MTCO (Mahmoud Altaheni & Partners Trading Company) Listed by Gammax Ransomware Group

On August 1, 2026, the ransomware group Gammax listed MTCO (Mahmoud Altaheni & Partners Trading Company) on its leak site, claiming the Saudi Arabian trading firm was hit by a ransomware attack in which internal files were exfiltrated. The company, which operates across Saudi Arabia and the wider GCC region, has not publicly confirmed the incident as of this writing. The leak-site listing does not specify the volume or exact nature of the files taken, nor does it disclose any deadline for ransom payment.

Primary Disclosure Details

The Gammax leak site entry states that internal files were exfiltrated during a ransomware attack on MTCO. No specific record count is provided, and the listing does not detail the types of documents involved. Because the sole primary source is the threat actor’s own leak page, accessed via ransomware.live, this remains an unconfirmed claim. MTCO has issued no official breach notification, and no regulator or government filing has yet addressed the incident. Public trackers show the listing appeared on August 1, 2026.

Why This Matters for You and Your Family

When a company in the GCC region suffers a ransomware incident, the people whose personal data sits in its systems face direct risk. If you have done business with MTCO, worked there, applied for a position, or had any commercial relationship with the firm, your information may be among the stolen files. Even though the exact data types remain unknown, ransomware operators routinely obtain names, contact details, national ID numbers, financial records, contracts, and employee files. Any of these can be used for identity theft, targeted phishing, or fraud against you and your family.

Business-to-consumer relationships in the trading, logistics, or supply-chain sectors often involve the exchange of personal identification and banking information. The absence of confirmed numbers does not reduce your exposure; it simply means the full scope is not yet public.

Doxxing and Identity-Chain Risks

Stolen internal files frequently contain more than isolated records. They can include spreadsheets that link customer names to phone numbers, email addresses, passport copies, or even family member details. Once published or sold on underground forums, this data becomes the foundation for doxxing chains. Attackers cross-reference leaked corporate data with other breaches to build complete identity profiles. A single exposed email or Saudi national ID can lead to account takeovers on personal services, government portals, or banking applications. Children’s records, if present in employee benefit files, are especially attractive because they often carry clean credit histories that can be exploited for years.

Gammax Ransomware Group Track Record

Public reporting attributes the emergence of Gammax to early 2025. The group has targeted organizations across the Middle East, Europe, and North America, with a focus on mid-sized companies in trading, manufacturing, and professional services. Typical Gammax playbooks begin with phishing or exploitation of remote desktop services for initial access, followed by rapid lateral movement, data exfiltration, and deployment of ransomware. The group operates a double-extortion model: they threaten both encryption of systems and public release of stolen files unless payment is made. Leak-site listings by Gammax have previously included sensitive corporate contracts, employee databases, and financial spreadsheets from other victims.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, usernames, and real-world identity, including any potential connection to MTCO records.
• Enable continuous DoxxScan monitoring across 15.4 billion breach records and more than 100 platforms so the next exposure surfaces within hours rather than months.
• Rotate any password you have ever used for MTCO-related services or accounts and secure them with 2FA through an authenticator app instead of SMS.
• Cover your entire household with DoxxScan family protection, which extends to dependents and children’s gaming accounts that often chain back to the same address or parental credentials.
• Let remediation specialists handle data-broker takedown requests and opt-out processes on your behalf while you focus on securing your digital footprint.

The incident underscores how quickly corporate ransomware claims can translate into personal exposure for ordinary customers, employees, and their families. A single unconfirmed listing today can become tomorrow’s targeted phishing campaign or identity theft attempt. DoxxScan by GalaxyWarden delivers continuous monitoring across 15.4B+ breach records and 100+ platforms, AI-powered identity-chain mapping, and hands-on remediation by specialists, with full household coverage that includes children’s gaming accounts vulnerable to credential-based attacks. Acting early remains the most practical defense.