Sovcali — Ransomware Profile
Sovcali is an extortion crew whose Tor data-leak site surfaced in early August 2026 and was quickly catalogued by trackers such as ransomware.live and WatchGuard, with dark-web watcher DarkFeed noting how much detail it attaches to each listing's description of the allegedly stolen data. Its debut claim targeted American EV maker Lucid Motors, first observed on the leak site in August 2026: the group says it holds roughly 5 TB of engineering material, including CAD models, simulations and bills of materials, allegedly obtained through the engineering services firm eShocan. BreachNews reported that Lucid confirmed a cybersecurity incident at an unnamed vendor on August 21, and that Sovcali published about 35 GB as proof before threatening a further 100 GB release. The claimed data volume remains independently unverified, and the leak site lists at least one victim to date.
Recent claimed victims
Read the full analysis on IntelFusions