Crossett listed on Termite ransomware leak site

• Ransomware group: Termite
• Country: United States
• Announcement date: September 26, 2026

The threat actor known as Termite has listed the organization Crossett on its leak site. The group claims to have gained access to the company's internal data and has announced the breach on September 26, 2026, alleging that the attack occurred on September 25, 2026.

The claims made by Termite

According to the announcement made by the Termite group, they have successfully accessed the data belonging to Crossett. The group alleges that the total volume of the stolen data amounts to 70 GB. While the full dataset has not been released in its entirety, the group has provided some portions of the information via screenshots to demonstrate the validity of their claims.

Publicly available information regarding the Termite group remains limited. There is very little information in the public domain concerning the specific tactics, techniques, or procedures used by this group. Furthermore, the group has not disclosed a ransom demand in connection with this specific listing.

Data involved in the alleged breach

The screenshots provided by the threat actor contain various sensitive documents. These include financial statements, accounting records, and vendor registration forms. The leaked information is reported to include the following types of data:

• Financial data
• Vendor information
• Tax identification numbers

The presence of such documentation suggests a significant exposure of corporate and partner information. In many ransomware scenarios, the theft of such data is used to pressure organizations through a method known as double extortion. In this model, attackers not only encrypt the victim's systems but also steal sensitive information, threatening to publish it on a public leak site if the ransom is not paid. This tactic aims to maximize leverage by threatening the victim's reputation and legal standing.

About Crossett

Crossett is a leading petroleum transportation company operating in the Eastern United States and Ontario, Canada. Established in 1928, the company provides safe fuel logistics services supported by a fleet of over 100 tractors and 210 trailers.

Impact and industry implications

The allegedly leaked data may pose a significant risk to the company's financial operations and its various supply chain partners. The specific inclusion of tax identification numbers and banking details within the shared documents could lead to identity theft or targeted phishing attacks against the affected parties. Such attacks often target the specific individuals or vendors identified in the stolen documents to gain further access or financial gain.

Because Crossett is a United States-based entity, the incident may trigger legal proceedings under relevant state laws and federal data protection standards. The publication of this data by the group, operating under a double-extortion model, may negatively impact the company's commercial reputation and weaken overall supply chain security.

For organizations operating in the logistics and transportation sectors, such incidents highlight the importance of robust data protection strategies. Common defensive steps for organizations facing similar threats include implementing strict access controls, maintaining offline backups, and conducting regular security awareness training to prevent phishing. Additionally, monitoring for unauthorized data exfiltration and ensuring that all vendor communications are secured can help mitigate the impact of a potential breach. Protecting the integrity of the supply chain is critical, as a breach in one company can create cascading risks for all associated partners and stakeholders.