ThreeAM ransomware group lists newmantractor.com on its leak site

• Ransomware group: ThreeAM
• Country: United States
• Sector: Manufacturing
• Announcement date: September 21, 2026

The ThreeAM ransomware group has claimed responsibility for a data breach involving Newman Tractor. On September 21, 2026, the threat actor listed the organization on its dedicated leak site, alleging that they have successfully exfiltrated and published data belonging to the company.

Details of the ThreeAM claim

According to the announcement made by the ThreeAM group, the organization was targeted and its data was made public on September 21, 2026. The threat actor provided a list of directory names that allegedly belong to the organization's infrastructure. While the group has published this information, public information regarding the specific activities and capabilities of the ThreeAM group remains limited.

The announcement serves as a public disclosure by the threat actor, a common practice in modern cyber extortion. In these scenarios, the attackers use leak sites to pressure victims by demonstrating that they have successfully breached the perimeter and obtained sensitive information. This specific incident involves a claim of a data leak rather than a simple encryption event, indicating a focus on information theft.

Data and directory information

The information provided by the threat actor includes screenshots of various directory names found within the breached environment. These directories suggest the presence of several types of data, though the full scope and specific content of the leaked material have not been detailed by the group. The identified directory names include:

• Customer Files
• Dropbox
• staging
• corpus

While these directory names provide a glimpse into the types of folders present on the systems, there is no detailed information regarding the full scope or specific content of the leaked data. No information was provided regarding the total size of the data or the specific number of files involved in the breach.

About Newman Tractor

Newman Tractor is an organization operating within the manufacturing sector. Founded in 1976, the company serves the heavy equipment industry on both a domestic and international scale. Originally established as a business focused on farm equipment, the company has evolved to provide a comprehensive range of services, including heavy equipment sales, rentals, and service provisions.

Risk assessment and industry implications

This leak claim may create secondary risks for the organization's customers and business partners. The presence of potential customer information could lead to targeted phishing attacks or identity theft attempts. Because the threat actor has published the data, this incident may be considered part of a double extortion tactic, where attackers not only encrypt data but also threaten to release it to maximize leverage.

As a United States-based organization, the company may face data breach notification obligations under relevant state laws and federal regulations. Beyond legal compliance, the organization may observe negative impacts on its operational continuity and corporate reputation due to the public nature of the claim.

For organizations in the manufacturing and heavy equipment sectors, such incidents highlight the importance of robust data protection strategies. Common defensive steps for organizations include implementing strict access controls, maintaining offline backups, and monitoring for unauthorized data exfiltration. Protecting customer-facing directories and cloud storage integrations is essential to preventing the secondary risks of phishing and identity theft that follow a data leak.