Inc Ransom ransomware group lists steelworksinc.ca on its leak site

• Ransomware group: Inc Ransom
• Country: Canada
• Sector: Manufacturing
• Announcement date: December 15, 2025

Inc Ransom claims data breach against Steel Works Inc.

The threat actor known as Inc Ransom has listed the Canadian organization Steel Works Inc. on its dedicated leak site. This announcement, made on December 15, 2025, follows an alleged attack that the group claims occurred on November 29, 2025. The listing constitutes an allegation of a data breach by the ransomware group, though the organization has not been confirmed to have been compromised.

Ransomware leak sites are platforms used by cybercriminal groups to exert pressure on their victims. These sites often serve as a public gallery for the groups' targets, where they post names of organizations and, in some cases, samples of stolen information. The primary goal of such listings is to damage the reputation of the target and coerce them into paying a ransom to prevent the full release of sensitive data.

Details of the alleged incident

According to the announcement posted by Inc Ransom, the group claims to have compromised data belonging to Steel Works Inc. The information currently available in the leak announcement is limited to general descriptive text regarding the company's operations and contact information. The threat actor has not provided specific details regarding the nature of the breach or the specific files involved.

The listing names no specific data types or individual files that have been allegedly exfiltrated.

The organization's profile

Steel Works Inc. is a company based in Canada that specializes in the fabrication of structural steel. Their operations include the installation and production of custom-built steel components designed for various industrial and commercial projects. The company's service portfolio is diverse, providing crane design, specialized fabrication, and surface treatment services. They primarily serve industrial facilities and the mining sector through these specialized manufacturing capabilities.

Implications and potential risks

This incident may have negative implications for the organization's operational continuity and commercial reputation. Because the company operates within Canada, there is a possibility that data protection obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA) may have been compromised. The use of double extortion tactics by Inc Ransom—where attackers both encrypt systems and threaten to publish stolen data—is a method designed to maximize pressure on the victim.

The potential consequences of such a breach extend beyond the organization itself. Employees and clients of the company could be at risk of targeted phishing attacks or identity theft attempts due to this alleged breach. When personal or corporate data is leaked, attackers often use it to craft highly convincing social engineering campaigns to target individuals within the supply chain or the company's customer base.

For organizations operating in the manufacturing and industrial sectors, maintaining robust cybersecurity posture is critical for operational continuity. Common defensive steps for organizations include implementing multi-factor authentication, maintaining regular offline backups, and conducting regular security awareness training for employees to recognize phishing attempts. Furthermore, ensuring compliance with regional data protection regulations is essential for managing legal and reputational risks following a potential security incident.