schuff.com Listed by blackbasta Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to target industrial and construction firms as part of a broader pattern of double-extortion attacks, in which data is stolen before systems are encrypted and then used as leverage. In this environment, listings on criminal leak sites have become a common way for threat actors to pressure victims and advertise their activity. On 20 November 2024, the domain schuff.com appeared on a leak site operated by the BlackBasta ransomware group, which claimed responsibility for a ransomware attack involving the exfiltration of internal files.

Public detail remains limited. The number of people affected is unknown, and independent confirmation of the full scope of the incident has not been released. What is known comes primarily from the group’s own listing and from publicly available information about the organisation itself. The episode matters because Schuff Steel Company handles sensitive commercial, engineering and employee information that, if exposed, could create lasting risks for staff, partners and projects.

Inside the incident

According to the BlackBasta listing reported on 20 November 2024, Schuff Steel Company (schuff.com) was the victim of a ransomware attack in which internal files were exfiltrated. The group claimed the total volume of data taken was approximately 800 GB. No further technical details—such as the initial access method, the duration of the intrusion, or whether encryption was successfully deployed—have been publicly confirmed. The number of individuals whose information may have been involved is listed as unknown.

The listing itself constitutes a claim by the threat actor rather than an independently verified disclosure. Organisations in this position sometimes negotiate, sometimes refuse, and sometimes remain silent; none of those outcomes has been confirmed in open sources for this case. As a result, the precise timeline, the exact systems affected and the full inventory of files remain undisclosed beyond the categories the group itself named.

Inside blackbasta

BlackBasta is a well-documented ransomware operation that emerged in 2022 and has since been linked to numerous attacks against organisations across manufacturing, construction, professional services and other sectors. The group typically employs a double-extortion model: after gaining access, operators steal large volumes of data, encrypt systems, and then threaten to publish the stolen material on a dedicated leak site if a ransom is not paid. They have historically used phishing, compromised credentials and exploitation of known vulnerabilities as common entry points, though the specific vector used against any individual victim is rarely confirmed by the group.

BlackBasta’s leak site serves both as a pressure mechanism and as a public catalogue of claimed victims. Listings often include sample file names or data-volume estimates intended to demonstrate that the theft occurred. In the case of schuff.com, the group has asserted that roughly 800 GB of internal material was taken and has listed several broad categories of data. Those assertions should be treated as claims pending any independent verification or official statement from the company.

Who is schuff.com?

Schuff Steel Company is one of the largest structural steel fabrication and erection firms in the United States. Founded in 1976 by Dave Schuff and his son Scott, the company provides comprehensive services for commercial and industrial construction projects, including high-rise buildings, sports arenas, hospitals and similar large-scale work. Its public headquarters address is listed as 3003 N. Central Avenue, Suite 1500, Phoenix, Arizona 85012, with a main telephone number of (602) 252-7787. The corporate website is www.schuff.com.

Companies of this type routinely manage detailed engineering drawings, project specifications, financial records, contracts and employee personnel files. Because structural steel work sits at the centre of major construction programmes, a compromise of internal systems can affect not only the firm itself but also owners, architects, subcontractors and other partners who rely on the accuracy and confidentiality of shared project data. A ransomware incident therefore carries both operational and reputational consequences for an organisation whose business depends on trust and precise technical coordination.

The information in question

The BlackBasta listing claims that the exfiltrated material included financial data; personal employee data, documents and forms; confidential materials and non-disclosure agreements; and engineering files, projects and drawings. The group further stated that the total volume was approximately 800 GB. These categories are presented as the actor’s description of what was taken; they have not been independently audited in public reporting, and the exact contents of any individual file remain unconfirmed.

Organisations in the structural-steel and heavy-construction sector typically hold payroll and benefits records, tax identifiers, design drawings, bid documents, client contracts and internal correspondence. Whether every one of those data types was present in the claimed 800 GB archive cannot be verified from available information. Readers should therefore treat the listed categories as the threat actor’s assertions rather than as a definitive inventory.

Why it matters

If the claimed data were made public or sold, employees could face risks of identity theft, targeted phishing or social-engineering attacks that exploit personal details. Financial records and NDAs could expose commercial terms, pricing strategies or partner relationships, potentially harming competitive position or contractual obligations. Engineering drawings and project files, if authentic, might reveal proprietary design methods or site-specific details that could be misused by competitors or, in extreme cases, by actors seeking to disrupt construction activity.

For the company itself, the incident creates operational disruption, potential regulatory notification duties, legal exposure and the cost of forensic investigation and recovery. Even when systems are restored, the lingering possibility that sensitive material remains in criminal hands can erode client confidence and complicate future bids. Because the number of affected individuals is unknown, the full human impact cannot yet be quantified, but any exposure of employee or partner data carries concrete, long-term privacy and security consequences.

Were you affected?

If you are a current or former employee, contractor or business partner of Schuff Steel Company, monitor financial accounts and credit reports for unusual activity and be alert to unexpected emails or calls that reference company projects or personal details. Consider placing a fraud alert with the major credit bureaus and changing passwords on any accounts that may have shared credentials with work systems. Because the exact scope of the breach remains unconfirmed, these steps are prudent regardless of whether you have received a formal notification.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. Such a scan will not confirm or rule out involvement in this specific incident, but it can indicate whether your address has surfaced elsewhere and help you prioritise further protective measures.

AICompiled with AI assistance from public sources and published under our editorial standards.