GLOBALMalwareEnergy & UtilitiesUtilitiesRansomwareDragonforceRansom DemandedActor NamedData Leak ThreatenedMedium

STEP Oiltools

bd_c783393273caaf59 · schema v1 · pii pii-v1

Threat-actor claim — not a regulatory filing

This row is a claim by the ransomware group DragonForce on its public extortion blog. It has not been validated by the victim or any regulator. Treat attribution and counts as the threat actor's assertion until a regulatory filing or victim disclosure corroborates them.

Group activity: EnergyDiscovered: 2026-07-12

View aggregator listing on ransomware.live

Source: Ransomware.live

Post text · scraped from the leak site

STEP Oiltools is a leading global provider of solids control and drilling waste management services, primarily serving the oil and gas and civil engineering industries. The company offers a range of products including mini separation systems, modular recyclers, and dewatering systems, aimed at enhancing efficiency and sustainability in drilling operations. With a commitment to health and safety, STEP Oiltools has received recognition for its high standards in workplace safety. Their clientele includes major players in the energy sector, civil construction, and water treatment markets.

Tracked as a single-filing incident — the only disclosure on record for this event so far.Unverified claimView incident

No regulatory filing corroborates this yet. If an SEC 8-K, state-AG notice, or victim statement lands, DisclosureLens will merge it into an incident and link it here.

Source provenance

Source URL: https://www.ransomware.live/id/U1RFUCBPaWx0b29sc0BkcmFnb25mb3JjZQ==
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jul 12, 2026
Raw hash: d830496064d822582044f260560558bc3520d086bbbd231942990bb4bcff95dc

Reporting entity

Name: dragonforce

Victim entity

Name: STEP Oiltools
norm: step oiltools
Domain: stepoiltools.com
Industry: Energy & Utilitiesllm

What this source establishes

Source ceiling: A leak-site claim can't tell us: discovery date · materiality · notification · affected count · confirmed data types · compliance clock. These stay blank until a regulatory filing or victim disclosure lands.
Attack vector: Ransomware· dragonforce
Threat actor: DragonforceExternalFinancial

Compliance

Compliance flags: — (clock not assessable for this source)

Extraction provenance

Status: No extraction artifact recorded for this disclosure.