🏭 Industrials & Manufacturing¶
Manufacturing, construction, engineering, aerospace & defense, agriculture, mining · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed
Victims L30D5▼ −26
Prior 30D31
Active actor L90DQilin · 14
Active actor L90DThe Gentlemen · 5
Active actor L90DStorm · 3
Today — 03 Nov 2026¶
No industry-tagged items in today's briefing — see recent activity below.
Last 14 days¶
Recent victim claims¶
Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.
October 2026
Oct 20
Brüninghoff Group
Payload
Payload lists the German hybrid-construction/prefabricated-building-components manufacturer on its leak site, claiming ~40GB of data; no company statement or independent confirmation. · Sources: Breachsense · HookPhish
Oct 19
Oak Grove Technologies
DragonForce
North Carolina-based defense and military-training services firm listed on DragonForce's leak site, discovery dated Oct 19; the group claims roughly 261GB exfiltrated. No company statement and no independent news corroboration found beyond the DLS tracker listing -- treat as an unverified actor claim, not a confirmed breach. · Sources: Breachsense
Oct 18
Quikrete
Helix
Helix leak-site post with no encryption claim and no proof samples threatens to post file-sharing links within six hours; Quikrete has not confirmed an incident. · Sources: RedPacket Security
Oct 16
Chadwick Switchboards
Qilin
Qilin published the full claimed dataset Oct 16 against this NSW low-voltage switchboard manufacturer, whose customers reportedly include childcare centres, nursing homes and police stations; the listing dates to Oct 4 but the publication is new. No company statement found; a trade outlet's own review of the dump called the data 'appears legitimate.' · Sources: hendryadrian.com
Oct 13
R. A. Wood Associates
Storm
Storm ransomware group listed R. A. Wood Associates, a New York engineering consultancy, on its leak site. Leak size undisclosed; no company statement, regulatory filing, or independent press corroboration found beyond the aggregator listing. Treat as an unverified claim. · Sources: Breachsense
Oct 03
Skaff Group
Rhysida
Listed on Rhysida's leak site; claims ~139,377 files/268GB incl. HR, national ID, banking (Byblos/Cedrus Bank) and payroll data. Unverified claim, no company confirmation. · Sources: DeXpose
Oct 03
Precon Marine Inc
Netrunner
US marine/subsea contractor; listed on Netrunner's leak site, 75 passwords plus one cookie exposed in an infostealer-style exposure scan. Unverified claim, no company confirmation. · Sources: DeXpose
Oct 02
Allied Machine & Engineering
Storm
Ohio-based cutting-tool manufacturer; claim listed, no scope/incident date given, no company confirmation. · Sources: GalaxyWarden
Oct 01
Zelham, Inc.
The Gentlemen
Boise, Idaho hotel-renovation general contractor (~55-57 employees) listed on The Gentlemen's leak site; no company confirmation. · Sources: GalaxyWarden
Oct 01
Disk Precision Group
Krybit
Precision engineering firm (sites in Singapore/Malaysia/Thailand). Claimed by Krybit Oct 1; this company already appeared on two other groups' leak sites in 2026 (The Gentlemen Apr, LeakBazaar May) -- treat as a recurring/possibly-stale target. Unverified DLS claim. · Sources: HendryAdrian
September 2026
Sep 30
Wooshin Safety Systems Co Ltd
The Gentlemen
KOSPI-listed (017370) automotive-assembly-line robotics/welding-systems supplier to GM, Ford, Stellantis, Hyundai/Kia and Rivian; listed on The Gentlemen's leak site; no company confirmation. · Sources: RansomLook
Sep 30
wolfusofsky.de
SafePay
Rhineland-Palatinate/Saarland construction and infrastructure services provider listed on SafePay's leak site; estimated attack date Sep 29; no company confirmation. · Sources: Ransomware.live · GalaxyWarden
Sep 30
econ-tec.com
SafePay
Industrial technical-systems design firm (engineering, process optimization, automation) listed on SafePay's leak site; estimated attack date Sep 29; no company confirmation. · Sources: Ransomware.live
Sep 28
Nissho Electric Manufacturing Co., Ltd.
