Xiamen Tungsten Co. targeted by beast ransomware group

• Ransomware group: beast
• Country: China
• Sector: Manufacturing
• Announcement date: March 31, 2026

The threat actor group known as beast has listed Xiamen Tungsten Co. (XTC) on its leak site, claiming to have exfiltrated a significant volume of corporate data. According to the announcement made on March 31, 2026, the group alleges they have successfully compromised the organization's infrastructure and are now offering the stolen information for sale.

Details of the alleged attack

The beast group claims to have obtained over 160GB of SQL backup files, which they assert belong to Xiamen Tungsten Co. (XTC). The threat actor has stated that this dataset represents a full compromise of the company's infrastructure. Rather than just encrypting files, the group is employing a double extortion tactic, where they threaten to leak sensitive information unless a ransom is paid. In this instance, the group has set a ransom demand of 20 BTC to prevent the public release of the data.

The announcement alleges that the stolen information is highly sensitive and covers various critical business functions. This includes documentation from ERP systems, human resources records, manufacturing processes, and even internal board meeting documentation. The scale of the claimed data suggests a deep intrusion into the company's digital environment.

Alleged data contents and affected information

The data allegedly leaked by the beast group is reported to include a wide variety of corporate and personal information. This includes ERP (Dynamics AX) systems, employee personally identifiable information (PII) and payroll records, LIMS laboratory information, manufacturing formulas, geological surveys, supply chain management (SCM) data, and internal board meeting minutes.

Based on the group's claims, the following types of data have been affected:

• Employee HR data
• Payroll records
• Manufacturing formulas
• Financial reports
• Supply chain data
• User credentials

About Xiamen Tungsten Co. (XTC)

Xiamen Tungsten Co., Ltd. (XTC) is a China-based industrial corporation specializing in the production of tungsten products, molybdenum, energy storage materials, and rare earth elements. The company operates globally, focusing on the processing of tungsten-based materials and advanced metallurgy.

Security implications and organizational risks

This alleged breach may pose significant risks to Xiamen Tungsten Co. regarding operational continuity and intellectual property security. The exposure of manufacturing formulas and strategic business plans could potentially damage the company's competitive advantage. Furthermore, the compromise of employee PII may create a foundation for identity theft and targeted phishing attacks against the workforce.

The alleged exfiltration of SSO credentials is particularly concerning, as it suggests that the organization's network security may have been thoroughly compromised, potentially allowing attackers to maintain access or move laterally through the network. While information about the beast group remains limited, the ransom demand and the volume of data suggest that the attack is likely financially motivated.

For organizations in the manufacturing and industrial sectors, such incidents highlight the importance of robust security measures. Common defensive steps include implementing multi-factor authentication (MFA) to protect against credential theft, maintaining offline or immutable backups to mitigate the impact of ransomware, and conducting regular audits of access controls. Protecting intellectual property, such as manufacturing formulas and strategic plans, requires strict data loss prevention (DLP) strategies and network segmentation to ensure that critical industrial control systems and sensitive databases are isolated from general business networks.