Elkair listed by the Clop ransomware group

Overview

The Clop ransomware group has listed Elkair, an Egyptian retail business operating elkair.com, on its leak site. The listing appeared on 25 January 2026. At the time of analysis, the group's leak page was not reachable.

What was published

The group claims to have exfiltrated corporate data from the retailer. The archive is expected to include customer records, corporate documentation and financial information.

Risks for affected individuals

• Customer personal data may be exposed.
• Financial records could enable fraud.
• Employees' information may be included.

What remains unknown

• The volume of data exfiltrated.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

Customers should monitor their accounts and be cautious of unsolicited communications. Elkair should notify affected customers and staff, review its systems, and report the incident to Egyptian authorities.