Mattatuck Industrial Scrap Metal Data Breach

Mattatuck Industrial Scrap Metal, a US-based company operating under the mattatuckscrap.com domain, has been listed as a victim on the Qilin ransomware group’s dark web portal. The listing was published on July 1, 2026, and identified through SOCRadar’s Dark Web Monitoring service. The company is classified within business services, covering its industrial scrap and recycling operations. Its US base aligns it with Qilin’s strong targeting of American industrial and service enterprises. In the 60 days prior to this listing, Qilin has claimed numerous victims, showing a pattern of targeting the business services, manufacturing, and consumer services sectors. Geographically, its victims are concentrated in the United States, the United Kingdom, and Australia. This aligns with Mattatuck’s profile as a US industrial and service enterprise.

Initial access for this incident was investigated using SOCRadar’s stealer-log telemetry, which returned no records for mattatuckscrap.com in the queried slice. However, a null result does not confirm security, as the organization might operate under alternate domains, or employees could use personal email aliases not captured in this specific lookup. The absence of a direct hit indicates no signal in this particular dataset, not a guarantee of secure credentials. For ransomware groups like Qilin, infostealer-harvested credentials are a common initial access vector. Operators or brokers source logs from dark web marketplaces, validate corporate credentials, and use them to access systems like Microsoft 365, VPNs, or remote access portals before deploying ransomware. The lack of evidence in this query does not rule out this scenario, as credentials may have appeared in other feeds, been rotated, or harvested under personal aliases. CTI teams should continue monitoring and conduct proactive credential hygiene checks rather than assuming security based on a negative query result.