trading Co) (SA) — Professional Services

A new ransomware incident has been published on the ransomware.live leak site, claiming that the threat actor Gammax has compromised MTCO (Mahmoud Altaheni & Partners Trading Co), a professional services firm based in Saudi Arabia. The listing, dated 1 August 2026, appears under the BREACH framework, which typically indicates that stolen data has been exfiltrated and may be publicly released if a ransom is not paid. No technical details, such as the attack vector or volume of data, have been disclosed at this time.

This affects MTCO and its clients, partners, and any third parties whose data may be held by the firm. As a professional services provider, MTCO likely processes sensitive commercial, financial, and possibly personal data, making this a high-risk breach for downstream supply chain exposure. Other organisations in the Saudi and Gulf professional services sector should treat this as a warning that similar attacks are active.

Compliance teams should immediately verify whether they have any data-sharing or service agreements with MTCO, and if so, assess the potential exposure of personal or commercially sensitive information. Review incident response and breach notification obligations under applicable data protection laws, including Saudi PDPL, and prepare to notify regulators and affected individuals if required. Also, monitor the leak site for any published data and update third-party risk registers accordingly.