Global Friction Products, Inc Data Breach

Orova added Global Friction Products, Inc to its dark web portal on August 4, 2026, a listing that was identified by SOCRadar’s Dark Web Monitoring on the same day. Global Friction Products, Inc is a manufacturing company based in the United States, falling within an industry sector frequently targeted by ransomware operations. This specific listing was part of an initial wave of Orova activity observed by SOCRadar, rather than a pattern of sustained postings. All of Orova’s other 23 claimed victims from the preceding 60 days were included in this August 4 batch, suggesting a concentrated release of data or claims. The ransomware group tends to target healthcare, manufacturing, and financial services sectors, although a notable portion of their listings do not specify an industry. Their victims are primarily located in the United States, Hong Kong, and Taiwan. Global Friction Products, Inc, as a US-based manufacturing entity, aligns with the group’s targeting patterns, alongside other manufacturing victims like Tat Fung Textile Co., Ltd., SBI Manufacturing, Conceptual Designs, Inc., and Integrated Site Management.

SOCRadar’s stealer-log telemetry analysis did not return any records for the domain globalfrictionproducts[.]com within the queried dataset. It is important to note that this finding represents a null result in a paginated sample and does not confirm that the organization is unaffected by data compromise. Exposure of credentials may still exist through legacy domains, regional subsidiaries, or the use of personal email aliases on corporate systems, none of which would be captured by this specific lookup. The result has been logged as no_exposure_in_sample, and the domain will remain under watch. For threat actors like Orova, the exploitation of credentials harvested by infostealers represents a common pathway for initial access. Operators or access brokers often acquire fresh logs from underground marketplaces, validate corporate credentials, and subsequently use them to gain access to systems such as Microsoft 365, VPNs, or remote-access portals before initiating ransomware deployment. The current telemetry findings do not definitively confirm or deny this specific intrusion path, highlighting the importance of ongoing monitoring and proactive credential hygiene.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.