The Recycler Core Listed by ElDorado Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

When a company that handles scrap materials, cores, used equipment and catalytic converters appears on a ransomware group's leak site, the people connected to that business face a practical question: what of their information may now be outside the organisation's control. On 18 November 2024, The Recycler Core was listed by the ElDorado ransomware group, which claimed that internal files had been exfiltrated. The number of people affected remains unknown, and public detail about the precise contents of those files is limited. For employees, suppliers, customers and others whose details may sit in company systems, the listing is a signal that personal or business data could be at risk of misuse even if the full scope is still unconfirmed.

This article sets out only what has been reported, places the claim in context, and outlines the concrete steps people can take while the picture remains incomplete.

Breaking down the breach

According to the available record, The Recycler Core was listed by the ElDorado ransomware group on 18 November 2024. The group claims that internal files were exfiltrated in a ransomware attack. No confirmed figure for the number of people affected has been published, and the method of initial access, the duration of any intrusion, and the exact volume of data taken have not been disclosed in the public summary. The organisation is described as having revenue of $20.4 million and as supplying scrap materials, cores, used equipment and catalytic converters for various industries. Beyond the claim of exfiltrated internal files, further technical or forensic detail about the incident itself has not been made public.

Because the listing originates from the threat actor's own site, it remains an unverified claim unless and until the organisation or independent investigators state the details. At present, the public record does not state whether a ransom was demanded, paid or refused, nor whether any data has been released beyond the initial listing.

Who is ElDorado?

ElDorado is a ransomware group that has operated in the public eye as a ransomware-as-a-service operation. Like many such groups, it is known for double-extortion tactics: encrypting systems while also claiming to steal data, then threatening to publish or sell the material if payment is not made. Victims are typically listed on a dedicated leak site, often with sample files or descriptions intended to pressure the organisation. Public reporting has associated ElDorado with attacks across multiple sectors rather than a single industry focus. The group’s listings are claims made by the actors themselves; they do not automatically constitute independent verification that every detail is accurate or that every named file set was in fact taken.

In the case of The Recycler Core, the only specific assertion available is the group’s claim that internal files were exfiltrated. No further statements attributed to ElDorado about this particular victim appear in the given record, and none should be assumed.

The Recycler Core and its sector

The Recycler Core operates in the recycling and industrial-supply sector, providing scrap materials, cores, used equipment and catalytic converters to various industries. Organisations of this type typically sit at the intersection of manufacturing, logistics and secondary-materials markets. They routinely hold operational records, supplier and customer contact details, shipping and inventory data, financial information, and employee records. Catalytic-converter and scrap-metal businesses can also process documentation related to material provenance, regulatory compliance and payment histories.

A breach involving such a firm is consequential because the data often includes both commercial information valuable to competitors or fraudsters and personal information belonging to staff, contractors and trading partners. Even when the precise files taken remain unconfirmed, the nature of the sector means that disruption or data exposure can affect supply chains, invoicing, and the privacy of individuals whose details are stored for ordinary business purposes.

What data was at risk

The public facts state only that internal files were exfiltrated in a ransomware attack. No itemised list of data categories—such as names, addresses, financial account numbers, or specific document types—has been disclosed. Organisations in the scrap-materials and industrial-equipment supply sector commonly maintain employee personnel files, payroll data, customer and supplier databases, contracts, shipping records and internal financial documents. It is therefore possible that some combination of these materials was among the files claimed to have been taken, but that remains unconfirmed.

Until a fuller disclosure is made by the organisation or by independent analysis of any released samples, the exact contents of the exfiltrated material cannot be stated as fact. Readers should treat any more detailed claims circulating online with caution unless they are corroborated by primary sources.

The real-world impact

For individuals whose information may have been held by The Recycler Core, the practical risks include phishing or social-engineering attempts that reference genuine business relationships, identity-related fraud if personal identifiers were present, and unsolicited contact from parties who have obtained contact details. Because the number of people affected is unknown and the data types have not been itemised, the scale of these risks cannot yet be quantified. Employees and contractors may face particular concern if payroll or identity documents were among the internal files; suppliers and customers may see elevated fraud risk around invoices or payment instructions.

For the organisation itself, the listing creates operational, reputational and potential regulatory consequences. Restoring systems after ransomware, investigating the scope of any data loss, and communicating with affected parties all require time and resources. Even if no data is ultimately published, the mere claim of exfiltration can erode trust among trading partners. None of these outcomes has been confirmed as having materialised; they are the ordinary consequences that follow such listings when the underlying claim proves accurate.

If your data was in this claimed breach

If you have a past or present relationship with The Recycler Core—as an employee, contractor, supplier or customer—treat the possibility of exposure seriously while recognising that confirmation is still limited. Monitor financial accounts and credit reports for unexpected activity. Be sceptical of unsolicited emails, calls or messages that reference the company or that urge urgent payment or credential entry. Change passwords on any accounts that reused credentials associated with work email, and enable multi-factor authentication where available. Consider placing fraud alerts with credit bureaus if you believe sensitive personal identifiers may have been involved.

You can also run a free exposure scan of your email address to check whether that address has already appeared in known breach data sets. Doing so provides one additional data point while official notifications, if any, are still pending. Keep records of any suspicious contact and report clear fraud attempts to the appropriate authorities. Further verified information from The Recycler Core or from independent investigators should be watched for, but in the meantime these basic steps reduce the most common avenues of harm.

AICompiled with AI assistance from public sources and published under our editorial standards.