Erla Technologies: a data leak claimed by a ransomware group

On 5 May 2026, Erla Technologies SAS — a French manufacturer that has, for more than 30 years, designed, built, installed and maintained equipment for the storage, distribution and management of petroleum products, biofuels, AdBlue and industrial and chemical fluids — was added to the leak site of the SpaceBears ransomware group, which claimed to have exfiltrated a large volume of internal data.

SpaceBears operates a double-extortion model: it steals data before (or instead of) encrypting systems, then threatens a staged public release to pressure the victim into paying. The group's posting referenced documentation belonging to Erla's clients, drawing particular attention to materials tied to a French army client. The intrusion is estimated to date to around 9 April 2026, several weeks before the public listing on 5 May 2026.

According to the group's claims, the exposed data includes:

• Personal information of employees and clients
• Financial documents
• Internal and project documentation
• Documentation associated with clients, including a French army client

As of reporting, the scale of the leak (record or file counts) has not been independently quantified, and Erla Technologies had not issued any public statement about the incident. The listing and accompanying leak samples remained active on the SpaceBears site, leaving the situation ongoing.