Specialty Textile Services Data Breach

Specialty Textile Services, an industrial textile services company based in the United States, was listed on the dark web portal of the INC Ransom ransomware group on September 2, 2026. This listing was identified by SOCRadar’s Dark Web Monitoring service. The company provides fabric and textile-related services to commercial clients. As of the reporting date, no independent confirmation of a data breach has been made. Specialty Textile Services operates within the manufacturing sector, an area frequently targeted by ransomware operations seeking to disrupt industrial supply chains and business operations. INC Ransom has claimed 57 victims in the 60 days leading up to this listing. The group primarily targets companies within the United States, particularly within the manufacturing sector, followed by professional services and healthcare. Recent victims in the United States within or adjacent to the manufacturing industry include RENO Refractories, Inc. (Manufacturing), New Century Ophthalmology Group (Healthcare), Oilquip Inc (Energy & Utilities), and Zummo. Specialty Textile Services aligns with INC Ransom’s typical targeting profile without any discernible deviation.

A query conducted by SOCRadar against the domain specialtytextile[.]com for stealer-log records returned no results within the queried dataset. It is crucial to note that this absence of records does not constitute confirmation that the organization is unaffected. Stealer-log data is typically paginated and filtered, meaning that credentials may exist in datasets beyond the scope of this specific query, or they could be associated with alternate corporate domains, adjacent data feeds, or personal email accounts used on corporate devices. Therefore, the null result does not rule out the possibility of compromised credentials. Such credentials, if they exist through other means, could be exploited by threat actors for initial access, credential validation, or as a pathway for ransomware deployment. Continued monitoring across various credential intelligence feeds is recommended to maintain awareness of any potential exposure. Assessment: INC Ransom is identified as a prolific threat actor with a strategic focus on U.S.-based industrial and manufacturing companies, making Specialty Textile Services a typical target within their operational profile. The null result from the stealer-log query should not be interpreted as an indicator of the organization’s security posture. Affected organizations are advised to conduct thorough audits of their external access points, including VPNs, Microsoft 365, and remote-access portals, and to implement proactive credential hygiene measures, irrespective of the current query findings.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.