Qilin
Electrical/electronic manufacturer listed on Qilin's leak site; ~300GB claimed exfiltrated. Unverified claim, no company confirmation. · Sources: Ransomware.live · FalconFeeds
Sep 28
MinMor Industries
Cry0
US industrial-sector company listed on Cry0's leak site with a threatened data leak. Unverified claim, no company confirmation. · Sources: Ransomware.live · DeXpose
Sep 28
Precision Facades Ltd
N0n
UK facade-engineering/construction firm listed on N0n's leak site; claim covers a full file server (finance/accounts, audits, bank mandates, board papers, tender/project data), publication deadline Oct 2 2026. Unverified claim, no company confirmation. · Sources: Ransomware.live · DeXpose
Sep 27
Pantaneiro Capas
Arcus Media
Manufacturer listed on Arcus Media's leak site with a publication deadline of Oct 4, 2026. Unverified claim, no company confirmation. · Sources: Ransomware.live · GalaxyWarden
Sep 26
Applied Composites
Storm
Aerospace/defense/space composite-components manufacturer (Lake Forest, CA); listed on Storm's leak site, no company confirmation. · Sources: Ransomware.live
Sep 25
Iberia Compositech Manufacturing
Qilin
Spanish manufacturing firm listed on Qilin's leak site; no company confirmation. · Sources: Ransomware.live
Sep 25
CO.R.I.S. S.r.l.
LockBit5
Italian auto-parts manufacturer (corisricambi.it) claimed by LockBit5 Sep 24, listed Sep 25; no company confirmation. · Sources: Ransomware.live
Sep 24
Wallatec GmbH
Akira
Austrian beverage-carbonation equipment manufacturer (Regau) listed on Akira's leak site; no company confirmation. · Sources: Ransomware.live
Sep 24
Strack Companies
Akira
St. Joseph, MN construction company listed on Akira's leak site; no company confirmation. · Sources: Ransomware.live
Sep 24
Agora cooperative agricole
Qilin
French agricultural cooperative listed on Qilin's leak site; no company confirmation. · Sources: Ransomware.live
Sep 24
Electro Heat Sweden AB
Rhysida
Swedish industrial-heating manufacturer; Rhysida claims 2.55TB/1,723,527 files incl. SolidWorks CAD IP, payroll/accounting databases and legal material. Unverified claim. · Sources: Ransomware.live
Sep 23
Tomix / Grupo JOPER
SpaceBears
SpaceBears listed Tomix / Grupo JOPER, a Portuguese agricultural and industrial equipment manufacturer, on its leak site Sep 23; no data sample or company confirmation. · Sources: RedPacket Security
Sep 22
Sealcon
Termite
Termite listed Sealcon (sealconusa.com), a Colorado-based cable-management/electrical-connector manufacturer, on its leak site. Listing gives no detail on encryption vs. exfiltration scope. No company confirmation. DLS claim only. · Sources: RedPacket Security
Sep 22
ARCA UNLIMITED Architects
BlackLocks
Architecture firm listed on BlackLocks' leak site, estimated attack date Sep 22, listing published Sep 26. Unverified claim, no company confirmation. · Sources: Ransomware.live
Sep 20
Zorlu Holding
Qilin
Qilin listed Zorlu Holding, a large Turkish industrial/manufacturing conglomerate, on its leak site Sep 20. No data volume disclosed, no company confirmation. DLS claim only; Qilin listings have included unverified/fabricated claims in the past. · Sources: RedPacket Security
Sep 18
Giti Tire (Giti Corp)
Killsec
Killsec listed Giti Tire, the Singapore-headquartered global tire manufacturer (32,000+ employees, 8 manufacturing facilities, distribution to 130+ countries), on its leak site Sep 18, claiming to have exfiltrated internal data. No data samples, scope, or company confirmation. DLS claim only. · Sources: RedPacket Security · Ransomware.live
Sep 18
Prefix Corp
Securotrop
Securotrop claims 1,135GB of exfiltrated data, threatens publication if no contact by Sep 30; unverified DLS claim · Sources: https://www.redpacketsecurity.com/securotrop-ransomware-victim-prefix-corp/
Sep 17
AECOM
Metaencryptor
Metaencryptor listed AECOM, the Texas-based multibillion-dollar global infrastructure consulting and engineering firm, on its leak site Sep 17, claiming to have seized 1.22 TB of data. No data samples published, no company confirmation of scope, encryption, or exfiltration. DLS claim only. · Sources: RedPacket Security · Ransomware.live
Sep 16
Aarsleff
Qilin
Qilin listed Aarsleff, a Sweden-based manufacturing organization, on its leak site Sep 16. No data volume or scope disclosed, no company confirmation. DLS claim only. · Sources: RedPacket Security
Sep 15
Veritiv
iah6477
iah6477, a newly emerged US-focused extortion group first observed Sep 15, listed Veritiv, a US packaging and paper distribution company, on its leak site claiming to have seized 1.9 TiB of data. No data samples published, no company confirmation. iah6477 is an emerging group whose prior listings have included unverified/disputed claims -- treat as unconfirmed pending corroboration. · Sources: https://www.dexpose.io/ransomware-group-iah6477-strikes-veritiv/
