McKay listed on mnt6 ransomware leak site

• Ransomware group: mnt6
• Country: New Zealand
• Sector: Manufacturing
• Announcement date: April 30, 2026

McKay targeted by mnt6 ransomware group

The mnt6 ransomware group has officially listed the New Zealand-based engineering firm McKay on its leak site. According to the announcement made on April 30, 2026, the threat actors claim to have successfully exfiltrated data belonging to the organization. The group asserts that the breach occurred on the same day the announcement was published, marking a significant security incident for the firm.

Claims of network vulnerabilities and data theft

The mnt6 group alleges that the breach was made possible due to significant vulnerabilities within McKay's network security. Specifically, the threat actors claim that the organization relied on outdated operating systems and maintained weak password policies. To support their claims, the group provided screenshots alleging that the company's network utilized the outdated Windows Vista operating system. Furthermore, the attackers claim that the company employed extremely weak passwords, such as 'qwerty', which facilitated their unauthorized access.

The group asserts that the scope of the compromise is extensive, claiming that all company files have been compromised. This alleged theft includes highly sensitive documentation related to critical infrastructure projects. The attackers claim that the stolen information encompasses details regarding government projects and prison infrastructure, suggesting a high level of sensitivity regarding the breached data.

Affected data types

• Government project documents
• Prison infrastructure projects
• Corporate network data

About McKay

McKay is a New Zealand-based engineering firm that operates within several high-stakes industries. The company provides critical services in the national defense, high-tech shipbuilding, and global energy sectors. Additionally, McKay specializes in providing automation systems and sustainable energy solutions designed for critical infrastructure.

Analysis and implications for critical sectors

This incident highlights the significant data exposure risks faced by organizations operating within the critical infrastructure and defense sectors. The alleged leak of data related to government and prison infrastructure projects could potentially pose secondary risks to national security. Because McKay operates within New Zealand, the organization may face requirements regarding compliance with relevant data protection regulations and could face potential legal consequences following the breach.

While information regarding the mnt6 group remains limited, the nature of the attack suggests a high level of intent. Ransomware actors frequently employ double extortion tactics, a method where they not only encrypt an organization's data but also threaten to leak sensitive information on public forums to increase pressure for payment. In such scenarios, the leaked data can be utilized for various malicious purposes, including targeted phishing campaigns or corporate espionage.

For organizations operating in similar sectors, this event underscores the importance of maintaining robust cybersecurity hygiene. Protecting against such threats typically involves implementing strict password policies, ensuring all operating systems are current and supported, and maintaining rigorous network monitoring to detect unauthorized access. As critical infrastructure providers become increasingly targeted, the intersection of physical engineering and digital security remains a primary area of concern for national security and corporate stability.