Pillar Resource Services Listed by royal Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On or around 21 January 2023, Pillar Resource Services appeared on a leak site operated by the ransomware group known as royal. Public reporting indicates that internal files were exfiltrated in a ransomware attack. The number of people whose information may be involved remains unknown, and many operational details have not been confirmed in open sources. For anyone who has worked with, contracted for, or supplied the company, the practical concern is straightforward: internal business records can contain names, contact details, contractual information, and other material that outsiders can misuse for fraud, social engineering, or further intrusion.

Because the scale and exact contents have not been publicly verified beyond the group’s listing and the description of internal-file exfiltration, affected individuals and partners are left to treat the claim seriously while waiting for clearer confirmation from the organisation or independent investigators.

Inside the incident

According to available public reporting dated 21 January 2023, Pillar Resource Services was listed by the royal ransomware group. The reported characterisation of the incident is that internal files were allegedly exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been released. Timing of the initial intrusion, the precise method of access, whether systems were encrypted in addition to data theft, and any ransom demand or negotiation outcome are not detailed in the public facts. The listing itself constitutes a claim by the group rather than an independently verified disclosure by the company.

Contact and location information associated with the organisation in the same reporting points to a fabrication facility, module yard and field-service centre in Edmonton, Alberta, Canada. Beyond that organisational footprint and the statement that internal files were taken, further technical or forensic particulars remain undisclosed.

Who is royal?

Royal is a ransomware operation that became publicly prominent in 2022. Like many contemporary ransomware groups, it has been observed using a double-extortion model: data is copied from victim networks before encryption, and the threat of publishing or selling the stolen material is used to pressure payment. The group has typically operated as a closed or semi-closed crew rather than a fully open affiliate programme, and it has targeted organisations across multiple sectors and geographies. Listings on its leak site are claims that a victim’s data was obtained; they do not by themselves prove the full scope or sensitivity of any particular haul.

In this case, the only attribution available in the facts is the group’s own listing of Pillar Resource Services and the associated description of internal-file exfiltration. No additional statements by royal specifically about this victim’s data have been supplied in the record, so nothing further should be assumed.

Who is Pillar Resource Services?

Pillar Resource Services appears, from the address and contact details carried in public reporting, to operate fabrication, module-yard and field-service activities out of Edmonton, Alberta. Organisations of this type commonly support industrial, energy and resource-sector projects—building or assembling modules, providing field labour and managing related logistics. Such firms routinely hold internal operational documents, supplier and customer correspondence, employee or contractor records, project specifications, and financial or contractual files.

A breach at a company in this position is consequential because the data often links multiple parties: employees, contractors, suppliers, and client project teams. Even when the primary target is a mid-sized industrial services firm, the ripple effects can reach individuals and businesses that never directly interacted with the ransomware operators.

The information in question

The facts state that internal files were exfiltrated in a ransomware attack. No further breakdown of data types—such as employee identifiers, payroll details, customer lists, engineering drawings, or financial records—has been publicly confirmed. The number of individuals affected is listed as unknown.

Organisations engaged in fabrication and field services typically maintain personnel files, contractor agreements, purchase orders, shipping and receiving records, email correspondence, and project documentation. Whether any of those categories were among the files taken in this incident has not been verified in the available reporting. Readers should therefore treat the precise contents as unconfirmed.

Why it matters

When internal files leave an organisation’s control, the immediate risks to people are concrete rather than abstract. Contact details and identity information can be used in targeted phishing or impersonation attempts. Contractual or project data can reveal business relationships that fraudsters later exploit. If employee or contractor records were included, individuals may face elevated risk of identity theft or credential stuffing against other accounts. For the organisation itself, loss of internal documents can disrupt operations, damage trust with clients and suppliers, and create regulatory or contractual notification obligations depending on the jurisdictions and data involved.

Because the headcount of affected people and the exact file inventory remain unknown, the prudent stance is to assume that anyone whose personal or business information resided in Pillar Resource Services systems could be exposed until clearer information emerges.

What to do if you're exposed

If you have a past or present relationship with Pillar Resource Services—as an employee, contractor, supplier or client—monitor financial and email accounts for unexpected activity and treat unsolicited messages that reference the company or its projects with caution. Consider placing fraud alerts with credit bureaus where available, and change passwords on any accounts that may have shared credentials or recovery information with work systems. Keep records of any suspicious contact.

You can also run a free exposure scan of your email address to check whether your information has already surfaced in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for understanding your wider exposure.

AICompiled with AI assistance from public sources and published under our editorial standards.