Mattatuck Industrial Scrap Metal Data Breach

Mattatuck Industrial Scrap Metal, a US-based company operating under the mattatuckscrap.com domain, has been listed as a victim on the Qilin ransomware group’s dark web portal. The listing was published on July 1, 2026, and identified through SOCRadar’s Dark Web Monitoring service. The company is classified within business services, covering its industrial scrap and recycling operations. Its US base aligns it with Qilin’s strong targeting of American industrial and service enterprises. In the 60 days prior to this listing, Qilin has claimed numerous victims, showing a pattern of targeting the business services, manufacturing, and consumer services sectors. Geographically, its victims are concentrated in the United States, the United Kingdom, and Australia. This aligns with Mattatuck’s profile as a US industrial and service enterprise.

Initial access for this incident was investigated using SOCRadar’s stealer-log telemetry, which returned no records for mattatuckscrap.com in the queried slice. However, a null result does not confirm security, as the organization might operate under alternate domains, or employees could use personal email aliases not captured in this specific lookup. The absence of a direct hit indicates no signal in this particular dataset, not a guarantee of secure credentials. For ransomware groups like Qilin, infostealer-harvested credentials are a common initial access vector. Operators or brokers source logs from dark web marketplaces, validate corporate credentials, and use them to access systems like Microsoft 365, VPNs, or remote access portals before deploying ransomware. The lack of evidence in this query does not rule out this scenario, as credentials may have appeared in other feeds, been rotated, or harvested under personal aliases. CTI teams should continue monitoring and conduct proactive credential hygiene checks rather than assuming security based on a negative query result.

Disclaimer

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.