J.T. Cullen Co., Inc. Listed by 8base Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure mid-sized industrial firms by stealing internal files and threatening public release, a pattern that has become a routine feature of the current threat landscape. In late September 2023, the group known as 8base listed J.T. Cullen Co., Inc. among its claimed victims, drawing attention to a custom metal fabricator whose work supports power, steel, architectural, and rail customers.

Public detail on the incident remains limited. What is known is that the company appeared on the group’s leak site with a claim that internal files had been exfiltrated in a ransomware attack. The number of people affected has not been disclosed, and independent confirmation of the full scope is not available in the public record.

What happened

On or around September 25, 2023, J.T. Cullen Co., Inc. was reported as listed by the 8base ransomware group. According to the available summary, the group claimed that internal files were exfiltrated during a ransomware attack. No public figure has been given for the volume of data, the precise date of initial access, or the technical method used. The number of individuals whose information may have been involved is unknown. Beyond the leak-site listing itself, further operational details have not been released in the materials provided.

Who is 8base?

8base is a ransomware operation that became more visible in 2022 and 2023. Like many contemporary groups, it typically follows a double-extortion model: encrypting systems while also copying data and threatening to publish it if a ransom is not paid. The group maintains a public leak site where it names organizations and, in some cases, posts samples or larger archives of stolen files. Its victims have spanned manufacturing, professional services, and other mid-market sectors. Listings on such sites are claims by the actors; they do not by themselves constitute independent verification that every asserted detail is accurate or complete. In this case, the facts state only that J.T. Cullen Co., Inc. was listed and that internal files were described as exfiltrated.

J.T. Cullen Co., Inc. and its sector

J.T. Cullen Co., Inc. is an employee-owned (ESOP) custom metal fabrication company based in Fulton, Illinois. For more than sixty years it has produced large and specialized fabrications for industries that include power generation, steel mills, architectural projects, and rail. The company holds ISO 9001:2015 and ASME certifications and describes itself as relying on an experienced workforce. Firms of this type routinely handle engineering drawings, production schedules, supplier and customer correspondence, quality records, and employee information necessary to run an ESOP and a certified manufacturing operation. A breach affecting such an organization matters because the data can touch both commercial relationships and the personal details of workers and partners, and because disruptions or leaks can affect supply chains that serve critical infrastructure sectors.

What was likely exposed

The only data type named in the available facts is “internal files” said to have been exfiltrated in a ransomware attack. No inventory of specific document categories, file counts, or personal-data fields has been publicly detailed. Organizations in custom metal fabrication commonly maintain design and fabrication drawings, material certifications, purchase orders, shipping records, employee personnel and benefits files, and customer or vendor contact information. Whether any or all of those categories were among the files taken in this incident is unconfirmed. Readers should treat the exact contents as undisclosed until a fuller accounting is provided by the company or by regulators.

What's at stake

For individuals, the practical risks depend on what was actually in the internal files. If employee or contractor records were included, possible consequences include phishing that uses accurate workplace details, attempts at identity fraud, or social-engineering calls that reference real projects or colleagues. For the company, exposure of proprietary drawings or customer data can create commercial and contractual concerns, while any operational disruption from ransomware can delay deliveries to power, steel, architectural, or rail clients. Because the scale and precise contents remain unknown, the concrete impact on any single person or partner cannot yet be measured from public information alone. The listing itself, however, signals that the group at least claimed possession of material it considered valuable enough to advertise.

If your data was in this claimed breach

If you are a current or former employee, contractor, or business contact of J.T. Cullen Co., Inc., treat the situation as a prompt for ordinary caution rather than panic. Monitor financial and benefits accounts for unexpected activity, and be wary of unsolicited messages that reference the company, specific projects, or personal details that could have come from internal files. Consider placing a fraud alert with the major credit bureaus if you believe sensitive personal identifiers may have been involved. Change passwords on work-related and personal accounts that may have shared credentials, and enable multi-factor authentication where it is available. You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. If the company issues an official notification or credit-monitoring offer, follow the instructions in that notice, as it will be based on a more complete internal assessment than is currently public.

AICompiled with AI assistance from public sources and published under our editorial standards.