California Gasket and Rubber Corporation Listed by frag Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized manufacturers in critical supply chains, including aviation and aerospace component makers, where operational disruption and data exposure can ripple beyond a single firm. In this environment, leak-site postings by groups such as frag have become a common way for attackers to pressure victims and signal that internal material has been taken.

On February 28, 2025, California Gasket and Rubber Corporation was listed by the frag ransomware group. Public reporting describes the incident as involving internal files exfiltrated in a ransomware attack. The number of people affected remains unknown, and independent confirmation of the full scope is limited. The listing itself is a claim by the group; what follows is based only on that claim and the limited public facts.

What happened

According to the reported summary, California Gasket and Rubber Corporation, an aviation and aerospace component manufacturer, was listed by the frag ransomware group on February 28, 2025. The group asserts that it conducted a ransomware attack in which internal files were exfiltrated. No public detail has been provided on the precise method of initial access, the duration of any intrusion, whether systems were encrypted, or any ransom demand. The scale of the incident—how many systems or individuals were involved—is undisclosed. Available information is limited to the group’s leak-site listing and the accompanying description of materials it claims to have taken.

Who is frag?

Frag is a ransomware group that operates in the now-familiar double-extortion model used by many such actors: data is stolen, systems may be locked, and the victim is threatened with public release of the material unless payment is made. Groups of this type typically maintain leak sites where they name organizations and, in some cases, post samples or full archives to demonstrate possession of the data. Their tactics commonly include phishing, exploitation of exposed remote services, or abuse of compromised credentials, followed by lateral movement and bulk data collection. Prior activity by frag and similar groups has focused on a range of commercial and industrial targets rather than a single sector. In this case, the group’s listing of California Gasket and Rubber Corporation is an unverified claim; no independent confirmation that the group holds the described material has been publicly established beyond the listing itself.

About California Gasket and Rubber Corporation

California Gasket and Rubber Corporation (CGR) was established in 1942. It operates two manufacturing divisions—Gasket and Rubber—within a 50,000-square-foot facility. The company produces components used in aviation and aerospace applications, placing it inside a regulated, quality-sensitive supply chain. Organizations of this type typically maintain engineering drawings, quality and compliance records, customer and supplier contracts, employee records, and financial data needed for production and certification. A breach at such a firm is consequential because it can expose both commercial relationships and personal information of employees and contacts, and because aerospace supply-chain partners often require high standards of data protection and continuity. Public detail on how the company has responded remains limited.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. The frag group claims to have extracted specific categories of material. Exact contents and whether every claimed item is authentic have not been independently verified. Organizations in manufacturing and aerospace commonly hold personnel files, customer contact lists, contracts, and financial records; the group’s listing asserts that such material, plus identity documents, was taken. The concrete points the group claims are as follows:

• Corporate internal documents and agreements
• HR documents
• Contact details of customers and employees
• Financial statements of the company
• Personnel documents with information on employees
• Passport scans

No confirmed count of affected individuals or files has been published. Readers should treat the list as the group’s claim rather than as established fact until further verification appears.

What's at stake

For individuals whose details may appear in the claimed material, risks include targeted phishing, identity fraud, and misuse of passport or personnel data. Contact details of customers and employees can be used to craft convincing social-engineering messages. Financial statements and internal agreements, if genuine, could reveal commercial terms or operational details useful to competitors or further attackers. For the organization, exposure of such material can damage trust with aerospace customers, raise compliance and contractual questions, and create ongoing operational and legal costs. Because the number of people affected is unknown and the full contents unconfirmed, the precise impact cannot yet be measured. The absence of public confirmation does not eliminate the need for caution among those who have had dealings with the company.

If your data was in this claimed breach

If you are a current or former employee, customer, or contact of California Gasket and Rubber Corporation, treat the possibility of exposure seriously even though the scale remains unknown. Monitor financial and credit activity for unusual requests or accounts. Be alert to unexpected messages that reference the company or that ask for credentials or payments. Consider placing fraud alerts with credit bureaus and reviewing any accounts that use the same email or personal details associated with the firm. Change passwords on work-related and personal accounts if they may have been reused, and enable multi-factor authentication where available. Because passport scans are among the items the group claims, watch for identity-related misuse and report any suspected fraud promptly to the relevant authorities. Readers can also run a free exposure scan of their email address to check whether their information has already appeared in known breach data sets. Public detail on this incident is limited; further official statements from the company or regulators, if they appear, should be followed for the most accurate guidance.

AICompiled with AI assistance from public sources and published under our editorial standards.