abcor.com.au Listed by threeam Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On 22 February 2024, the Australian engineering firm abcor.com.au appeared on a listing published by the ransomware group known as threeam. Public reporting states that internal files were exfiltrated in a ransomware attack affecting Preston General Engineering, a division of ABCOR Pty Ltd. The number of people affected remains unknown, and further operational details have not been disclosed.

The listing itself is a claim by the group rather than independent confirmation of every asserted detail. For individuals and organisations connected to the company, the episode raises questions about what internal material may have left its systems and what practical steps follow.

Inside the incident

According to the available record, abcor.com.au was listed by threeam on 22 February 2024. The reported summary identifies Preston General Engineering (PGE), a division of ABCOR Pty Ltd, as the entity involved. Public detail characterises the event as a ransomware attack in which internal files were allegedly exfiltrated. No confirmed figures have been released for the volume of data taken, the precise date of initial access, the encryption status of systems, or any ransom demand. The number of people potentially affected is listed as unknown. Method of intrusion, dwell time, and any subsequent recovery actions by the organisation are likewise undisclosed in the public facts.

What is established is limited to the leak-site listing and the description of internal-file exfiltration. Beyond that, the record does not supply timelines, technical indicators, or verified statements from the company confirming the full scope.

The group behind it: threeam

threeam is a ransomware operation that has been active in the public threat landscape since approximately 2023. Like many contemporary groups, it is known for double-extortion tactics: encrypting systems while also claiming to steal data and threatening to publish it on a dedicated leak site if payment is not made. The group typically posts victim names, sometimes with sample files or descriptions of stolen material, as a means of applying pressure. Prior activity attributed to threeam has involved a range of sectors and geographies, consistent with opportunistic targeting rather than a narrow industry focus.

In this case the group claims that abcor.com.au / Preston General Engineering was compromised and that internal files were taken. No additional claims specific to this victim—such as particular file counts, financial demands, or screenshots—are contained in the provided facts, so none are asserted here. Listings of this kind remain claims until corroborated by the victim organisation or independent forensic reporting.

abcor.com.au and its sector

abcor.com.au is the online presence of ABCOR Pty Ltd, whose Preston General Engineering division is described as an industry leader in the fabrication and assembly of metal, aluminium and stainless-steel parts. The company operates in the Australian manufacturing and precision-engineering sector, supplying components that support industrial, construction and related supply chains. Organisations of this type typically maintain design drawings, production schedules, supplier and customer records, quality-control documentation, and internal administrative files.

A breach involving such a firm is consequential because manufacturing data can include proprietary process information, contractual details and contact records of business partners and staff. Even when the exact contents remain unconfirmed, the sector’s reliance on both physical production continuity and digital records means disruption or exposure can affect operations, commercial relationships and the individuals whose information appears in those records.

The information in question

The facts state only that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as employee records, customer lists, financial documents or intellectual property—is provided. Public detail is therefore limited to the generic category of “internal files.”

Companies engaged in metal fabrication and engineering commonly hold engineering drawings, bills of materials, purchase orders, employee contact and payroll information, and correspondence with clients and suppliers. Whether any of those categories were among the material claimed by threeam has not been confirmed. Exact contents remain unconfirmed; readers should treat any more specific assertions as unverified until additional authoritative information appears.

What's at stake

For individuals whose details may reside in the organisation’s systems, the primary risks are identity-related misuse, targeted phishing that references genuine business relationships, and potential exposure of personal contact or employment information. Because the scale is unknown, it is not possible to quantify how many people fall into this category.

For the organisation itself, stakes include operational interruption if systems were encrypted, reputational damage from the public listing, possible regulatory notification obligations under Australian privacy law, and the commercial sensitivity of any proprietary fabrication data that may have left the network. None of these outcomes is established as having already materialised; they represent the concrete possibilities that follow from a claimed ransomware incident involving internal files.

If your data was in this claimed breach

If you have a past or present connection to ABCOR Pty Ltd or Preston General Engineering—whether as an employee, contractor, supplier or customer—treat the possibility of exposure seriously even while exact contents remain unconfirmed. Change passwords on any accounts that reused credentials linked to work email, enable multi-factor authentication where available, and monitor financial and email accounts for unusual activity. Be cautious of unsolicited messages that reference the company or the incident, as threat actors sometimes use stolen data for follow-on social engineering.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach datasets. That step provides an immediate, practical indicator of wider exposure and helps prioritise further protective measures while official details continue to emerge.

AICompiled with AI assistance from public sources and published under our editorial standards.