Flexmaster Data Breach

Flexmaster, a Canadian manufacturer specializing in flexible and industrial components, has been identified as a victim of the Storm ransomware group. The listing was observed on September 9, 2026, and was detected through SOCRadar’s Dark Web Monitoring service. The company’s operations in the manufacturing sector, particularly in Canada, align with Storm’s known targeting patterns, which often focus on industrial entities in North America. The Storm ransomware group has been actively targeting the Manufacturing, Healthcare, and Financial Services sectors. Their operational focus frequently includes industrial companies across North America, with a notable pattern of including Canadian manufacturers alongside victims in the United States and Australia. Recent organizations claimed by Storm include Melitron, Integra Castings, National Salvage, and Otto Sieve GmbH, underscoring a consistent trend in their victimology.

SOCRadar’s analysis of stealer-log telemetry revealed no records associated with the domain novaflex[.]com, which is linked to Flexmaster. It is important to note that this dataset is paginated and sampled, meaning that credential exposure under alternative domain aliases or outside the queried data scope cannot be ruled out. Therefore, the absence of positive signals in this specific search does not confirm that the organization is unaffected by credential compromise. The lack of direct correlation in the stealer-log telemetry means that a pre-intrusion foothold established through infostealer malware cannot be confirmed or excluded for Flexmaster. The possibility of compromised credentials existing under different domain names or within data feeds not included in the analyzed sample remains. Appropriate follow-on actions should include continued monitoring of the novaflex[.]com domain and any identified associated domain aliases within stealer-log feeds. This ongoing surveillance is crucial for detecting any potential credential exposure that could indicate an initial access vector for ransomware operations.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.