Demidov Steel Group data allegedly leaked by AuditTeam

• Ransomware group: AuditTeam
• Country: Russia
• Sector: Manufacturing
• Announcement date: August 26, 2026

AuditTeam claims to have leaked data from Demidov Steel Group

The threat actor group known as AuditTeam has published data on their leak site, claiming it belongs to the Russia-based metal manufacturer Demidov Steel Group. This announcement, made on August 26, 2026, follows an alleged attack that occurred on August 18, 2026. The group has released the data to the public after stating that the remediation window for the organization had expired.

In many modern ransomware attacks, groups employ a tactic known as double extortion. In this scenario, attackers do not merely encrypt an organization's systems to disrupt operations; they also exfiltrate sensitive data before the encryption process begins. If the victim refuses to pay the ransom to restore their systems, the attackers threaten to release the stolen information on a public leak site to pressure the organization into compliance. This method increases the leverage held by the threat actors, as the threat of a public data leak can cause significant reputational and operational damage.

Details of the alleged breach

According to the announcement made by AuditTeam, the group claims to have compromised specific types of data belonging to Demidov Steel Group. The threat actor states that they have acquired archives containing information from the company's internal systems. To validate their findings and prove the legitimacy of the breach, the group included sample data artifacts and decryption keys within their announcement.

The announcement specifies that the following data types are involved in the leak:

• File server data
• PST email data

The inclusion of PST files is particularly significant in cyberattacks, as these archives often contain entire mailboxes, including historical correspondence, attachments, and contact lists, which can provide a deep look into an organization's internal communications and business relationships.

About Demidov Steel Group

Demidov Steel Group is a Russian manufacturer and trader of metal products. The company produces and sells over 4,000 items, including steel pipes, structural shapes, sheet metal, and rebar, through wholesale and retail channels. With production plants in cities such as Ryazan, Davlekanovo, and Novocherkassk, the company serves clients in the construction and industrial sectors.

Potential impact and industry implications

The alleged compromise of file server and email data may contain sensitive information regarding the company's commercial operations, client relationships, and internal communications. This exposure could potentially facilitate targeted phishing attacks against the company's supply chain partners and industrial clients. When attackers gain access to email archives, they can often impersonate legitimate business contacts, making social engineering attacks much more convincing and dangerous for the organization's partners.

Furthermore, if the leaked data includes personal information of employees or business partners, it may lead to reputational damage and operational risks for the organization. The public release of such data can also increase the likelihood that secondary threat actors could exploit this information for malicious purposes. In the manufacturing sector, where supply chains are complex and interconnected, a breach in one company can create a ripple effect of risk across many different stakeholders.

To defend against such threats, organizations in the manufacturing and industrial sectors typically implement several defensive layers. These include robust endpoint protection, regular offline backups to ensure data can be restored without paying a ransom, and strict network segmentation to prevent attackers from moving laterally from one system to another. Additionally, monitoring for unauthorized data exfiltration and conducting regular security awareness training for employees can help mitigate the risk of successful phishing and unauthorized access to sensitive file servers and email databases.