Cullum Services Listed by losttrust Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to single out mid-sized industrial and construction firms, treating operational data and internal records as leverage in double-extortion schemes. In this climate, the appearance of a long-established South Carolina mechanical-services company on a criminal leak site is a familiar but still serious development.

On September 26, 2023, Cullum Services was listed by the ransomware group losttrust. Public reporting states that internal files were exfiltrated in a ransomware attack. The number of people affected remains unknown, and many operational details have not been disclosed. For employees, partners and anyone whose information may sit inside those files, the listing is a clear signal to treat the incident as real until proven otherwise.

Breaking down the breach

According to available public information, Cullum Services appeared on losttrust’s leak site on or about September 26, 2023. The sole concrete claim attached to the listing is that internal files were taken during a ransomware attack. No confirmed figure for the volume of data, no list of specific file categories beyond the general description “internal files,” and no public timeline of when the intrusion began or how long the attackers remained inside the network have been released. The number of individuals whose personal or work-related information may be involved is likewise unknown. In short, the incident is documented only at the level of a ransomware group’s claim of exfiltration; independent verification of scope and method has not been made public.

The group behind it: losttrust

losttrust is a ransomware operation that follows the now-standard double-extortion model: encrypt systems to disrupt business and simultaneously steal data so that the threat of public release can be used as additional pressure. Like other groups in this category, it maintains a leak site where it posts victim names and, in some cases, sample files to demonstrate possession of the data. The group’s listings are claims, not independently audited disclosures. In the case of Cullum Services, losttrust asserts that internal files were exfiltrated; that assertion has not been corroborated by a detailed victim statement or regulatory filing that would confirm the full contents or the success of any ransom negotiation. Public knowledge of losttrust’s broader activity shows a pattern of targeting organizations across multiple sectors rather than a narrow industry focus, but no further specifics about this particular intrusion have been released by the group beyond the listing itself.

About Cullum Services

Cullum Services, Inc. has supplied mechanical maintenance, repair and retrofit services in South Carolina since 1972. It maintains offices in North Charleston, Columbia, Florence and Greenville and operates more than 90,000 square feet of sheet-metal and pipe-fabrication shops. The company is a subsidiary of Cullum Mechanical Construction, Inc., and a sister company of Cullum Constructors, Inc. Firms of this type routinely hold employee records, contractor and vendor information, project documentation, facility diagrams, inventory data and internal correspondence. Because the work often involves critical building systems and industrial sites, a compromise can affect not only the company’s own workforce but also the continuity of services provided to clients across the state.

The information in question

The only data description supplied in public reporting is “internal files exfiltrated in a ransomware attack.” No itemized inventory of those files—whether they contain payroll details, Social Security numbers, customer contracts, engineering drawings or other categories—has been released. Organizations engaged in mechanical construction and maintenance typically store personnel files, benefits information, bid and contract documents, supplier records and operational schematics. Until Cullum Services or a regulator publishes a precise accounting, the exact contents remain unconfirmed. Readers should therefore assume that any sensitive material customarily held by a company of this profile could be among the taken files, while recognizing that this remains an assumption rather than an established fact.

The real-world impact

For individuals, the primary risks are identity theft, targeted phishing and unauthorized use of personal or financial details if such data were present in the exfiltrated files. Employees and contractors may face fraudulent tax filings, account takeovers or social-engineering attempts that reference internal project or payroll information. For the organization, the consequences include potential operational disruption from the ransomware encryption itself, reputational harm, possible contractual or regulatory notification obligations, and the cost of investigation and remediation. Because the scale of the breach is undisclosed, the full extent of these risks cannot yet be quantified; the prudent stance is to treat exposure as possible until clearer information emerges.

What to do if you're exposed

If you have a past or present connection to Cullum Services—as an employee, contractor, vendor or client—begin by monitoring financial accounts and credit reports for unfamiliar activity. Place a fraud alert or credit freeze with the major credit bureaus if you believe personal identifiers may have been involved. Be alert to phishing messages that reference the company or its projects; verify any unexpected request through a known, separate channel. Change passwords on work-related and personal accounts that may have shared credentials, and enable multi-factor authentication wherever it is offered. Finally, you can run a free exposure scan of your email address to check whether it has already appeared in known breach data sets; doing so provides an early indication of whether your information is circulating beyond this single incident.

AICompiled with AI assistance from public sources and published under our editorial standards.