SIFCO Industries INC. Data Breach

metaencryptor has targeted SIFCO Industries INC., a U.S.-based manufacturer specializing in precision forgings and machined parts for the defense and aviation sectors. The listing occurred on September 7, 2026, and was identified through SOCRadar’s Dark Web Monitoring. SIFCO’s operations, which involve supplying critical components to major defense contractors and government programs, make it a high-value target for ransomware and extortion campaigns due to the sensitive nature of its work and the potential impact of disruption. The metaencryptor group has been active, claiming 10 other victims in the past 60 days across the Healthcare, Manufacturing, and Other sectors. Their operations are primarily concentrated in the United States, Canada, and Singapore. Recent manufacturing victims in the U.S. include FactoryFive, Hologic Inc., Aquamar Inc., and Weber Water Resources. SIFCO Industries INC.’s profile as a U.S.-based manufacturer with defense industry ties aligns with metaencryptor’s typical targeting patterns.

SOCRadar’s analysis of stealer-log telemetry for sifco[.]com returned zero records within the queried dataset. It is crucial to understand that a null result does not confirm the absence of compromise. These datasets are often paginated and sampled, meaning that credentials may exist in other data feeds, under alternate corporate domains, or associated with personal email aliases. Furthermore, any identified credentials could have been utilized and subsequently rotated before being indexed by the telemetry. Infostealer-harvested credentials are a known initial access vector employed by the metaencryptor ransomware group. Therefore, the absence of direct evidence in the queried stealer logs does not rule out this pathway as a potential method of intrusion for this incident. The group’s modus operandi often involves leveraging compromised credentials to gain a foothold within targeted networks before deploying ransomware. The null result from the stealer-log telemetry does not preclude the possibility of a compromise via stolen credentials. Organizations should consider continuous monitoring of dark web forums and stealer-log feeds for any mention of their domains or credentials. Proactive measures such as credential hygiene checks, mandatory password rotation, and rigorous review of multi-factor authentication configurations for all remote access points, including Microsoft 365 and VPNs, are strongly recommended. Monitoring for unusual activity on alternate corporate domains and within remote-access portals remains a critical defense strategy.

This report is intended for threat intelligence and security awareness purposes. SOCRadar does not host, redistribute or buy stolen data. All breach information reported here is collected from publicly accessible threat actor and ransomware portals. This content is intended to equip CTI teams with context around recent attacks. While we strive for accuracy, listings on ransomware leak and extortion sites cannot always be independently verified and may not reflect confirmed breaches. If you believe any data in this report is incorrect, please contact us.