Henry Pratt Company Data Breach

Henry Pratt Company, a manufacturer of industrial valves and flow control systems for water, wastewater, and process industries, was listed by the Clop ransomware group on September 10, 2026. As a supplier to critical infrastructure sectors within the United States, Henry Pratt’s operations could be a target for ransomware attacks due to their essential role in the supply chain. The listing by Clop indicates a potential compromise or data exfiltration event. In the 60 days preceding this listing, Clop claimed 87 other victims, positioning them as one of the most active ransomware operations currently. The group’s recent targeting has predominantly focused on the Technology sector, followed by Retail & E-Commerce and Manufacturing. Geographically, their attacks are concentrated in the United States, with notable activity also in India and Italy. Recent high-profile victims include Harley-Davidson, Zebra Technologies, Largan Precision Co., Ltd., and Atomberg Technologies. Henry Pratt’s profile as a U.S. manufacturer serving critical infrastructure aligns with Clop’s established targeting patterns.

A stealer-log query was performed for the domain henrypratt[.]com. The query aims to identify any associated credentials that may have been exfiltrated by infostealer malware. Such compromised credentials can potentially be leveraged by ransomware groups for initial access into victim networks, facilitating further malicious activities including data encryption and extortion. The query returned zero records. It is important to note that this result is based on a paginated and bounded sample of available stealer-log telemetry. The absence of records in this specific dataset does not definitively confirm that Henry Pratt Company’s credentials have not been compromised. Compromised credentials could still exist in other data feeds not covered by this query, might be associated with alternate corporate domain aliases, or could be linked to employee personal accounts. Furthermore, credentials may have been used and subsequently rotated before being indexed, or the data may not yet have been indexed in the queried feeds. Therefore, a null result does not rule out the possibility of credential compromise. Given the nature of stealer-log data and its potential use in ransomware operations, ongoing monitoring for any new or existing credential exposures is recommended. This includes continuous vigilance on dark web forums, stealer-log feeds, and related underground marketplaces. Organizations should also implement proactive credential hygiene measures such as regular password rotations, robust multi-factor authentication enforcement across all access points, and thorough reviews of access logs for Microsoft 365, VPNs, and remote-access portals. Monitoring for activity under alternate corporate domains is also a crucial step to ensure comprehensive coverage.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.