Bonava Listed by ExfilSquad Ransomware Group

On July 26, 2026, Swedish homebuilder Bonava was listed on the leak site of the ExfilSquad ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the company, which reported annual revenue of SEK 8 billion. The number of individuals affected has not been publicly quantified by either the victim or the threat actor.

Reported Details from the Listing

The ExfilSquad leak site entry indicates that internal files were successfully exfiltrated. It does not specify the exact volume or list of data stolen, though the group typically publishes samples as proof. Public corroboration through ransomware.live states the disclosure date as July 26, 2026 and notes that Bonava operates in the residential construction sector across Northern Europe. The listing does not detail any ransom demand or negotiation status, which is common in early-stage extortion listings.

842,000 records are referenced in associated data descriptions, reportedly containing significant PII, property ownership and interests, warranty and repair cases, contractor information, marketing preferences, and customer service history. The primary disclosure itself stops short of confirming exact record counts or every data category, so these figures should be treated as the group’s claim until independent verification emerges.

Why This Matters for You and Your Family

If you have ever bought a home from Bonava, requested a warranty repair, or interacted with their customer service, your personal information may now sit in an attacker-controlled archive. This is not abstract corporate risk. Names, addresses, phone numbers, email addresses, and details about your property and family living situation are exactly the kind of data that fuel identity theft, targeted phishing, and physical stalking. For families with children, the exposure of home addresses combined with marketing preferences and service history creates a detailed profile that can be sold or exploited for years.

Doxxing and Identity-Chain Risks

Property ownership records are high-value connectors in doxxing chains. Once attackers or data brokers link your name and home address to an email address or phone number from this claimed breach, they can cross-reference it with credential leaks, gaming accounts, and social-media handles. This creates persistent identity graphs that are difficult to dismantle. Credential leaks of this nature frequently cascade into account takeovers, especially on platforms where the same password or recovery email was reused. Gaming accounts belonging to children are particularly vulnerable because they often share family email addresses or phone numbers and lack mature security controls.

ExfilSquad’s Known Track Record

Public reporting attributes ExfilSquad with operating a double-extortion model focused on data exfiltration followed by public leak-site pressure. The group emerged in late 2024 and has targeted mid-to-large organizations across Europe and North America, with a noticeable focus on construction, manufacturing, and professional-services firms. Their playbook typically begins with initial access through phishing or exploited remote desktop services, followed by lateral movement to file servers and cloud storage. Rather than always deploying ransomware encryptors, ExfilSquad often emphasizes data theft and selective publication of sensitive internal documents to coerce payment. Their leak site is used both to shame victims and to auction or distribute stolen archives when negotiations fail.

What to do

• Run a DoxxScan to map every link between your email addresses, phone numbers, home address from the Bonava breach, and any associated online handles or gaming accounts.
• Rotate any password you have ever used with Bonava or their contractors anywhere it is reused, and immediately enable 2FA using an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next time your information surfaces you are alerted in hours, not months.
• Cover the entire household — DoxxScan family coverage includes dependents and children’s gaming accounts that often chain back to the same breached addresses and emails.
• Let DoxxScan remediation specialists handle data-broker takedown requests and persistent exposure cleanup on your behalf.

The Bonava listing is a reminder that even established European companies remain targets and that your family’s housing and service records are now commodities on ransomware leak sites. Taking concrete steps now limits how far attackers can build on this exposure. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, including household coverage that explicitly protects children’s gaming accounts vulnerable to credential-based takeovers.