THREAT WATCH · October 16, 2026 · RANSOMWARE LISTING
SETTRA lists Norwegian IT firm konsis.no
konsis.no, a Norway-based IT organization with more than 1,000 employees, appears on a ransomware tracker associated with the SETTRA group. The listing was recorded on October 16, 2026. The disclosure status is recorded as not disclosed yet. A listing is a signal that an organization may be targeted or claimed by a ransomware group. It is not confirmation of a breach, data theft, or operational impact.
- Attack group
- SETTRA
- Listed domain
- konsis.no
- Record date
- October 16, 2026
- Location on record
- Norway
- Sector
- IT
- Reported size
- +1000 employees
- Disclosure on record
- Not disclosed yet
Key takeaways
- konsis.no appears on the SETTRA ransomware tracker as of October 16, 2026.
- The listed organization is based in Norway and operates in the IT sector.
- Company size is recorded as more than 1,000 employees.
- Disclosure status is recorded as not disclosed yet.
What is recorded
- Organization: konsis.no
- Domain: konsis.no
- Ransom group: SETTRA
- Listing date: October 16, 2026
- Country: Norway
- Sector: IT
- Company size: more than 1,000 employees
- Disclosure status: not disclosed yet
What a listing means
A listing means the organization appears on an attacker-side ransomware tracker. It is strong signal, not a confirmed breach. The available record does not establish that systems were accessed, that data was taken, or that services were disrupted.
What is not known
No additional details are recorded in this entry. There is no information about affected systems, data types, ransom demands, timelines, or business impact. The disclosure status remains not disclosed yet.
Suggested next steps
- Confirm whether the organization has received any direct contact or demand.
- Review backup, access, and monitoring records for unusual activity.
- Prepare internal and external communication plans in case disclosure changes.
- Coordinate with legal, security, and executive teams before making public statements.
SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 17, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.