Cooper Steel Fabricators, a prominent U.S.-based structural steel fabricator serving high-profile clients like Amazon, suffered a significant data breach. A threat actor claimed to have exfiltrated a complete mirror of the company’s FTP server (330 GB), including proprietary 3D models, engineering drawings, and structural specifications for critical projects. Among the compromised data were hyperscale data center designs for Amazon’s Ohio facility, structural details for Publix Greensboro Refrigerated Distribution Center, and blueprints for Walmart distribution centers, cold storage facilities, and a Massachusetts-based Amazon sorting hub.The attacker demanded $28,500 in cryptocurrency for the stolen data, which includes sensitive intellectual property (IP) vital to Cooper Steel’s operations and client trust. The breach exposes not only the company’s internal project documentation but also confidential client infrastructure details, risking competitive disadvantage, reputational harm, and potential legal liabilities. As of now, Cooper Steel has not publicly acknowledged the breach, leaving the extent of operational or financial fallout uncertain. The incident underscores vulnerabilities in supply chain security, particularly for firms handling critical infrastructure designs for tech and logistics giants.
Source: https://www.scworld.com/brief/copper-steel-fabricators-allegedly-subjected-to-data-breach
Cooper Steel cybersecurity rating report: https://www.rankiteo.com/company/cooper-steel-usa
"id": "COO11101911112525",
"linkid": "cooper-steel-usa",
"type": "Breach",
"date": "11/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': ['Amazon (Ohio data center, '
'Massachusetts sorting '
'facility)',
'Publix (Greensboro '
'Refrigerated Distribution '
'Center)',
'Walmart (distribution centers, '
'cold storage facilities)'],
'industry': 'structural steel fabrication',
'location': 'United States',
'name': 'Cooper Steel Fabricators',
'type': 'private company'},
{'industry': 'e-commerce/cloud services',
'location': 'United States',
'name': 'Amazon',
'type': 'corporation (client of Cooper Steel)'},
{'industry': 'retail/grocery',
'location': 'United States (Greensboro, NC)',
'name': 'Publix',
'type': 'corporation (client of Cooper Steel)'},
{'industry': 'retail',
'location': 'United States',
'name': 'Walmart',
'type': 'corporation (client of Cooper Steel)'}],
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['CAD files',
'PDFs',
'project documents',
'FTP server files'],
'sensitivity_of_data': 'high (proprietary client project '
'details, hyperscale data center '
'specifications)',
'type_of_data_compromised': ['proprietary engineering data',
'3D models',
'drawings',
'structural specifications',
'project documentation']},
'description': 'Cooper Steel Fabricators, a U.S.-based structural steel '
'fabricator serving clients like Amazon, was allegedly '
"breached by a threat actor. The actor offered a 'complete "
"mirror' of the company's FTP server (330 GB of data) for "
'$28,500 in cryptocurrency. The leaked data reportedly '
'includes 3D models, drawings, and structural specifications '
"for high-profile projects such as Amazon's Ohio data center "
'(hyperscale operations), Publix Greensboro Refrigerated '
'Distribution Center, Walmart distribution centers, cold '
'storage facilities, and a Massachusetts-based Amazon sorting '
'facility. Cooper Steel has not yet acknowledged the breach '
'claims.',
'impact': {'brand_reputation_impact': 'potential (unconfirmed; breach claims '
'unacknowledged)',
'data_compromised': ['3D models',
'drawings',
'frames',
'structural specifications (e.g., hyperscale '
'data center operations)',
'project data for Publix Greensboro '
'Refrigerated Distribution Center',
'Amazon Ohio data center details',
'Massachusetts-based Amazon sorting facility '
'data',
'Walmart distribution center data',
'cold storage facility data'],
'systems_affected': ['FTP server']},
'initial_access_broker': {'data_sold_on_dark_web': True,
'high_value_targets': ['Amazon hyperscale data '
'center specifications',
'Publix distribution center '
'designs',
'Walmart infrastructure '
'data']},
'investigation_status': 'unconfirmed (Cooper Steel has not acknowledged the '
'breach)',
'motivation': ['financial gain', 'data sale'],
'ransomware': {'data_exfiltration': True,
'ransom_demanded': '$28,500 (in cryptocurrency)'},
'references': [{'source': 'Cybernews'}],
'threat_actor': {'motivation': ['financial gain', 'data monetization'],
'type': 'cybercriminal (extortionist)'},
'title': 'Cooper Steel Fabricators Data Breach and FTP Server Leak',
'type': ['data breach', 'data exfiltration', 'extortion']}