high severity September 23, 2026 · 3 min read Unverified claim — what this is

Abtach Ltd. Listed by Barracuda Ransomware Group

If you are a customer of Abtach Ltd., here’s what is being claimed, and what it would mean for you.

Abtach Ltd. was renamed Intersys Ltd.—a Pakistani company engaged in fraud targeting the US. The company’s employees charged fees for services that did not actually exist. The company’s founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace. We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain e
— from Barracuda’s own leak-site posting. This is the group’s claim, quoted verbatim; it is not GalaxyWarden’s reporting and has not been independently verified.

Abtach Ltd. Listed by Barracuda Ransomware Group

The group operating the Barracuda ransomware leak site has listed Abtach Ltd. on its page as of September 23, 2026. According to the listing, the company — which reportedly rebranded as Intersys Ltd. — is accused of involvement in fraud targeting US customers and of the founder’s alleged role in synthetic opioid trafficking. The group claims it encrypted systems and exfiltrated roughly 1.5 TB of data. Abtach Ltd. has not publicly confirmed the claim as of writing.

Already exposed?

You can’t unleak data. You can take away what it’s worth.

A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.

See what is exposed about you — free scan →

Watch Abtach Ltd.

Get alerted the next time Abtach Ltd. files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.

We’ll email you only about Abtach Ltd.’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.

Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.

What a Leak-Site Listing Actually Establishes

Ransomware groups frequently publish names on leak sites to pressure targets for payment or to generate publicity. These listings are one-sided claims produced by the attackers themselves. They are not independently verified by any regulator, breach-notification authority, or neutral third party. Many turn out to be exaggerated, recycled from older compromises, aimed at companies that no longer exist under the original name, or simply false. A listing alone does not prove that a breach or data exfiltration occurred, nor does it establish what, if anything, was taken. Real confirmation would require a statement from the company, a regulatory filing, or direct notification to affected customers.

Exposure Pack · one payment

The full list, and what to lock in ten minutes.

Every indexed leak tied to your address — all of them, named and dated
A deeper search of collected breach data — the kinds of your information it holds, where it finds you
What this kind of incident typically exposes
A ten-minute lock list written for this kind of organisation

One payment. Nothing renews, and no account is created. Emailed to you within a minute.

The Pattern Behind These Claims

Ransomware operators continue to target small or rebranded entities and post unverified allegations on leak sites regardless of whether a successful compromise took place. The tactic mixes financial pressure with public shaming. Because the record here enumerates no categories of information and states no number of affected customers, it is impossible to gauge scale or content from the filing itself. The absence of detail is common in these postings and leaves customers with more questions than answers.

What This Means for Your Records

Because no data categories are listed, it is not possible to know whether permanent identifiers, financial details, or account credentials were included. If customer records were taken, they could enable targeted fraud attempts using information the company legitimately held. The only reliable way to learn whether your information is involved is a direct notification from the organisation, usually sent by post to your last known address. Absence of such a letter usually indicates you were not in the affected group, but anyone who has changed address should contact Abtach Ltd. or Intersys Ltd. directly to confirm their status.

Actions Worth Taking Now

Review recent statements from any accounts you hold with the company and set up transaction alerts to spot unusual activity quickly.
Change the password for this account if you still have one and do not reuse it anywhere else; this remains cheap insurance even when exposure is unconfirmed.
Place a fraud alert with the three major credit bureaus as a temporary precaution if you have any relationship with the business.
Monitor mail over the coming weeks for any notification from the organisation explaining what, if anything, was involved.

GalaxyWarden provides continuous monitoring across 13.1B+ breach records and 100+ platforms together with identity-chain mapping and remediation support by specialists.

What the free scan actually returns

Sample resultyou@email.comIllustrative — not a real person

Found on people-search siteswe remove these

These listings are live, public, and legal to remove — and removing them is what we do.

value redacted in this sampleage, relatives, address historySpokeo

value redacted in this samplephone, household, property recordsBeenVerified

value redacted in this sample580 companies checked

Found in breach recordsverifiedreported — unverified

Each record is labeled: confirmed breach data, or an attacker’s claim no one has verified.

verifiedvalue redacted in this samplepassword + phone · 2024telecom breach

unverifiedvalue redacted in this sampleclaimed in ransomware listing · 2026leak-site claim

Leaked data cannot be deleted from the internet — anyone claiming otherwise is lying. Broker listings can be removed. We do the second, and show you exactly what to fix from the first.

Check your exposure

Abtach Ltd. is one listing. Your email is probably in others.

We can’t confirm any single incident against the sources we search, so we won’t pretend to. What we can show you is your own exposure — your email against 13.1B+ leaked records and the sites that publish your address. About 15 seconds. No account, no card.

Report details & sourcing

Attributed to Barracuda · 9 incidents tracked →

Severity High the filing does not enumerate what was exposed

Disclosed September 23, 2026

Last reviewed September 23, 2026

Affected Unconfirmed

By GalaxyWarden Threat Research · Editorial & sourcing standards

Unverified claim — what this report is

This page documents a public listing on a ransomware/extortion group’s leak site, tracked via public threat-intelligence sources. A listing is the attacker’s claim. GalaxyWarden aggregates and reports such claims; we have not independently verified that a breach occurred, what data (if any) was taken, or the accuracy of anything the group asserts, and the named organisation has not necessarily confirmed the incident. Sections above describe what the listing shows and the group’s documented history — not verified findings about the named organisation. If you represent this organisation and believe anything here is inaccurate, tell us and we’ll review it promptly.

Editorial & sourcing policy

GalaxyWarden is a breach-monitoring service and news aggregator. We do not exfiltrate, host, purchase, or redistribute stolen data. Breach information is compiled from publicly accessible sources and threat-intelligence platforms, and is reported as claims attributed to their source. We promptly correct or remove material shown to be inaccurate — see our content & takedown policy or write to support@galaxywarden.com.

Sources: Barracuda leak site (via ransomware.live)

Threat-actor tracker

Barracuda — 9 incidents tracked

Every breach we've attributed to Barracuda, in one running log. See who else they've hit →

Related breaches

high September 23, 2026