GLOBALMalwareConstructionRansomwareSinobiRansom DemandedActor NamedData Leak ThreatenedData PublishedHigh

CPS

bd_6b3645215094bc3a · schema v1 · pii pii-v1

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group Sinobi on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: ConstructionDiscovered: 2025-12-09

View aggregator listing on ransomware.live

Source: Ransomware.live

Post text · scraped from the leak site

CPS, Ltd. is a full-service engineering firm based in Grand Forks, ND, specializing in municipal engineering, transportation, water resources, solid waste management, and construction engineering. Established in 1979, the company aims to provide innovative, technically sound designs tailored to meet the unique needs of clients in communities, companies, and governmental agencies across North Dakota and northwest Minnesota. Their services also include land planning and surveying, ensuring accurate data and documentation for a variety of projects. CPS, Ltd. is committed to leveraging its experience and expertise to support clients in achieving successful project outcomes.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

No regulatory filing corroborates this yet. If an SEC 8-K, state-AG notice, or victim statement lands, DisclosureLens will merge it into an incident and link it here.

Source provenance

Source URL: https://www.ransomware.live/id/Q1BTQHNpbm9iaQ==
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Dec 9, 2025
Raw hash: 39b278fee144552be56aced2742f5922b66f7b7e784c5b4dc93004382093deeb

Reporting entity

Name: sinobi

Victim entity

Name: CPS
norm: cps
Domain: cpsenergy.com
Industry: Constructionllm

What this source establishes

Source ceiling: A leak-site claim can't tell us: discovery date · materiality · notification · affected count · confirmed data types · compliance clock. These stay blank until a regulatory filing or victim disclosure lands.
Attack vector: Ransomware· sinobi
Threat actor: SinobiExternalFinancial

Compliance

Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.