lohmann-tapes.com Listed by INC Ransom Ransomware Group

On February 12, 2026, the ransomware group Incransom added lohmann-tapes.com to its leak site and published 700GB of internal files stolen from the German adhesive manufacturer Lohmann, which employs roughly 5,000 people and generates $817.4 million in annual revenue.

Reported Details of the Breach

Public reporting indicates the attackers exfiltrated data from Lohmann’s finance, accounting and controlling departments (24,098 files) as well as sales and customer account records (115 files). The leak site lists contact details for senior executives, including CFO Julie Pappas, whose direct phone number and corporate email address (Julie.Pappas@lohmann-tapes.com) appear in the posted material. The company, which supplies industrial adhesive tapes and smart bonding solutions, had its internal documents taken during a ransomware incident whose exact initial access vector remains undisclosed in available reporting.

700GB of compressed files were allegedly exfiltrated, according to the group’s disclosure. No customer credit-card numbers or payment details have been publicly confirmed as part of the release, but the presence of sales and customer files means names, addresses, order histories and business contracts may now be circulating on dark-web forums.

Why This Matters for You and Your Family

When a company the size of Lohmann suffers a breach, the information rarely stays inside corporate systems. Employee records, supplier contracts and customer spreadsheets often contain personal phone numbers, home addresses and email accounts that overlap with your own data. If you or any member of your family has ever done business with an industrial supplier, worked at a manufacturing firm, or had your details shared through a B2B transaction, this incident could expose you indirectly.

Once names and contact details surface, they are quickly cross-referenced with other leaks. A single exposed work email can lead to personal accounts, especially when people reuse passwords. For families this means children’s school forms, medical appointments or online purchases can suddenly become visible to strangers who know how to follow the chain.

The Doxxing and Identity-Chain Risk

Ransomware leaks like this one rarely stop at the first publication. The released files create new connections between corporate identities and real-world households. Attackers combine the CFO’s phone number with addresses found in customer files, then search for linked social-media accounts, children’s usernames on gaming platforms, and family photos. These identity chains allow doxxing campaigns that can escalate from nuisance calls to targeted extortion or identity theft.

Credential leaks cascade into account takeovers. A password stolen from a corporate sales portal today can unlock your personal email, streaming services or children’s Roblox, Fortnite or Minecraft accounts tomorrow. Public reporting shows that gaming platforms are frequent secondary targets once an address or parent email is known.

Incransom’s Publicly Known Track Record

Public reporting attributes Incransom with emerging in late 2024. The group has claimed responsibility for attacks on mid-sized manufacturing, logistics and professional-services companies. Its typical playbook involves initial access through phishing or exploited remote-desktop services, followed by claimed exfiltration of sensitive folders, then dual extortion: demanding ransom for decryption and threatening to publish stolen data if payment is not made. Leak-site postings usually appear after a short negotiation window, with partial samples released to pressure victims. Exact success rates and prior victim counts are difficult to verify, but industry trackers list Incransom among active double-extortion operators.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, then use the cleanup to remove what you can.
• Rotate any password you ever used at lohmann-tapes.com or related supplier portals, and enable 2FA through an authenticator app on every account where that password was reused.
• Enable continuous DoxxScan monitoring across 13.1 billion+ breach records and more than 100 platforms so the next exposure of your information is caught in hours rather than months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which frequently become targets when parent data appears in corporate leaks.
• Let remediation specialists handle takedown requests across data brokers and leak sites while you focus on securing your own accounts.

The speed with which stolen corporate files reach criminal marketplaces means ordinary families must treat every vendor breach as a personal risk. Starting with clear visibility into your own identity chain is the most practical defense. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1B+ breach records and 100+ platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Acting early limits how far attackers can travel down the chain that now begins with the Lohmann files.