Ransomware: thegentlemen claims Byggelit Sverige (SE) — Construction

On 16 July 2026, a ransomware group known as thegentlemen publicly claimed responsibility for a cyberattack against Byggelit Sverige, a Swedish construction company. The breach was published on the ransomware.live data leak site under the BREACH framework, indicating that sensitive data may have been exfiltrated and is at risk of exposure. This incident highlights an ongoing threat to the construction sector, which is increasingly targeted due to its reliance on supply chain data and project-critical systems.

Organizations in the construction, engineering, and building materials sectors across the EU should consider themselves directly affected, particularly those with operations in Sweden or the Nordic region. Compliance teams should also assess exposure for any third-party vendors or partners linked to Byggelit Sverige, as ransomware attacks often cascade through interconnected supply chains. The incident underscores the need for sector-specific vigilance under frameworks like NIS2 and the GDPR.

Compliance teams should immediately verify whether their organization has any data-sharing or contractual relationships with Byggelit Sverige. They should also review incident response plans, ensure offline backups are current, and conduct a risk assessment for ransomware in the construction sector. Finally, teams should monitor regulatory guidance from national cybersecurity authorities, as this breach may trigger mandatory reporting obligations under applicable EU data protection and incident notification laws.