EPC Group listed on direwolf leak site with claims of data theft

• Ransomware group: direwolf
• Country: United States
• Sector: Technology
• Announcement date: June 4, 2025

EPC Group targeted by direwolf ransomware group

The threat actor known as direwolf has listed the organization EPC Group on its dedicated leak site. According to the announcement made on June 4, 2025, the group claims to have successfully exfiltrated 73 GB of data from the victim's systems. This type of announcement is a common tactic used in double extortion ransomware campaigns, where attackers not only encrypt an organization's data but also threaten to release sensitive information publicly to pressure the victim into paying a ransom.

In such scenarios, the threat actor typically uses a leak site to host proof of the breach. This proof often includes file lists or samples of the stolen data to demonstrate the validity of their claims. For organizations, these incidents represent a significant escalation in cyber risk, moving from simple service disruption to the potential exposure of intellectual property and sensitive corporate information.

Details of the claimed attack

The claim made by the direwolf group suggests a structured approach to the data release. The group announced the breach on June 4, 2025, and has stated that the stolen data will be released in stages. According to the group's timeline, a full release of all the claimed data is scheduled to occur on June 30, 2025. To support their allegations, the group has provided links to sample files and various file lists within their announcement.

While the specific method of initial entry remains unknown, the presence of such large volumes of data on a leak site indicates a significant breach of the perimeter. Ransomware groups often target high-value sectors to maximize their leverage during negotiations. In this instance, the group is using the threat of a complete data dump to create urgency for the target organization.

Alleged stolen data types

The data claimed to be stolen by direwolf is diverse, covering various aspects of the organization's operations and technical infrastructure. The listed data types include:

• SQL server data
• Customer data
• Supply chain data
• PhysicalLab data
• Technical office data
• Other corporate data

About EPC Group

EPC Group is an internationally active engineering and plant construction company. The organization provides innovative technological solutions for various industrial sectors. Their expertise spans several critical areas, including chemical, petrochemical, energy, and environmental technologies. Given the nature of these sectors, the organization plays a vital role in the industrial infrastructure of the regions in which it operates.

Impact assessment and industry implications

This incident may create negative impacts on EPC Group's operational continuity and commercial reputation. The alleged exposure of customer and supply chain data could pose risks to the organization's relationships with third parties. As the organization is based in Germany, the incident may require evaluation regarding data protection violations under GDPR.

Furthermore, the public release of data may increase secondary risks such as identity theft or targeted phishing attacks for the organization's customers and employees. In the technology and engineering sectors, the loss of technical office data or specialized laboratory data can lead to the exposure of proprietary processes or sensitive project details.

For organizations operating in similar industrial and technological sectors, maintaining robust defensive postures is essential. This includes implementing strict access controls, conducting regular audits of SQL servers, and ensuring that supply chain communications are encrypted and monitored. As information about the direwolf group remains limited in the public domain, organizations must remain vigilant against the evolving tactics used by such threat actors.