Richmond Plywood Corporation Limited targeted by secp0 ransomware group

• Ransomware group: secp0
• Country: Canada
• Sector: Manufacturing
• Announcement date: April 14, 2026

secp0 claims data breach at Richmond Plywood Corporation Limited

The threat actor group known as secp0 has announced on its leak site that it has compromised data belonging to Richmond Plywood Corporation Limited. According to the announcement made on April 14, 2026, the group claims to have exfiltrated a significant volume of information from the organization.

The claim made by secp0 involves a massive dataset that allegedly consists of 522,925 files. The total size of the data claimed to be stolen is approximately 1.09TB. While the group has published this information on their leak site, public information regarding the specific identity and operations of the secp0 group remains limited.

Details of the alleged data exfiltration

The threat actor has provided specific details regarding the nature of the stolen information. The group claims that the exfiltrated dataset contains various types of sensitive information that could be used for malicious purposes. The alleged data includes:

• Confidential business information
• Financial information
• Client data
• Confidential health information

The categorization of these data types by the threat actor suggests that the information may have been analyzed in depth during the attack, which may indicate a targeted exfiltration attempt rather than a random automated process.

About Richmond Plywood Corporation Limited

Richmond Plywood Corporation Limited is a manufacturing company based in British Columbia, Canada. The organization specializes in the production of plywood and wood products.

Analysis and potential impact

The nature of the allegedly leaked data may pose secondary risks such as identity theft or targeted phishing attacks for the organization's employees and clients. Because the stolen information includes confidential business, financial, and client data, the organization may face significant operational and reputational challenges.

Furthermore, the presence of leaked health records may prompt scrutiny of the organization's sensitive personal data protection processes. Given that the organization is based in Canada, the incident may lead to legal consequences regarding data privacy obligations under the Personal Information Protection and Electronic Documents Act (PIPEDA). The organization may be required to fulfill data breach notification obligations and inform the affected parties.

In general, ransomware attacks involving data exfiltration often follow a double extortion model. In this scenario, threat actors do not just encrypt an organization's systems to disrupt operations, but they also steal sensitive data to use as leverage. By threatening to release confidential information on a public leak site, the attackers attempt to pressure the victim into paying a ransom to prevent the disclosure of sensitive files.

For organizations in the manufacturing sector, such incidents highlight the importance of robust cybersecurity frameworks. Common defensive steps for organizations include implementing strict access controls, maintaining regular offline backups, and conducting regular security awareness training for employees to prevent initial access through phishing. Additionally, monitoring for unusual data egress can help detect exfiltration attempts before large volumes of data are moved off the network.