Loading story…
Sedgwick, a major claims management and risk solutions provider, confirmed a ransomware attack targeting its U.S. federal contractor subsidiary, Sedgwick Government Solutions. The TridentLocker ransomware group claimed responsibility for the incident, announcing the theft of 3.4GB of data from an isolated file transfer system on New Year's Eve. Sedgwick Government Solutions supports several key U.S. federal agencies, including DHS, ICE, CBP, USCIS, DOL, and CISA. The company emphasized that the affected system was segmented from core operations, with no evidence of access to claims management servers or disruption to client services.
Following detection of the breach, Sedgwick activated its incident response protocols, engaged external cybersecurity experts, and notified law enforcement and impacted customers. TridentLocker, an emerging ransomware-as-a-service group, has targeted multiple sectors since its launch in late 2025, using double-extortion tactics. Security professionals are advised to monitor for indicators of compromise related to TridentLocker and to prioritize network segmentation, especially in federal contractor environments, to mitigate similar risks.
TTPs, infrastructure, and targeting history in one profile.
5 events from the most recent confirmed update back to the earliest known activity.
In early January 2026, Sedgwick publicly disclosed a cybersecurity incident affecting Sedgwick Government Solutions. The company confirmed the breach was limited to the subsidiary's isolated file transfer system and said the investigation was ongoing.
Following discovery of the breach, Sedgwick isolated affected systems, engaged external cybersecurity experts, notified law enforcement, and began informing affected customers. The company said client services were not disrupted and broader Sedgwick operations were unaffected.
On or around New Year's Eve 2025, TridentLocker added Sedgwick Government Solutions to its Tor leak site and claimed to have exfiltrated roughly 3.39 to 3.4 GB of data, publishing some of the allegedly stolen material. The public claim linked the incident to the ransomware group, though Sedgwick itself did not publicly attribute the breach to a specific actor.
Around December 30, 2025, Sedgwick Government Solutions suffered unauthorized access to an isolated file transfer system. Sedgwick said the affected environment was segmented and that there was no evidence claims management servers or broader company systems were accessed.
The TridentLocker ransomware-as-a-service group emerged in late November 2025 and began posting victims on its leak site. By early January 2026, reporting said the group had claimed around 12 organizations across multiple sectors and regions.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcethecyberthrone.in
Open sourcebleepingcomputer.com
Open sourcesecurityaffairs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
San Jose officials notified current and former city employees that a **USB drive was lost** on Jan. 9 and may have contained sensitive employee data, including **Social Security numbers**; the city has not disclosed how many individuals were affected. Separately, **Conduent Business Services** reported a large-scale compromise in which attackers allegedly accessed its network from **Oct. 21, 2024 to Jan. 13, 2025** and exfiltrated files containing personal and medical data; multiple state-level notices and alerts cited impacts ranging from **10.5 million** individuals (Oregon DOJ alert) to **4 million** residents (Texas), with Conduent stating it has not seen evidence of misuse or public posting to date. In another incident, **Managed Care Advisors / Sedgwick Government Solutions** disclosed a ransomware event affecting a corporate **SFTP server** that stored **PII/PHI**; the company said the intrusion began **Nov. 16, 2025** via exploitation of a vulnerability in the SFTP application, was detected **Dec. 4, 2025**, and resulted in encryption of files on that server only. Sedgwick reported it disabled SFTP connections, restored data from backups the next day, and engaged **Mandiant** for forensic support, stating the investigation found no compromise beyond the single server.
Jul 12, 2026
Jewett-Cameron Trading Company, a leading manufacturer and distributor of fencing, pet, and industrial wood products, experienced a significant cybersecurity incident involving a ransomware attack. On October 15, 2025, the company detected unauthorized access to its IT environment, which was later disclosed in an SEC 8-K filing. The attackers deployed encryption and monitoring software on portions of the company’s internal corporate systems, disrupting business applications and limiting access to certain operational and corporate functions. As a precaution, Jewett-Cameron voluntarily took some systems offline to contain the incident. The ransomware gang exfiltrated sensitive data, including images of video meetings, computer screens, and non-public financial documents, some of which were being prepared for the company’s annual SEC report. The threat actors threatened to publicly release the stolen information unless a ransom was paid, increasing the pressure on the company. The company’s 8-K filing confirmed that law enforcement was notified and external cybersecurity experts were engaged to assist with the investigation and recovery efforts. The breach’s full impact on records and data types remains under investigation, but it is confirmed that sensitive company information was accessed and exfiltrated. The company’s operations were disrupted, though the incident was reported as contained at the time of disclosure. Jewett-Cameron’s response included activating its cyber incident response process, assessing the scope of the breach, and implementing remedial measures to secure its systems. The company did not disclose whether any ransom was paid or if any data had been released by the attackers. The incident occurred during a critical period as the company was preparing its annual financial filings, potentially increasing the risk of exposure of sensitive financial data. The company’s public communications emphasized its commitment to transparency and regulatory compliance by promptly filing the required SEC disclosure. The attack highlights the ongoing threat of ransomware to manufacturing and distribution companies, particularly those handling sensitive financial and operational data. The use of monitoring software by the attackers suggests a period of surveillance prior to data exfiltration and encryption, indicating a sophisticated approach. The company’s swift engagement with law enforcement and cybersecurity professionals reflects best practices in incident response. The long-term impact on Jewett-Cameron’s business operations, reputation, and regulatory standing remains to be fully assessed as the investigation continues. The incident underscores the importance of robust cybersecurity measures and incident response planning for organizations in the manufacturing and distribution sectors.
Jul 12, 2026
Russian-speaking ransomware group Lynx executed a significant cyberattack against Dodd Group, a major UK Ministry of Defence (MoD) contractor, resulting in the theft and subsequent leak of approximately 4 terabytes of sensitive data. The breach targeted Dodd Group, a Shropshire-based firm providing electrical and mechanical services to British military bases, and exposed confidential information related to both the company and the MoD. The stolen data, which the Lynx group began leaking on their Tor data leak site, includes staff names, email addresses, contractors’ names, phone numbers, car registrations, and MoD personnel contact details. Some of the compromised documents were marked as “Controlled” or “Official Sensitive,” indicating the high level of sensitivity and potential national security implications. The leaked files reportedly contain information on at least eight Royal Air Force (RAF) and Royal Navy bases, including RAF Lakenheath, which hosts US F-35 jets and is believed to house nuclear weapons, RAF Portreath, a NATO radar site, and RAF Predannack, the UK’s National Drone Hub. Visitor logs for RAF Portreath and RNAS Culdrose were among the documents exposed, raising concerns about operational security and the safety of military personnel. The attack was described as “catastrophic” by The Daily Mail, highlighting the scale and impact of the breach. The Dodd Group, which employs over 1,100 people and operates across multiple sectors, confirmed the cyber incident and is cooperating with authorities. The UK Ministry of Defence has launched an investigation into the breach, emphasizing its robust and proactive approach to cyberthreats but declining to comment further on operational details. The Lynx group, considered a successor to the INC criminal operation, reportedly began leaking the data after failed negotiations with the victim. The breach has raised alarms about the security of third-party contractors and the potential exposure of sensitive military infrastructure and personnel information. The incident underscores the growing threat posed by ransomware groups targeting critical defense supply chains. The leak of documents related to ongoing projects, such as the installation of oil tanks and new lighting at military bases, further illustrates the operational risks introduced by such breaches. The exposure of sensitive data could have long-term implications for the security posture of the UK’s defense sector. Authorities are assessing the full extent of the compromise and working to mitigate potential risks to national security and military operations.
Jun 29, 2026