Sichuan Dowell Science and Technology Company Inc Listed by blacksuit Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

On May 24, 2024, Sichuan Dowell Science and Technology Company Inc was listed by the blacksuit ransomware group. The group claims the company was hit in a ransomware attack that involved the exfiltration of internal files. The number of people affected is unknown, and public detail on the precise timing, method, or full scale of the incident remains limited.

The listing matters because the organisation operates as a significant player in China’s leather-chemicals sector. Any confirmed exposure of internal material could affect business continuity, proprietary processes, and parties connected to the firm, even while the exact contents of the claimed data set stay unconfirmed.

What happened

Public reporting records that Sichuan Dowell Science and Technology Company Inc appeared on a blacksuit leak site on May 24, 2024. According to the group’s claim, the incident was a ransomware attack in which internal files were exfiltrated. No independent confirmation of the attack’s success, the volume of data taken, or the encryption status of systems has been released in the available facts. The number of individuals potentially affected is listed as unknown. Specifics such as the date the intrusion began, the initial access vector, or any ransom demand are undisclosed.

What is known is therefore confined to the leak-site listing itself and the description of “internal files exfiltrated in ransomware attack.” Beyond that single characterisation, further operational detail has not been made public.

The group behind it: blacksuit

Blacksuit is a ransomware operation that became publicly visible in 2023. Security researchers have documented it as a double-extortion group: operators encrypt systems and simultaneously steal data, then threaten to publish the material if payment is not made. The group maintains a dedicated leak site on which it posts victim names and, in some cases, sample files. Public reporting has linked blacksuit to earlier activity under the Royal ransomware banner, with shared tooling and negotiation practices. Typical targets have included mid-sized enterprises across manufacturing, professional services, and industrial sectors. The group’s listings are claims made by the operators themselves; they do not constitute independent verification that a breach occurred or that the described data was in fact taken.

In the present case, blacksuit’s sole public assertion is that Sichuan Dowell Science and Technology Company Inc suffered a ransomware attack involving exfiltration of internal files. No additional statements attributed to the group about this specific victim appear in the available record.

Who is Sichuan Dowell Science and Technology Company Inc?

Sichuan Dowell Science and Technology Company Inc, also referred to in Chinese corporate records as Sichuan Dawei Technology Co., Ltd, was established in November 2003. Its core business is the research, development, production and sales of leather chemicals. Product lines cover clean tanning materials, leather functional additives, finishing materials and colorants, with a reported production capacity exceeding 200 product varieties. The company listed on China’s Growth Enterprise Market in 2016 and is described as a leading enterprise in the domestic leather industry.

Organisations of this type routinely manage proprietary chemical formulations, production process data, supply-chain records, employee information, and commercial contracts. A ransomware incident at such a firm is consequential because disruption can halt manufacturing, compromise intellectual property, and create secondary risks for customers and partners who rely on the company’s materials. Because the firm is publicly listed, any material incident also carries potential disclosure and market-confidence implications under Chinese securities rules, though no regulatory filing details are provided in the current facts.

The information in question

The only data type named in the available record is “internal files exfiltrated in ransomware attack.” No further breakdown—such as whether the files included employee records, customer lists, financial documents, or technical formulas—has been disclosed. Public detail on exact contents is therefore unconfirmed.

Companies operating in specialty chemicals typically hold a range of sensitive material: research notebooks, batch records, quality-control data, supplier and customer contracts, payroll and human-resources files, and network credentials. Whether any of those categories were among the files claimed by blacksuit cannot be established from the facts at hand. The absence of a confirmed inventory means affected parties cannot yet determine the precise nature of any exposure.

What's at stake

For individuals whose data may have been present in internal systems—employees, contractors, or business contacts—the primary risks are identity misuse, targeted phishing, or unsolicited contact that leverages personal details. Because the number of people affected is unknown and the file contents remain unspecified, the concrete personal impact cannot yet be quantified.

For the organisation itself, the stakes include potential operational downtime, loss of proprietary leather-chemical formulations, reputational damage with customers and investors, and the cost of forensic investigation and system restoration. Even if encryption was reversed or systems restored from backups, the mere claim of exfiltration can trigger contractual notification duties and regulatory scrutiny. Competitors or opportunistic actors could also attempt to exploit any leaked technical information. None of these outcomes is confirmed; they represent the ordinary range of consequences that follow a claimed ransomware incident of this type.

Were you affected?

If you have a past or present relationship with Sichuan Dowell Science and Technology Company Inc—as an employee, supplier, customer, or partner—consider the following practical steps while official confirmation remains limited:

• Monitor financial and email accounts for unexpected activity or password-reset attempts.
• Enable multi-factor authentication on any accounts that share credentials or contact details with the company.
• Treat unsolicited messages that reference leather chemicals, production schedules, or internal project names with heightened caution.
• Request written confirmation from the company about whether your personal or business data was involved once an official statement is issued.
• Run a free exposure scan of your email address against known breach data sets to check whether your information has already appeared in public or underground collections.

Public detail on this incident is still sparse. Continued monitoring of official company notices and reputable cybersecurity reporting remains the most reliable way to learn whether further information becomes available.

AICompiled with AI assistance from public sources and published under our editorial standards.