DisclosureLens
GLOBALUnknownRansomwareUndergroundLow

Sheng Yu Steel Co., Ltd.

bd_b9c42ecd88d23cbc · schema v1 · pii pii-v1

Severity

Low

Discovered

—

Filed

Mar 30, 2025

To disclose

—

Affected

Not disclosed

Linked

2 filings

Confidence

60%
Full breach record for Sheng Yu Steel Co., Ltd. →

Press / market disclosure — not a breach-notification filing

A media or market posting that confirms an incident but carries no breach-notification fields, so compliance clocks aren't assessable. The summary below is extracted from the coverage — verify against the source.

Today's Information. SHENG YU STEEL CO., LTD.: A cyberattack struck the company on March 30, 2025, infecting certain hosts and computers with viruses. The security team activated defense mechanisms and collaborated with experts to contain the attack, with no loss of personal or confidential data. The company has launched an investigation and is currently strengthening its infrastructure security to prevent future attacks. Linked ransomware group: underground.

Incident timeline — mostly unverified

? — ?

Breach window unknown

Mar 30, 2025

Press report

—

Corroborated · see linked filings

Compliance clocks stay unassessable until a regulatory filing lands. Dashed segments fill in automatically when corroboration arrives.

Attack → press

—

Compliance clock

Not assessable

This filing is one of 2 about the same incident.View merged incident

Linked disclosures

Why this link?

Ransomware claims (1)

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market reportThis record

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filing

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source ceiling

  • incident type + narrative only (may be machine-translated)
  • discovery date
  • materiality
  • affected count
  • data types
  • compliance clock

The ✕ fields stay blank until a regulatory filing or victim disclosure lands.

About this groupFirst seen 2023-05-30

underground

According to ransomware.live, Underground ransomware is deployed by the Russia-based RomCom group (Storm-0978) and has victimized companies across multiple industries since July 2023 by exploiting CVE-2023-36884, encrypting files without changing extensions and deleting Volume Shadow Copies and Windows event logs in double-extortion campaigns.

26 victims claimed globally26 tracked hereFull profile →