MCPolymers Data Breach

Settra, a ransomware group, has listed MCPolymers, a company operating in the polymer and plastics manufacturing sector, on its dark web leak site on October 2, 2026. The group claims to have exfiltrated corporate data, although this remains unverified. The primary concern highlighted is the potential exposure of proprietary material formulations, processing parameters, and client product specifications. This type of data is critical intellectual property in sectors such as automotive, packaging, and medical devices, where its public disclosure would lead to irreversible value loss. Over the past 60 days, Settra has demonstrated a pattern of targeting manufacturing and specialty materials companies, showing a particular interest in entities possessing significant industrial intellectual property. Polymer manufacturers like MCPolymers are vulnerable to dual threats: the compromise of formulation data that undermines their competitive standing with clients, and the encryption of production scheduling or quality management systems, which could lead to immediate operational shutdowns. The scope of data allegedly exfiltrated by Settra aligns with these potential impacts.

A SOCRadar stealer-log query for MCPolymers did not yield any results. This absence of evidence does not confirm that the organization is unaffected by credential theft or other forms of compromise. Potential initial access vectors could include phishing campaigns targeting employees in engineering or sales roles, or the exploitation of vulnerabilities in Enterprise Resource Planning (ERP) systems or supply chain management platforms. The complex interdependencies of polymer manufacturers, involving integrations with raw material suppliers, toll manufacturing partners, and customer quality systems, significantly extend their effective attack surface beyond the traditional network perimeter. Incident response efforts should focus on determining the extent of any exfiltrated formulation and process data. It is advisable to proactively notify clients whose product specifications might be compromised. Implementing multi-factor authentication (MFA) on all remote access pathways and restricting access to proprietary formulation data are immediate protective measures. A thorough review of the security of all digital integrations with suppliers and customers is crucial before considering the network perimeter to be secure.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.