Calmec targeted by TridentLocker ransomware group

• Ransomware group: TridentLocker
• Country: Canada
• Sector: Manufacturing
• Announcement date: November 29, 2025

The threat actor known as TridentLocker has published data on its leak site, claiming it belongs to Calmec. This announcement, made on November 29, 2025, indicates a significant data breach targeting the Canadian manufacturing entity.

Details of the claimed attack

According to the announcement posted on the group's leak site, the TridentLocker group has listed a dataset that is claimed to belong to Calmec. The group asserts that the data was leaked on November 15, 2025, though the attack itself is claimed to have occurred on October 29, 2025. While the group has made these claims, public information regarding the specific operations and background of the TridentLocker group remains limited.

The incident follows a pattern often seen in modern cyberattacks where threat actors use specialized leak sites to pressure victims. These sites serve as a platform for the group to host stolen information, often accompanied by specific demands. In this particular instance, no ransom demand has been specified by the group.

Data and file information

The volume of data involved in this alleged breach is substantial. The group claims to have exfiltrated approximately 73.91 GB of data, which is organized into 76,820 files. The file list provided on the leak site consists of various archive files. While the exact content of the data is not clearly specified by the threat actor, the archives reportedly contain various industrial and commercial partner names.

Potential data risks

• Trade secrets
• Supply chain information
• Employee data

Although the content of the allegedly leaked data is not fully known, there may be a risk of exposure for the items listed above, which are critical to an organization operating in the manufacturing sector.

About Calmec

Calmec is a Canadian engineering and manufacturing company that designs and produces custom production lines and equipment for the wire and cable industry. The company specializes in wire drawing, stranding, and cable processing technologies. As a Canada-based entity, potential data breaches may be subject to PIPEDA regulations.

Analysis and industry implications

The method employed by the TridentLocker group in this incident may be viewed as part of a double-extortion strategy. In a double-extortion scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also steal sensitive data to threaten its public release. This approach is designed to increase the pressure on the victim to pay the ransom, as the threat of exposing sensitive information can be more damaging than the operational downtime caused by encryption alone. This strategy can potentially compromise the overall operational security of the targeted organization.

The exposure of the claimed data could be utilized by threat actors for various malicious purposes. Specifically, the data could be used to facilitate targeted phishing attacks against the organization's business partners or for secondary fraud attempts. When industrial or commercial partner names are leaked, it provides attackers with the necessary context to craft highly convincing social engineering campaigns.

For organizations operating within the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Protecting intellectual property, such as trade secrets and specialized technical processes, is vital for maintaining a competitive advantage. Furthermore, securing supply chain information is essential to prevent downstream attacks where a breach in one company is used as a stepping stone to reach its partners. Organizations can mitigate these risks by implementing strict access controls, monitoring for unauthorized data exfiltration, and ensuring compliance with regional data protection regulations to manage the legal and reputational fallout of a potential breach.