Samcrete listed by the Clop ransomware group

Overview

The Clop ransomware group has listed SAMCRETE, an Egyptian construction and building operations company, on its leak site. Founded in 1963, the company is active in real estate development, infrastructure, industrial construction and ready-mix concrete production. The listing appeared on 13 November 2025. At the time of analysis, the group's leak page was not reachable.

What was published

The group claims to have exfiltrated corporate data from the company. The archive is expected to include project documentation, construction contracts and financial records.

Risks for affected individuals

• Employees' personal records may be exposed.
• Project and contract data could be of commercial value.
• Financial information may enable fraud attempts.

What remains unknown

• The volume of data stolen.
• The exact contents of the leak.
• Whether the data has been published elsewhere.

What affected people should do

Employees should update credentials and watch for phishing referencing the company. SAMCRETE should notify staff and partners, engage cybersecurity experts, and coordinate with Egyptian authorities on the response.