ECO USA Data Breach

A ransomware group added ECO USA to its data leak site on October 18, 2026, claiming to have accessed the company’s systems and exfiltrated internal corporate data. ECO USA is a US-based manufacturing company engaged in industrial production operations. The group claims possession of sensitive internal files and has threatened public disclosure. The specific ransomware group behind this listing has not been named in available sources. Ransomware operators have maintained a consistent focus on US manufacturing throughout recent campaigns, with dozens of American industrial firms at varying scales appearing on extortion sites in recent months. The sector’s time-sensitive production dependencies and heterogeneous IT environments make it attractive for disruption-based extortion.

SOCRadar’s stealer-log analysis of domains associated with ECO USA returned no matching records. No employee or customer credentials were identified in the infostealer telemetry reviewed. Other vectors—phishing, exploitation of external-facing systems, or initial access broker activity—haven’t been ruled out, but infostealer-sourced credential compromise isn’t confirmed here. US manufacturing remains among the most heavily targeted sectors. ECO USA’s listing is consistent with ongoing broad targeting of industrial firms regardless of size. The absence of stealer-log records doesn’t meaningfully change the risk posture; the ransomware claim itself is the primary indicator requiring response. Prioritize vulnerability management for internet-facing systems. Segment production and corporate networks. Establish incident response procedures covering both IT and OT environments.