Engineers Contractors Fabricators Inc (ECF) Data Breach

interlock claimed Engineers Contractors Fabricators Inc. (ECF) on its dark web portal on October 12, 2026, as part of a campaign that has targeted 19 victims over the past 60 days. ECF is a U.S.-based manufacturing firm specializing in engineering and fabrication. The company has not yet issued a public response to the claim. The threat actor group’s recent activity over the last 60 days shows a concentration in the Healthcare, Manufacturing, and Education sectors, with a significant geographic presence in both the United States and Chile. Other organizations claimed during this period include Concord Eye Center (US, Healthcare), Nu-Quest Distribution (US, Retail), and Pedigo Products (US, Manufacturing). The repeated targeting of manufacturing and engineering firms by interlock is a notable pattern, suggesting a strategic focus on these industries.

Stealer-log queries conducted by SOCRadar for Engineers Contractors Fabricators Inc. (ECF) did not yield any records within accessible repositories. This absence of direct evidence in public logs does not preclude a compromise, as threat actors can operate undetected within target networks. Manufacturing and engineering contractors often possess valuable data, including project design files, client specifications, and supply-chain credentials, making them attractive targets for data extortion. The interlock group has demonstrated its capability to infiltrate networks and conduct operations without leaving detectable traces in public log feeds, underscoring the potential for stealthy intrusions. Credential rotation across VPN, SSO, and remote desktop services should be prioritized. Implementing phishing-resistant MFA across all remote access and identity systems is a critical control. For manufacturing firms with access to supplier portals or ERP credentials, these are prime targets for attackers. Organizations should review their authentication logs for anomalies within the past 30 days.