MECASEM appears in 3AM leak listings

Mecasem.org is listed as a victim attributed to the Threeam, or 3AM, group on Ransomware.live, with a discovery date of August 19, 2026. Breachsense also logged a data incident tied to the same domain and the same actor, likewise discovered on August 19, 2026, while GalaxyWarden said 3AM would have posted MECASEM on its leak site, although the company has not publicly confirmed a breach or data theft.

What do the public records show?

Ransomware.live identifies mecasem.org as a victim attributed to Threeam and sets an estimated attack date of 2026-08-19. That public entry places the case within the usual tracking of leaks or extortion linked to ransomware groups, but on its own it does not provide independent confirmation of the incident from the affected organization.

Breachsense also includes the case in its data incident database and attributes it to the 3AM ransomware group, with a discovery date of August 19, 2026. That entry does not specify the size of the leak. The platform also describes Mecasem as a family-run industrial laboratory based in France, specializing in materials testing, calibration, and metrology services, which suggests the affected organization is French rather than Mexican.

How confirmed is the case?

The public reporting available so far does not allow the incident to be treated as confirmed with public validation from the company. GalaxyWarden said 3AM would have listed mecasem.org on its leak site, but clarified that MECASEM has not publicly confirmed a breach or data theft.

That distinction matters because Mallory's threat profile for THREEAM indicated that, through mid-August 2026, no public activity attributed to that actor had yet been observed. That suggests victim listings for the group are recent and that the documented history remains limited.