Aeroklas Duys listed by the Deadlock ransomware group

Overview

On 12 October 2026 the Deadlock ransomware group added Aeroklas Duys (Pty) Ltd, a South African automotive manufacturer, to its public victim list. The entry was collected by the Breaches.Africa monitoring pipeline the same day it appeared. No sample files, record counts or ransom demand were attached to the listing.

What was published

The listing names Aeroklas Duys (Pty) Ltd, described in the group entry as a specialised automotive manufacturing company formed as a joint venture between the Duys Engineering Group and Aeroklas, an automotive accessory manufacturer owned by the Eastern Polymer Group of Thailand.

• Victim: Aeroklas Duys (Pty) Ltd / Duys Engineering Group
• Country: South Africa
• Sector: automotive manufacturing and mechanical engineering
• Group: Deadlock
• Listing date: 12 October 2026
• Data types claimed: not specified in the listing
• Volume claimed: not disclosed

Duys Engineering Group is presented in the listing as an industrial and mechanical engineering firm founded in South Africa in 1960. The group entry carries no technical detail on the intrusion, no screenshots of exfiltrated files and no indication of how many records are involved. The company domain aeroklasduys.co.za no longer serves a corporate site and currently returns a hosting placeholder page.

Risks for affected individuals

• Employee and contractor identity data, payroll files and human resources records held by an automotive components manufacturer.
• Commercial documents such as supply agreements, customer and supplier lists, and engineering or production specifications.
• Credentials for corporate systems and third party portals, which enable follow on intrusion attempts and business email compromise.

What remains unknown

• Whether Aeroklas Duys, its joint venture partners or South African authorities have confirmed the intrusion.
• Which systems were accessed and how initial access was obtained.
• The content and volume of any exfiltrated data, and whether a ransom has been demanded or paid.
• Whether the Deadlock listing reflects completed exfiltration or a claim published before data is released.

What affected people should do

Anyone who works for or does business with Aeroklas Duys should treat email and messaging accounts linked to the company as potentially exposed, change any reused password and enable multi factor authentication. Watch for invoices, payment redirection requests and job offers that reference the company or its partners. Staff can report suspected incidents and identity misuse to their internal security team, to the South African Police Service and to the Information Regulator.