[ Ransomware claim · deadlock · 23 Oct 2026 ]
Hensel Elektrik
The ransomware group deadlock named Hensel Elektrik (Germany) on its leak site on 23 Oct 2026. This is the group's own claim: it has not been verified by Cyfenced or Ransomware.live, and some claims turn out to be exaggerated, recycled or false.
[ Status ]Has the attack been confirmed?
We have found no statement from Hensel Elektrik and no press report of an attack so far. Until the organisation says something, treat the listing as an unproven claim, but stay alert to the phishing such claims are used for.
[ The organisation ]Who is Hensel Elektrik?
- What it does
- Hensel Elektrik San. ve Tic. Ltd. Sti. is the Turkish subsidiary of Gustav Hensel GmbH & Co. KG, a German manufacturer of electrical installation and power distribution systems. The group makes enclosures, cable junction boxes, distribution boards, photovoltaic system components and cable entry systems, sold under brands such as ENYCASE, ENYSTAR, ENYMOD and ENYSUN.
- Based in
- Parent company in Lennestadt, North Rhine-Westphalia, Germany; Turkish office in Kartal, Istanbul, Türkiye
- Founded
- 1931 (parent company)
- Size
- more than 1,000 employees worldwide, about 600 of them in Germany
- Who it serves
- Electrical wholesalers, installers, panel builders and industrial and building projects that need electrical distribution equipment, including for harsh environments with dust, moisture or corrosion. The Turkish subsidiary serves customers in Türkiye.
[ Impact ]Who could be affected
Distributors, installers and project customers could see delayed quotes, orders or deliveries of electrical distribution products if order or logistics systems were disrupted. Business contacts could face a higher risk of invoice fraud or phishing if any customer or supplier information was exposed.
In manufacturing generally: Production stops ripple down the supply chain to customers waiting for parts and products, and groups often take design files and supplier contracts.
[ The attacker ]About deadlock
DeadLock is a financially motivated ransomware operation first seen in mid-2025 that typically uses compromised legitimate credentials, deletes backups before encrypting files and threatens to leak or sell stolen data. It is known for storing its command infrastructure addresses on the Polygon blockchain to resist takedowns.
deadlock has claimed 6 organisations in the last 30 days, most in United States, Germany and South Africa, and mostly in manufacturing, healthcare and agriculture and food production.
Other organisations deadlock has named
- United States
- South Africa
- United States
- Spain
- Italy
[ What to do ]If you are a customer, partner or neighbour
- Customers and distributors should confirm order and delivery status with their usual Hensel contact.
- Verify any request to change bank details or payment instructions by phone using a known number.
- Be cautious with unexpected emails carrying invoices, quotes or attachments that appear to come from Hensel.
- Suppliers with system access should review and reset any shared credentials.
[ Similar claims ]Other manufacturing organisations in Germany
- thegentlemen
- payload
- thegentlemen
- qilin
- payload