Sep 07
ST Engineering
Metaencryptor
Singapore-based multinational technology, defence and engineering group (aerospace, smart city, defence and public security segments); Metaencryptor DLS claim Sep 7, 2026; data scope and impact unconfirmed. 🟥 Unverified DLS claim; verify before treating as a breach. · Sources: https://www.ransomware.live/id/U1QgRW5naW5lZXJpbmdAbWV0YWVuY3J5cHRvcg==
Sep 07
United Group
Vexy
Indian diversified business group (food ingredients, nutraceuticals, industrial machinery, infrastructure, fashion, digital branding, packaging, automotive accessories); Vexy DLS claim Sep 7, 2026; Vexy is a newly emerged group (first seen Sep 2026); data scope and impact unconfirmed. 🟥 Unverified DLS claim; verify before treating as a breach. · Sources: https://www.redpacketsecurity.com/vexy-ransomware-ransomware-victim-united-group/
Sep 07
Master Manufacturing Co., Inc.
Dark Project
Southern Indiana custom metal stamping, laser cutting, and wire bending manufacturer (founded 1970, IATF 16949 certified); Dark Project claims 36GB exfiltrated, including SQL databases with personal data and technical schematics; data-exfiltration claim, no encryption reported. 🟥 Unverified DLS claim; verify before treating as a breach. · Sources: https://www.redpacketsecurity.com/dark-project-ransomware-victim-master-manufacturing-co-inc/
Sep 04
EDIF S.p.A.
Aurora
Italian wholesale distributor of electrical equipment, plumbing, and lighting systems; Aurora DLS claim Sep 4, attack estimated Aug 27; exposed data includes system passwords, certified email credentials, customer invoices, tax numbers, shipping records, CCTV configurations, financial databases, and a detailed 2024 financial report; 🟥 DLS claim only; verify before treating as a breach · Sources: https://www.dexpose.io/aurora-targets-italian-wholesale-distributor-edif-s-p-a/ · https://www.redpacketsecurity.com/aurora-ransomware-victim-edif-s-p-a/
August 2026
Aug 29
Bandit Industries
Qilin
Qilin DLS claim Aug 29, 2026; US industrial equipment manufacturer; scope and data volume unconfirmed · Sources: https://www.ransomware.live/summary/
Aug 26
Air International Thermal Systems
Qilin
Qilin DLS posting Aug 26. Air International Thermal Systems is a US provider of thermal management and HVAC solutions for industrial and defense applications. Unverified DLS claim; no data samples published. · Sources: https://www.dexpose.io/qilin-ransomware-strikes-air-international-thermal-systems/
Aug 26
Metal Conversions
Qilin
Qilin DLS posting Aug 26. Metal Conversions is a US metals manufacturing company. Unverified DLS claim; no data samples published. · Sources: https://www.dexpose.io/qilin-ransomware-strikes-metal-conversions/
Aug 25
Johnson City Honda
Global Secret Group
Car dealership, Tennessee. DLS claim Aug 25. 🟥 Unverified DLS claim. · Sources: https://ransomware.live/
Aug 24
Espac
The Gentlemen
Chilean construction company; The Gentlemen DLS claim Aug 24 threatening sensitive data exposure · Sources: https://www.dexpose.io/thegentlemen-ransomware-attack-on-espac/
Aug 21
NTE Italia
Panzer
Panzer ransomware DLS claim August 21 2026; NTE Italia is an engineering and telecommunications service provider based in Catanzaro, Italy; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 19
Babcock Africa
The Gentlemen
TheGentlemen ransomware DLS claim August 19 2026; Babcock Africa is a major engineering and asset management company serving critical infrastructure and heavy equipment across Africa; data scope unconfirmed; 🟥 unverified DLS claim · Sources: https://ransomware.live/id/QmFiY29ja0B0aGVnZW50bGVtZW4=
Aug 18
R&D Machine and Engineering
DragonForce
DragonForce ransomware group posted R&D Machine and Engineering (rdmachine.com) on its DLS Aug 18; US aerospace and defense manufacturer; sensitive engineering data threatened for release. 🟥 Unverified DLS claim. · Sources: https://www.dexpose.io/dragonforce-strikes-r-d-machine-and-engineering/
Aug 13
General Electric
Clop
Clop listed GE on DLS as part of mass PTC Windchill/FlexPLM campaign (CVE-2026-12569); claimed engineering data. GE has made no public statement. DLS claim — breach not confirmed. · Sources: https://www.bleepingcomputer.com/news/security/clop-ransomware-targets-windchill-flexplm-in-data-theft-attacks/
Aug 12
B Wright Drywall
Qilin
DLS claim by Qilin (Aug 11-13 posting); Canadian construction firm; scope and data volume unverified · Sources: https://www.ransomware.live/group/qilin
Aug 10
Astro Electroplating
Qilin
Qilin DLS posting August 10, 2026; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 10
Chung Tai Shin Chemical Industry Co.
