BahnLog
bd_b2c5f57b67934a2e · schema v1 · pii pii-v1
Full breach record for BahnLog →Threat-actor claim — not a regulatory filing
This row is a claim by the ransomware group INC Ransom on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.
Source: Ransomware.live
Post text · scraped from the leak site
BahnLog is a railway transport company (EVU) and a railway infrastructure company (EIU). The EIU operates public railway infrastructure, public service facilities, and takes over private railway infrastructure. The logistics company has been a partner and service provider for the railway since 2002. The Homburg/Saar track maintenance yard is the only remaining of six former track maintenance yards in Saarland. From here, railway construction sites throughout the Greater Region are served. ===> Phone Number: +49 6841-189 78 60 Revenue: $6 Million Employees: 25 Data:72gb Contact: Bahnlogistik und Service GmbH Tel.: +49 6841-189 78 60 Reiner Schwarz 06841-189 7873 Christina Naumann 06841/1897860 068411897863 Daniel MüllerD-66459 Kirkel Tel: +49 16097479434 Peer Hanson Tel +49 (0) 6841-189 7869 Mobil +49 (0) 172 – 6199 056 Sabrina Linnenbach Tel +49 (0) 6841-189 78 87 Mobil: +491635576604 Jörg Michael Fries 06825 9703703 Fr.Naumann 06841/1897873 Thomas Bergmann 068411897863 buch haltung 06841/18978-64 J.M: Fries [REDACTED-EMAIL] 06841 1897-867 / -882 N. Sefrin [REDACTED-EMAIL] 06841 1897-869 /-883 !!!_Data publication in 3 days_!!!
J jump to incidentP pin to compareR raw source
Incident timeline — mostly unverified
? — ?
Breach window unknown
Feb 26, 2025
Claim posted
—
No filing yet · watching
Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.
Claim → filing
—
Compliance clock
Not assessable
Evidence ladder
Attacker assertion only. Establishes: claim date, group, alleged victim.
Unlocks: incident narrative, operational impact. Still no compliance clock.
Unlocks: discovery date, data types, affected count, compliance clock.
Unlocks: materiality, stated response, full audit trail. Ceiling removed.
No regulatory filing corroborates this yet — it is the attacker's own assertion. Watch this entity to be notified the moment a filing corroborates or contradicts it.
Source ceiling
- actor name
- victim claim
- ransom/leak status
- discovery date
- materiality
- notification
- affected count
- confirmed data types
- compliance clock
The ✕ fields stay blank until a regulatory filing or victim disclosure lands.