Skip to content
Leak-site post naming Southwire, captured by ThreatCluster

Southwire

helix

Ransomware leak-site victim intelligence

Posted
Oct 18, 2026
Country
US
Industry
Manufacturing

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post

The leak claims to have exfiltrated a broad set of Southwire business records, including customer and account data, orders and shipments, leads, opportunities, campaigns, projects, and related internal items; downloads are live. The leak page identifies Southwire as the victim, notes yearly revenue around $9 billion, and states that data is hosted on GoFile. The leak post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
GoFile

What was taken

Southwire. Yearly revenue ~$9 billion yearly. Downloads are live.

Data categories
ContactsAccountsShipmentOrder linesCustom ordersCaseCampaign membersDealOpportunitiesOrdersLeadsProjectsCase commentsUsersCampaignsNotesOpportunity contactsWork order linesAccount plansWork ordersEventsContracts

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Waiting room
Your place. Held. You have been placed in a queue, awaiting forwarding to the site. You are joining the line. Estimated wait: less than a minute . Please do not refresh the page. You will be forwarded automatically.

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture