M.C.S. Steel Public Company Limited · Breach

[Single source] Rhysida ransomware claims 4.2 TB theft at Thailand's M.C.S. Steel

Nov 09, 2026 · 1 min read

The Rhysida ransomware gang has listed M.C.S. Steel, Thailand's largest structural-steel fabricator and a SET-listed company, on its leak site. The group claims 2.3 million files (4.2 TB), including executive payroll, advisor contracts, staff identity documents and work permits, plaintext SQL credentials, and confidential project data tied to major Japanese construction contractors. The claim has not been confirmed by the company.

By HIFY Radar newsroom Updated 11/09/2026 02:18 PM Get this every day →← Back to the feed 1 source

MediumBreachNo software to update

In 30 seconds

Observed

The Rhysida ransomware gang has listed M.C.S. Steel Public Company Limited: Thailand's largest structural-steel fabricator and a SET-listed company (ticker MCS): on its leak site, according to threat-intelligence account DailyDarkWeb.

Alleged

Rhysida claims to hold 2.3 million files totaling 4.2 TB, including executive payroll, advisor contracts, staff identity documents and work permits, plaintext SQL credentials, and confidential project data tied to major Japanese construction contractors. M.C.S. Steel has not confirmed an incident, and no samples have been independently verified.

What happened

Observed

A post by DailyDarkWeb on X reports that Rhysida added M.C.S. Steel Public Company Limited to its leak site. M.C.S. Steel is described as Thailand's largest structural-steel fabricator and is publicly traded on the Stock Exchange of Thailand under the ticker MCS.

Alleged

According to the report, the gang claims the stolen corpus comprises 2.3 million files (4.2 TB) spanning executive payroll and advisor contracts, staff identity documents and work permits, plaintext SQL credentials, and confidential project data connected to major Japanese construction contractors.

Why it matters

Inferred

The analyst note accompanying the report warns that Rhysida often adds governance "findings" to its leak-site claims in order to pressure listed companies, so claims about related-party payments should be expected to draw attention if this campaign follows the group's usual pattern.

Inferred

If the claims are accurate, M.C.S. Steel staff would face identity-fraud risk from exposed identity documents and work permits, and the project data of partner firms: including major Japanese construction contractors: would be exposed.

What to do

Observed

The reporting account explicitly advises treating this as an unverified threat-actor claim and not as confirmation of a breach; readers should await an official statement from M.C.S. Steel.

Inferred

Until samples are independently verified, monitoring the Rhysida leak site for published data and watching for a company disclosure are the most defensible next steps; staff and partners named in the claims should be alert to potential misuse of identity documents if verification later confirms the theft.

Confirmed and still uncertain

Observed

Known: Rhysida has listed M.C.S. Steel on its leak site, and the gang publicly claims 2.3 million files (4.2 TB) covering payroll, contracts, identity documents, SQL credentials, and project data.

Observed

Unknown: M.C.S. Steel has not confirmed an incident, no samples have been independently verified, and no details are yet available on the intrusion method, timeline, or ransom demand.

What people are saying

Observed

DailyDarkWeb, the threat-intelligence account that surfaced the listing, states that M.C.S. Steel has not confirmed an incident and that no samples have been independently verified, framing the event as an unverified threat-actor claim rather than a confirmed breach.

Alleged

The same account's analyst note predicts Rhysida may append governance-related allegations, such as related-party payments, to increase pressure on the SET-listed company.

Evolution

Observed

The public record currently consists of the initial leak-site listing as reported by a single threat-intelligence account; no published samples, deadline, or countdown details were included in that report.

Inferred

The story is at its earliest stage: a claim, a listing, and no corporate response yet. Expect the narrative to shift depending on whether M.C.S. Steel issues a statement and whether Rhysida publishes samples or additional governance allegations.

Reach

Observed

1 independent groups, 1 updates, and 0 engagements.

Technical detail

Alleged

The claim includes plaintext SQL credentials among the stolen material; if accurate, this would indicate that database credentials were stored unencrypted and that the attackers obtained access to internal database infrastructure.

Inferred

Rhysida operates a leak site used to publicize stolen data as extortion leverage, which is the mechanism by which the M.C.S. Steel listing became visible; no technical indicators of compromise or intrusion details were included in the report.

Sources and evidence

Observed

This item is based on a single source: a post by the DailyDarkWeb account on X reporting the Rhysida leak-site listing and the gang's claims. All figures and file inventories originate from the threat actor via that report and remain unverified.

Observed

Evidence gaps remain significant: there is no victim confirmation, no independently verified sample, and no corroboration from a second source at the time of compilation.