Doman listed on interlock leak site

• Ransomware group: interlock
• Country: Canada
• Sector: Manufacturing
• Announcement date: April 4, 2025

The Canadian-based building materials company Doman has been listed on a leak site by the threat actor group known as interlock. The announcement, which appeared on the group's platform, indicates a potential data breach involving the organization.

The claim by interlock

The interlock group has officially listed Doman on its dedicated leak platform. According to the announcement, which was created on April 4, 2025, the group claims to have successfully obtained data belonging to the organization. While the group has made this public claim, the specific details surrounding the method of access or the exact timing of the intrusion remain unverified by the source.

Ransomware leak sites serve as a primary tool for extortion in the modern cyber threat landscape. These platforms are used by threat actors to pressure victims into paying ransoms by threatening to release sensitive information. The presence of an organization on such a site is a significant indicator of a targeted cyberattack aimed at data exfiltration.

Details of the alleged data leak

At this stage, there is no information available regarding the nature of the alleged leaked data. The group has not provided specifics concerning the types of files or the volume of information involved in this incident. Furthermore, the provided screenshot associated with the claim does not contain any relevant content to assist in identifying the scope of the breach.

Because the listing names no specific data types, the full extent of the information exposure remains unknown. In many such incidents, the lack of immediate detail can make it difficult for the targeted organization to assess the immediate impact on its digital assets or its regulatory standing.

About Doman

Doman Building Materials Group is a vertically integrated building materials company that supplies lumber and various construction products to retailers across North America. Headquartered in Vancouver, Canada, the company operates wood processing plants, sawmills, and distribution centers.

Risk assessment and industry implications

Public information regarding the interlock group is currently limited, making it difficult to establish a pattern of activity. However, the potential exposure of Doman's data may create significant compliance risks under Canada's PIPEDA regulations. If employee or customer data has been disclosed, there may be a risk of identity theft or targeted phishing attacks against the affected individuals.

Beyond the immediate victims, secondary risks could emerge for the organization's supply chain partners. In the manufacturing and distribution sector, interconnected business processes mean that a breach in one company can potentially impact the security posture or operational stability of its partners. Given that ransomware groups often employ double extortion tactics—whereby they both encrypt systems and threaten to leak data—it is possible that the organization's operational continuity could be negatively impacted.

General defensive considerations

Organizations facing such threats often prioritize several defensive layers. These typically include robust backup strategies to ensure operational continuity and strict identity and access management to limit the movement of attackers within a network. Monitoring for unusual data exfiltration patterns is also a common practice to detect breaches before they reach the leak site stage. As double extortion becomes a standard tactic, the focus for many companies has shifted from mere data recovery to comprehensive data loss prevention and rapid incident response capabilities.