On December 25, 2025, the ransomware group LockBit5 added acarlar.com.tr to its leak site, claiming that it had exfiltrated internal files from the Turkish company ACARLAR A.Ş. during a ransomware attack. The firm, founded in 1963, provides logistics, construction, and industrial services across Turkey and neighboring markets. Public reporting indicates that customer, supplier, and employee records may be among the stolen data, although the exact number of affected individuals remains unknown.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch acarlar.com.tr
Get alerted the next time acarlar.com.tr files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about acarlar.com.tr’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
Reported Details of the Breach
Available reporting describes the incident as a classic ransomware operation in which LockBit5 first gained access, encrypted systems, and then exfiltrated files before demanding payment. The data posted on the leak site consists of compressed archives of internal documents rather than a simple database dump. No precise count of exposed records has been released, but the volume suggests thousands of files that could contain names, addresses, national identification numbers, contact details, and business contracts. The deadline for the company to pay the ransom or face full public release of the remaining data is still active on the LockBit5 portal.
Why This Matters for You and Your Family
When a company like ACARLAR suffers a breach, the information stolen often includes details that can be used to target you or members of your household. Employee records, customer invoices, and supplier contracts frequently contain home addresses, phone numbers, dates of birth, and government ID numbers. Once those details appear on criminal forums, they become building blocks for identity theft, loan fraud, and phishing campaigns aimed at your family. Even if you have never heard of ACARLAR, your data may have reached them through routine business, employment, or vendor relationships.
The Doxxing and Identity-Chain Risks
Stolen internal files rarely stay isolated. Criminals combine leaked emails, phone numbers, and addresses with gaming usernames, social-media handles, and family-member details to create complete identity chains. A single credential from this claimed breach can lead to takeover of your email, bank accounts, or children’s online gaming profiles. Gaming accounts are especially vulnerable because kids often reuse passwords or email addresses tied to family data; once one account falls, attackers can pivot to doxxing, extortion, or further account takeovers across platforms.