GMORS Co., Ltd listed on underground ransomware leak site

• Ransomware group: underground
• Country: Taiwan
• Sector: Manufacturing
• Announcement date: June 25, 2025

Underground group claims data breach at GMORS Co., Ltd

The threat actor group known as underground has listed GMORS Co., Ltd, a Taiwan-based manufacturing company, on its leak site. According to the announcement, the group claims to possess 302.7 GB of data belonging to the organization.

The event was officially announced on the group's leak site on June 25, 2025. The threat actor claims to have obtained a wide range of corporate and personal data from the company's systems. While the group has made these claims, information regarding this specific group remains limited in the public domain.

Ransomware attacks often involve a tactic known as double extortion. In these scenarios, attackers do not merely encrypt a company's files to disrupt operations; they also exfiltrate sensitive data. The threat actors then threaten to leak this stolen information on public or private leak sites if a ransom is not paid. This pressure is designed to maximize the impact on the victim by threatening their reputation and legal standing.

Claimed data contents and affected information

The information allegedly stolen from GMORS Co., Ltd is extensive, covering various aspects of both corporate operations and individual privacy. The leak is said to include a diverse array of sensitive files that could impact multiple stakeholders within and outside the organization.

The specific types of data mentioned in the claim include:

• Passport data
• Employee HR data
• Financial documents
• Contracts
• Product technical specifications
• Trade secrets

Beyond these categories, the group claims to have access to VIP and employee profiles, salary and insurance information, non-disclosure agreements (NDAs), 3D models, and business correspondence. The breadth of this alleged data suggests a significant compromise of the company's digital environment.

About GMORS Co., Ltd

GMORS Co., Ltd. is a Taiwan-based manufacturing company specializing in the design and production of high-performance O-rings, seals, and rubber components. The company provides a wide range of sealing solutions for industrial, automotive, and medical applications.

Risk assessment and industry implications

The alleged data leak may pose a high risk of identity theft and targeted phishing for the company's employees and stakeholders. When personal identifiers such as passports and HR data are exposed, individuals become prime targets for sophisticated social engineering attacks designed to exploit their personal information.

At the corporate level, the exposure of patents and trade secrets could harm the company's competitive advantage and lead to long-term financial losses. For manufacturing entities, the loss of intellectual property—such as technical specifications and 3D models—is particularly devastating as it undermines the core value of their industrial innovations.

Furthermore, the company may face legal sanctions under Taiwan's Personal Data Protection Act (PDPA). The presence of data belonging to supply chain partners could also increase the risk of secondary attacks and damage the company's reputation. When a manufacturer is compromised, the breach often extends to its partners, creating a ripple effect throughout the supply chain.

To mitigate such risks, organizations in the manufacturing sector typically focus on robust defensive measures. These include implementing strict access controls to protect intellectual property, maintaining comprehensive logging to detect unauthorized data exfiltration, and conducting regular security awareness training to defend against phishing. Additionally, segmenting networks can help prevent attackers from moving from general corporate systems to sensitive research and development environments.