Pritchard Brown & Chillicothe Metal listed on interlock ransomware leak site

• Ransomware group: interlock
• Country: United States
• Sector: Manufacturing
• Announcement date: October 29, 2025

Pritchard Brown and Chillicothe Metal targeted by interlock ransomware group

The threat actor known as interlock has listed data allegedly belonging to Pritchard Brown and Chillicothe Metal on its leak site. The announcement, made on October 29, 2025, claims that the group has successfully compromised the organizations and has made the stolen files available for public access. This type of activity is characteristic of modern ransomware operations, where attackers often employ double extortion tactics. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also exfiltrate sensitive data to pressure the victim into paying a ransom by threatening to leak the information publicly.

Details of the claimed attack

According to the announcement posted on the interlock leak site, the group claims to have accessed the local network structures of the targeted entities. The threat actor asserts that the breach involves a significant volume of information, totaling approximately 2.8 TB of data. This massive amount of data suggests a deep penetration into the internal networks of the organizations involved.

The group's claim is supported by a screenshot that displays two primary directory structures. These directories appear to correspond to the internal network environments of the companies: one labeled 'cmcousa.local' containing 1.5 TB of data, and another labeled 'PRITCHARDBROWN.local' containing 1.3 TB of data. While the volume of the data is clearly stated, the listing provides no specific details regarding the exact nature or the specific types of files contained within these directories.

Organization profile

Pritchard Brown and Chillicothe Metal Company are two manufacturing firms specializing in protective enclosures and microclimate control systems. They provide custom-designed solutions for various industries, including energy, utilities, petrochemical, mining, and defense. Given their specialized role in providing critical components for high-stakes sectors like defense and energy, the integrity of their data is vital to their operations.

Potential impact and industry risks

This incident may negatively impact the organization's operational continuity and commercial reputation. Given the volume of the allegedly leaked data, the company's intellectual property or sensitive business information could be at risk. As a US-based entity, legal processes may be triggered under relevant state laws and federal data protection regulations. Secondary risks may include the potential use of the leaked data in identity theft or targeted phishing campaigns.

For organizations operating in the manufacturing sector, especially those providing specialized solutions for critical infrastructure, such incidents highlight the importance of robust cybersecurity postures. Common defensive steps for organizations include implementing multi-factor authentication, maintaining offline backups, and conducting regular network segmentation to prevent lateral movement by attackers. Furthermore, monitoring for unusual data exfiltration patterns can help detect an intrusion before large volumes of data are moved off-site. Information about the interlock group remains limited in the public domain, making it difficult to attribute the attack or predict the group's specific motivations beyond their public claims.