[WORLDLEAKS] – Ransomware Victim: Coilplus
![[WORLDLEAKS] - Ransomware Victim: Coilplus 1 image](https://www.redpacketsecurity.com/wp-content/uploads/2024/09/image.png)
NOTE: No files or stolen information are exfiltrated, downloaded, taken, hosted, seen, reposted, or disclosed by RedPacket Security. Any legal issues relating to the content should be directed at the attackers, not RedPacket Security. This blog is an editorial notice informing that a company has fallen victim to a ransomware attack. RedPacket Security is not affiliated with any ransomware threat actors or groups and will not host infringing content. The information on this page is automated and redacted whilst being scraped directly from the WORLDLEAKS Onion Dark Web Tor Blog page.
AI Generated Summary of the Ransomware Leak Page
On October 16, 2025, a leak post published by the ransomware actor group worldleaks identifies Coilplus, a United States-based manufacturer in the metal processing sector, as a victim of a cyber intrusion. The post describes Coilplus as a company founded in 1985 in Illinois with a global footprint including facilities in Mexico, Spain, and China, emphasizing a commitment to quality control and expert engineering. The post does not specify whether the impact is encryption or data leakage, and no ransom amount or demand is provided in the available metadata. There is a reference to a claim URL on the leak page, indicating additional information exists elsewhere, though no actual link is shown in this summary. The page itself shows no visible screenshots or downloadable content; there are zero images and no downloadable files mentioned.
From the metadata, the leak page appears to function primarily as a high-level corporate profile rather than a dump of internal documents. The page provides background on Coilplus’s business in metal coil processing, including slitting, roll forming, and cut-to-length lines, but does not reveal any sensitive data within the post itself. Given the absence of attached images or files (images_count = 0, downloads_present = false, link_count = 0), there is no visible evidence of data exfiltration or encryption on the page. The post date is used as the release date, with no explicit compromise date provided beyond the stated timestamp, and there are no ransom figures or detailed incident indicators included in the published content. The entry references a claim URL, suggesting more information exists beyond what is displayed here, but no direct link is included in this summary.
Support Our Work
A considerable amount of time and effort goes into maintaining this website, creating backend automation and creating new features and content for you to make actionable intelligence decisions. Everyone that supports the site helps enable new functionality.
If you like the site, please support us on Patreon or Buy Me A Coffee using the buttons below.