Qilin
Qilin DLS posting August 10, 2026; chemicals and manufacturing sector; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 10
AIMS Group
The Gentlemen
TheGentlemen DLS posting August 10, 2026; UAE-based conglomerate; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 10
Actini Group
KRYBIT
KRYBIT ransomware DLS posting August 10, 2026; French industrial machinery manufacturer; data scope unconfirmed · Sources: https://www.redpacketsecurity.com/krybit-ransomware-victim-www-actini-com/
Aug 08
Filtronic plc
Qilin
Qilin DLS claim August 8 2026; UK-listed manufacturer of RF/microwave components for defence and telecoms infrastructure; no statement from Filtronic; data scope and impact unconfirmed · Sources: https://www.hendryadrian.com/ransom-filtronic-aug-2026/
Aug 08
Clausing Industrial
Qilin
Qilin DLS claim August 8 2026; Michigan-based metalworking machinery manufacturer; no statement from Clausing; data scope and impact unconfirmed · Sources: https://www.ransomware.live/group/qilin
Aug 07
IEH Corporation
Unknown
SEC cybersecurity disclosure; producer of components for military satellites, missiles, fighter jets; cyberattack discovered early August, containment actions taken · Sources: https://therecord.media/military-device-manufacturer-discloses-cyber-incident
Aug 04
Trulite Glass and Aluminum Solutions
INC Ransomware
INC Ransomware DLS claim August 4 2026; US glass and aluminium manufacturer; attack via SonicWall SMA1000 zero-day chain (CVE-2026-15409/15410 CVSS 10.0); no statement from Trulite; data scope unconfirmed · Sources: https://thehackernews.com/2026/08/inc-ransomware-emerges-as-dominant.html
Aug 04
RUPP Spritzguss
Qilin
Qilin DLS claim approximately August 4 2026; German plastics injection-moulding manufacturer; no statement from RUPP; data scope and impact unconfirmed · Sources: https://www.ransomware.live/
Aug 01
Sigma Plastics Group
Play
Play DLS claim August 1 2026; major US plastics manufacturer. No victim statement; no data published. · Sources: https://www.redpacketsecurity.com/play-ransomware-victim-sigma-plastics-group/
July 2026
Jul 31
Hyundai Motor Türkiye
CRPxO
CRPxO DLS claim July 31: 1.5 GB of recruitment and personnel data including interview answers, evaluation scores, and tracking logs. Part of the broader July 31 CRPxO Turkish wave. 🟥 DLS claim only; no victim statement. · Sources: https://gbhackers.com/crpx0-ransomware-claims-hyundai-turkey-breach/amp/ · https://cyberpress.org/crpx0-ransomware-claims-hyundai-turkey-breach/
Jul 30
Indus Protech Solutions
The Gentlemen
TheGentlemen DLS claim July 30, 2026; Chennai-based bulk MRO and supply chain services provider for global trade; data scope and impact unconfirmed; 🟥 unverified · Sources: https://www.redpacketsecurity.com/thegentlemen-ransomware-victim-indus-protech-solutions/ · https://www.ransomware.live/
Jul 30
MicroPhase Corporation
The Gentlemen
TheGentlemen DLS claim July 30, 2026; US defense electronics and IT company; data scope and impact unconfirmed; 🟥 unverified · Sources: https://www.breachsense.com/breaches/ · https://www.ransomware.live/