Bruker Corporation disputes this leak-site listing
What Bruker Corporation asked
On 23 September 2026 a member of Bruker's Information Security Team wrote to us: "You have stated on your website that Bruker Corporation was impacted by a ransomware attack by Metaencryptor. I am contacting to request that you remove or correct your published statements because they are inaccurate. Bruker's internal and external cybersecurity professionals have been investigating and have found no evidence to support the alleged breach."
What we changed
The record stays and its wording is unchanged: it says the Metaencryptor group listed Bruker Corporation on its leak site on 21 September 2026, and states that a listing is not confirmation that a breach occurred. Bruker's position is now published here alongside the group's claim: its internal and external investigators have found no evidence to support it. The same listing was reported by Redpacketsecurity and ransomware.live. This group's listings have previously included victims that were never substantiated, and the record notes that.
Our response
Thanks for getting in touch.
ThreatCluster does not state that Bruker was breached. Our page records that the Metaencryptor group listed Bruker Corporation on its leak site on September 21, 2026, and the record itself states that a listing is not confirmation that a breach occurred. We collect these listings from the group's own site and hold a capture of the post. The same listing has been reported by Redpacketsecurity and ransomware.live.
We keep the record because the listing is a fact about the group's behaviour, and our users, including firms that supply or buy from Bruker, need to know the claim was made. Removing it would not remove the claim.
What we can do, is add your statement to the record so anyone reading it sees Bruker's position alongside the claim: that your internal and external investigators have found no evidence to support it. If you later have a public statement or a regulator filing, send it to us, and we can link it. Let us know if you would like us to add a statement to the page.
For what it is worth, this group's listings have previously included victims that were never substantiated, and our page already notes that.
ThreatCluster summarises published reporting and leak-site listings. All corrections are listed at /corrections.
