TPI Corporation Listed by avoslocker Ransomware Group: Ransomware Claim — What’s Alleged & What To Do

Ransomware groups continue to pressure organisations by pairing encryption with public leak-site listings, turning stolen internal files into leverage. In late 2022 that pattern again reached mid-sized industrial firms whose day-to-day operations generate large volumes of contracts, financial records and project correspondence.

On 26 December 2022 the ransomware group known as avoslocker listed TPI Corporation on its leak site, claiming to have exfiltrated roughly one terabyte of confidential internal material. The number of people affected remains unknown, and independent confirmation of the full scope has not been published. The listing itself is a claim by the group; what can be examined are the sample files it chose to post and the categories of data it described.

Inside the incident

Public reporting of the incident is limited to the avoslocker leak-site entry dated 26 December 2022. According to that listing, the group asserted that it had stolen approximately 1 TB of confidential data from TPI Corporation in a ransomware attack and had begun releasing samples. The group described the material as including NDA agreements, email bases, private conversations in .msg format, financial statements, IRS notices, confidential business information, engineering projects, legal statements and accounting statements.

As proof of access the group posted a small archive labelled TPI-Part1.zip containing several named documents: a 31 March 2022 TPI financial statements PDF, a 30 August 2021 IRS CP216F Notice, an executed mutual NDA dated 31 March 2021 involving Hearn and TPI Fostoria Corporation, a 31 March 2021 Headliner NVH Project email, a 10 July 2020 Mission National Insurance Co. distribution PDF, and a partial file dated 16 March 2020 referring to Oliver’s of Or. No further technical details—initial access vector, encryption timeline, ransom demand or negotiation outcome—have been disclosed in the available record. The total number of individuals whose information may appear in the wider data set is unknown.

Who is avoslocker?

Avoslocker is a ransomware operation that emerged in 2021 and operated primarily as a ransomware-as-a-service model. Like many contemporaneous groups it practised double extortion: encrypting systems while simultaneously exfiltrating data and threatening to publish it on a dedicated leak site if payment was not made. The group typically targeted mid-sized organisations across manufacturing, professional services and other sectors, using standard intrusion techniques such as compromised credentials, exposed remote-access services and commodity malware loaders before deploying its ransomware payload.

Avoslocker’s leak site served both as a pressure mechanism and as a public catalogue of claimed victims. Listings routinely included sample file trees or small archives to demonstrate authenticity. The group’s activity declined after law-enforcement actions and infrastructure disruptions in subsequent years, but its earlier claims remain part of the public breach record. In the present case the only statements about TPI Corporation are those appearing on the leak site; they have not been independently verified in the facts available here.

About TPI Corporation

TPI Corporation is a United States-based manufacturer whose operations, judging by the sample project and corporate documents referenced in the listing, involve engineered products, supply-chain relationships and multi-party commercial agreements. Firms of this type routinely maintain detailed financial ledgers, tax correspondence, non-disclosure agreements with suppliers and customers, engineering project files, insurance records and internal email archives.

A breach affecting such an organisation is consequential because the data sets are both commercially sensitive and potentially personal. Engineering drawings, pricing models and executed contracts can confer competitive advantage if disclosed; employee and counterparty contact details, tax notices and insurance distributions can expose individuals to secondary fraud or privacy harm. Even when the precise headcount of affected people is unknown, the categories of material claimed by avoslocker indicate that both the company and its business partners could face lasting exposure.

What data was at risk

The facts identify the exposed material only as “internal files exfiltrated in [a] ransomware attack.” The avoslocker listing elaborates with a claim of roughly 1 TB containing NDA agreements, email stores, private .msg conversations, financial statements, IRS documents, confidential business information, engineering projects, legal statements and accounting statements. Sample file names released by the group are consistent with those categories—financial statements, an IRS notice, an executed mutual NDA, a project-related email and insurance distribution records.

Exact contents of the full archive remain unconfirmed. Organisations in manufacturing and industrial supply chains typically hold employee and contractor contact data, payroll or benefits information, customer and vendor contracts, technical drawings, quality records and tax filings. Whether any of those additional elements were present in the TPI data set cannot be established from the public record; only the group’s description and the limited sample files are known.

What's at stake

For individuals whose names, email addresses or personal identifiers appear inside the stolen files, the practical risks include targeted phishing, business-email compromise and identity-related fraud. Tax notices and insurance documents can supply enough detail for convincing social-engineering attempts. Counterparties named in NDAs or project correspondence may find their own commercial arrangements exposed, creating secondary liability or reputational questions.

For TPI Corporation the stakes include potential regulatory notification duties, contractual breach-of-confidence claims, and the long-term loss of negotiating leverage if pricing, engineering or legal strategies became public. Because the volume of affected people is unknown and the full data set has not been independently inventoried, both the company and any third parties mentioned in the files must treat the exposure as open-ended until clearer inventories emerge.

What to do if you're exposed

If you have a past or present relationship with TPI Corporation—as an employee, contractor, supplier or customer—monitor financial and email accounts for unusual activity and treat unexpected messages that reference internal projects or tax matters with caution. Consider placing fraud alerts with major credit bureaus if you believe tax or identity documents may have been involved. Preserve any official breach notification you receive; it will contain the most accurate description of what was confirmed stolen.

You can also run a free exposure scan of your email address to check whether it has already appeared in known breach data sets. That step does not confirm or rule out involvement in this specific incident, but it provides a practical starting point for personal monitoring.

AICompiled with AI assistance from public sources and published under our editorial standards.