Central Trenching Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target mid-sized specialist contractors across critical infrastructure supply chains, using data theft and public leak-site pressure as leverage. In late September 2023, the group known as losttrust listed Central Trenching among its claimed victims, adding another North Dakota-based utility and construction services firm to the roster of organisations whose internal files were allegedly taken during a ransomware incident.

Public detail on the event remains limited. What is known comes chiefly from the group's own claim and basic organisational background; the number of people affected, the precise method of intrusion, and the full scope of material involved have not been independently confirmed in available reporting.

What happened

On or around 26 September 2023, Central Trenching was listed by the losttrust ransomware group. According to the claim associated with that listing, internal files were exfiltrated in the course of a ransomware attack. No further verified timeline, entry vector, encryption status, or ransom demand has been publicly detailed. The number of individuals whose information may have been involved is recorded as unknown. Beyond the group's assertion that internal files were taken, concrete operational facts about the incident itself remain undisclosed.

Who is losttrust?

losttrust is a ransomware operation that became active in the public eye during 2023. Like many contemporary groups, it has followed a double-extortion model: encrypting systems where possible while also copying data and threatening to publish it on a dedicated leak site if payment is not made. The group has listed victims across multiple sectors, typically posting sample files or directories to support its claims and applying time pressure. Its listings are public assertions by the actors themselves; they do not constitute independent confirmation that every claimed file set was in fact stolen or that every named organisation suffered the full impact described. In this case, the listing of Central Trenching should be treated as the group's claim rather than as verified forensic fact.

Who is Central Trenching?

Central Trenching, also referred to as CTI in available descriptions, is a North Dakota-based company that specialises in directional boring, trenching, cable and pipe plowing, hydrovacing, hot-shot services, and turn-key fibre-optic installation. It has worked for decades with municipalities, utility companies, corporations, contractors, and homeowners, both locally and across state lines. Organisations of this type sit at the intersection of physical infrastructure and digital project coordination. They routinely handle project plans, customer and municipal contacts, crew and subcontractor records, equipment and site data, and billing or contract documentation. A breach affecting such a firm can therefore touch both commercial operations and the wider utility and communications networks those operations support.

The information in question

The only data category named in connection with the incident is “internal files exfiltrated in a ransomware attack.” No itemised inventory of documents, databases, or personal-data fields has been released in the public record summarised here. Companies engaged in directional boring, trenching, and fibre installation typically maintain project files, customer and municipal contact lists, employee and contractor information, site maps or as-built records, invoices, and operational correspondence. Whether any of those categories were among the material claimed by losttrust is unconfirmed. Exact contents and the volume of data remain undisclosed.

What's at stake

For individuals whose details may appear in internal files—employees, contractors, municipal contacts, or private customers—the practical risks include targeted phishing, social-engineering attempts that reference real projects or locations, and potential misuse of any contact or identity information that was present. For the organisation, exposure of internal files can disrupt ongoing work, complicate relationships with utility and municipal clients, and create longer-term concerns about the confidentiality of project and commercial data. Because the scale of the exfiltration and the precise file types are unknown, the concrete impact on any single person or partner cannot be stated with certainty; the risk is real but currently unquantified.

Were you affected?

If you have worked with, been employed by, or supplied services to Central Trenching, it is reasonable to treat the possibility of exposure seriously even while public detail is sparse. Practical first steps include:

• Monitor financial and email accounts for unexpected activity or tailored phishing that references trenching, fibre, or utility projects.
• Enable multi-factor authentication on important accounts and update passwords that may have been reused in work contexts.
• Retain any notices you receive directly from the company and follow official guidance rather than unsolicited offers of help.
• Consider running a free exposure scan of your email address against known breach datasets to see whether your information has already appeared in circulating collections.

No public confirmation has established how many people, if any, had personal data included in the claimed file set. Staying alert to unusual contact and verifying requests through trusted channels remains the most useful immediate response while further verified information is unavailable.

AICompiled with AI assistance from public sources and published under our editorial standards.