ThreeAM ransomware group lists icgad.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Announcement date: May 25, 2025

ThreeAM claims data breach against Interstate Commercial Glass and Door, Inc.

The ThreeAM ransomware group has listed the domain icgad.com on its leak site, alleging that data associated with the organization has been published. This announcement, made on May 25, 2025, suggests that the organization's digital assets may have been subject to unauthorized access.

Ransomware groups often utilize leak sites as a tool for double extortion. In these scenarios, threat actors not only encrypt an organization's systems to disrupt operations but also steal sensitive information. The group then threatens to publish this data on their public or private platforms if a ransom is not paid. This tactic aims to maximize pressure on the victim by threatening to expose confidential information to the public or competitors.

Details of the alleged leak

According to the information provided by the ThreeAM group, the alleged attack occurred on February 21, 2025. The group has shared a screenshot as evidence of the breach. This screenshot displays a file list that is dated February 21, 2025, with a total reported size of 15.83 MB. Information regarding this specific group remains limited in the public domain.

The content of the leaked data is not fully known. Based on the screenshot shared on the leak site, the directories listed include:

• Home
• Public
• Users
• files.txt

Beyond these directory names and a single file named "files.txt", there is no detailed information available regarding the specific content of the data. No information was provided regarding the specific ransom demand or the total file count.

About Interstate Commercial Glass and Door, Inc.

Interstate Commercial Glass and Door, Inc. is a glass and glazing subcontractor. The company operates primarily in the Northwest Ohio and Southeast Michigan regions. They specialize in providing services for new construction and renovation projects, specifically focusing on sectors such as schools, hospitals, and office buildings.

Potential risks and organizational impact

The incident highlights the ongoing risks faced by organizations in the construction and subcontracting sectors. If the leaked data contains employee or customer information, it could pose a risk for identity theft or targeted phishing attacks. Furthermore, the leaked information could potentially be used by other threat actors, and the organization may face damage to its commercial reputation.

From a regulatory perspective, the organization may face notification obligations under state laws and data protection regulations in the US region where it operates. When such breaches occur, organizations typically face significant pressure to manage both the technical recovery and the legal implications of the data exposure.

To defend against such threats, organizations often implement various defensive measures. These include maintaining robust backup systems to ensure data availability, implementing multi-factor authentication to secure access to directories like "Users" or "Home," and conducting regular security awareness training to prevent initial access via phishing. Additionally, monitoring network traffic for unauthorized access to sensitive directories is a common practice to detect potential exfiltration before data is published on a leak site.