California Gasket and Rubber Corporation listed on frag ransomware leak site

• Ransomware group: frag
• Country: United States
• Sector: Manufacturing
• Announcement date: March 24, 2025

Aviation component manufacturer targeted by frag group

California Gasket and Rubber Corporation, a manufacturer specializing in components for the aviation and aerospace industries, has been listed on the leak site of the threat group known as frag. The listing, which appeared on March 24, 2025, indicates a potential data breach involving the organization.

The threat actor, operating under the name frag, claims to have conducted a cyber incident against the company on February 28, 2025. According to the group's announcement, they have gained unauthorized access to the organization's internal documents and sensitive data. The group has issued threats to publish the information they claim to have obtained. It is important to note that public information regarding the activities and methods of the frag group remains limited.

Alleged exfiltration of sensitive documents

The leak announcement claims that a wide variety of sensitive information has been exfiltrated from the organization. While no screenshots were provided to verify the claims, the group alleges that the stolen data includes various types of corporate and personal information. The specific categories of data mentioned in the claim include:

• Corporate internal documents
• Agreements
• HR documents
• Customer contact details
• Employee contact details
• Financial statements
• Personnel files
• Passport scans

The presence of such diverse data types suggests a significant breach of information, ranging from business operations to highly sensitive personal identification documents.

About California Gasket and Rubber Corporation

California Gasket and Rubber Corporation is a manufacturing company that has been established since 1942. The organization focuses on the production of gasket and rubber components specifically designed for the aviation and aerospace industries. The company manages its industrial activities through two main divisions operating at its facility located in California.

Risk assessment and industry implications

The alleged leak of this data carries several significant risks for the organization and the individuals involved. The presence of sensitive personal data, specifically passport scans, significantly increases the risk of identity theft for the company's employees and customers. Such information can be exploited by malicious actors to facilitate fraudulent activities against the individuals whose data was compromised.

Furthermore, the disclosure of financial statements and internal documents poses risks to the company's commercial competitiveness. From a regulatory perspective, the exposure of such data may impact compliance processes under US state-level data protection laws. Additionally, the leaked contact information for customers and employees creates a secondary risk of targeted phishing attacks, where attackers use the stolen details to craft convincing fraudulent communications.

The group's threat to publish the data is characteristic of a double extortion scenario. In such scenarios, ransomware actors not only encrypt an organization's systems to disrupt operations but also steal sensitive data to use as leverage, threatening to leak it unless a ransom is paid. This tactic increases the pressure on organizations to comply with demands.

For organizations operating in high-stakes sectors like aerospace manufacturing, managing these risks requires robust defensive measures. Common industry practices to mitigate such threats include implementing strict access controls, maintaining comprehensive logging and monitoring to detect unauthorized access, and conducting regular security awareness training to defend against phishing. Additionally, protecting sensitive personal information through encryption and ensuring compliance with regional data protection regulations are critical components of a modern cybersecurity posture.