Skip to content
Leak-site post naming CP Manufacturing, Inc., captured by ThreatCluster

CP Manufacturing, Inc.

aurora

Ransomware leak-site victim intelligence

Files
6
Views
6,239
Posted
Oct 30, 2026
Country
United States
Industry
manufacturing - waste sorting and recycling equipment (MRF systems)

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The group states six files were taken from CP Manufacturing, Inc., a San Diego-based industrial manufacturer of waste sorting and recycling equipment with reported revenue of $109.1M. They claim the data taken includes HR records, finance data, engineering data, legal documents, operations data, sales data, customer contracts, NDAs, vendor records, and PII. The post is in countdown status with six days remaining, and identifies CP Manufacturing, Inc. as the victim with San Diego headquarters.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
Sage ERP Epicor ERP AutoCAD Electrical Artec 3D SolidWorks Electrical FabriWin SQL Server
People named
Hans Ouellet

What was taken

CP Manufacturing, Inc. is a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems). The page describes a dataset including HR, finance, engineering, legal, operations, and sales infrastructure, with ERP data showing revenue of $109.1M for FY2024, extensive sensitive data including SSNs, payroll records, vendor records, NDAs, legal materials, and intellectual property.

Data categories
HR recordsfinance dataengineering datalegal documentsoperations datasales datapersonal data (PII)payroll recordstax filings (ACA 1095-C)vendor recordsNDAsintellectual propertyERP datacontracts
File types seen
csv × 2txt × 2ovpn × 1xlsx × 1
Sample files (6)
1823 Charlotte MRF.ovpn
cpmfg_vendor_202608201000.csv
EWON Customer List 2024-1-6.xlsx
Passwords.txt
PP20260514184000.txt
Truist_CP_001005_20250928181508.csv

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Phone
619-477-3175
Address
6795 Calle de Linea San Diego, CA 92154
address
6795 Calle de Linea San Diego, CA 92154
Data Publishing
4 days : 11 hours : 34 min : 26 sec

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture