DistributionNOW (DNOW Inc.) listed by Falcon ransomware group
The threat group known as Falcon has listed DistributionNOW on its leak site, claiming to have exfiltrated 344 GB of corporate data.
- Published
- 2 min read
- 2 min read
- Ransomware group: Falcon
- Country: United States
- Sector: Manufacturing
- Announcement date: August 30, 2026
Falcon ransomware group claims data breach at DistributionNOW
The threat group known as Falcon has listed DistributionNOW on its leak site, claiming to have exfiltrated 344 GB of corporate data. This announcement, made on August 30, 2026, follows a period of alleged unauthorized access to the company's systems.
Details of the alleged attack
According to the claims made by the Falcon group, the security incident that led to the data exfiltration reportedly occurred on July 14, 2026. The group has asserted that they gained access to various corporate datasets during this timeframe. Following the alleged breach, the group has threatened to publish the stolen information unless their specific demands are met. While the group has identified the victim and the volume of data, no information was provided regarding the specific ransom demand.
Alleged stolen data types
The data allegedly stolen by the Falcon group is extensive and covers a wide range of sensitive corporate and personal information. The group claims to have obtained the following items:
- Corporate bank statements
- Vendor payment instructions
- Payroll records
- Employee compensation
- Tax documents
- Operational secrets
- SCADA gateway backups
- PLC logic programs
- Industrial automation project files
- Internal audit logs regarding unethical activity
- Whistleblower reports on harassment and discrimination
- Employee disciplinary records
- Personally identifiable information (PII)
- Passports
- Driving licenses
- Medical drug screen results
About DistributionNOW (DNOW Inc.)
DNOW Inc. is a publicly traded company headquartered in Houston, Texas. The organization provides supply chain management and product distribution services for energy and industrial markets. It serves as a supplier of equipment and solutions for the oil, gas, and various other industrial sectors.
Potential impact and industry implications
This alleged breach may pose significant risks to DistributionNOW's employees and its overall operational integrity. The exposure of SCADA and PLC-related industrial control system files could potentially lead to secondary security risks regarding the organization's infrastructure. Such risks are a growing concern in the manufacturing and energy sectors, where the intersection of information technology and operational technology creates unique vulnerabilities.
Furthermore, the presence of sensitive employee PII and medical records may result in regulatory scrutiny and legal consequences under US data privacy laws. Beyond the legal implications, the alleged exposure of internal audit and whistleblower reports could damage the organization's reputation and provide material for targeted phishing campaigns against the company or its stakeholders.
General context on ransomware and defense
Ransomware attacks involving data exfiltration often follow a