Steel Warehouse Co. LLC Hit by Cactus Ransomware Attack, Exposing 679GB of Sensitive Data
Steel Warehouse Co. LLC, a family-owned steel processor and distributor based in South Bend, Indiana, disclosed a significant data breach linked to the Cactus ransomware group. The attackers claimed responsibility on February 24, 2025, alleging they exfiltrated 679 GB of data, including personal identifiable information (PII), corporate records, customer details, financial documents, employee and executive data, and internal correspondence.
The breach was officially reported to the Vermont Attorney General on April 30, 2026, though the total number of affected individuals remains undisclosed. Confirmed exposed data includes Social Security numbers, heightening risks of identity theft and fraud.
Steel Warehouse has begun notifying impacted individuals but has not confirmed whether it will provide free credit monitoring or identity theft protection services. The company has directed inquiries to its support lines (800-348-2529 or 574-236-5100).
The incident underscores the ongoing threat of ransomware attacks targeting industrial and supply chain sectors, with attackers increasingly leveraging stolen data for extortion.
Source: https://www.claimdepot.com/data-breach/steel-warehouse-2026
Tata Steel Nederland cybersecurity rating report: https://www.rankiteo.com/company/tata-steel-nederland
"id": "TAT1777667117",
"linkid": "tata-steel-nederland",
"type": "Ransomware",
"date": "2/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Steel Processing and Distribution',
'location': 'South Bend, Indiana, USA',
'name': 'Steel Warehouse Co. LLC',
'type': 'Company'}],
'customer_advisories': 'Notifying impacted individuals; directed inquiries to '
'support lines (800-348-2529 or 574-236-5100). Free '
'credit monitoring or identity theft protection '
'services not confirmed.',
'data_breach': {'data_exfiltration': 'Yes',
'personally_identifiable_information': ['Social Security '
'numbers'],
'sensitivity_of_data': 'High',
'type_of_data_compromised': ['Personal Identifiable '
'Information (PII)',
'Corporate records',
'Customer details',
'Financial documents',
'Employee and executive data',
'Internal correspondence']},
'date_publicly_disclosed': '2025-02-24',
'description': 'Steel Warehouse Co. LLC, a family-owned steel processor and '
'distributor based in South Bend, Indiana, disclosed a '
'significant data breach linked to the Cactus ransomware '
'group. The attackers claimed responsibility on February 24, '
'2025, alleging they exfiltrated 679 GB of data, including '
'personal identifiable information (PII), corporate records, '
'customer details, financial documents, employee and executive '
'data, and internal correspondence. The breach was officially '
'reported to the Vermont Attorney General on April 30, 2026, '
'though the total number of affected individuals remains '
'undisclosed. Confirmed exposed data includes Social Security '
'numbers, heightening risks of identity theft and fraud.',
'impact': {'data_compromised': '679 GB', 'identity_theft_risk': 'High'},
'motivation': 'Extortion',
'ransomware': {'data_exfiltration': 'Yes', 'ransomware_strain': 'Cactus'},
'references': [{'source': 'Vermont Attorney General'}],
'regulatory_compliance': {'regulatory_notifications': ['Reported to Vermont '
'Attorney General on '
'April 30, 2026']},
'response': {'communication_strategy': 'Notifying impacted individuals; '
'directed inquiries to support lines '
'(800-348-2529 or 574-236-5100)'},
'threat_actor': 'Cactus ransomware group',
'title': 'Steel Warehouse Co. LLC Hit by Cactus Ransomware Attack',
'type': 'Ransomware'}