Ransomware group rhysida hits M.C.S. Steel Public Company Limited
M.C.S. Steel Public Company Limited — a manufacturing target operating in TH has been listed by the rhysida ransomware group on 2026-11-09. The information below reflects what the threat actor has publicly claimed on their leak site; the details have not been independently verified.
Incident Report
| Target Organization | M.C.S. Steel Public Company Limited |
|---|---|
| Threat Group | rhysida |
| Summary | M.C.S. Steel Public Company Limited, a manufacturing organization in Thailand, was listed by the rhysida ransomware group on its leak site on 2026-11-09. |
| Date of Breach | 2026-11-09 |
| Discovery Date | 2026-11-09 |
| Region | TH |
| Target Domain | — |
| Business Sector | Manufacturing |
| Severity | HIGH |
Claim by rhysida
M.C.S. Steel Public Company Limited M.C.S. Steel Public Company Limited - largest structural-steel fabricatorin Thailand, SET-listed (ticker MCS).Total files: 2,314,625Total volume: 4.2 TB'Senior Advisor to Chairmen of the Board' paid 800,000 JPY/month viaTrust Engineering K.K. (Tokyo) to Keiyo Bank Chiba account 5376091,term Nov-2025..Oct-2027 - while Mr. Yokoyama Yukio also sits on MCSpayroll. Related-party flow outside SET disclosures.Chairman & CEO Dr. Naiyuan Chi carries a PAYROLL 'advisor' gross of12.92M THB/yr (2023-2026); lifetime net receipts ~79M THB (2015-2026).Advisor/consultant contracts to Haneishi, Iijima, Ogilvie, Yang -overlapping the company's Japanese payroll.Identity documents of staff incl. Chairman's daughter (Thai nationalIDs, passport, house registration), foreign managers' work permits.Myanmar workshop staff charged 500-800 THB per clinic visit (signedmemo, 2023) - labour-protection exposure.Prior Faust ransomware infection inside the network (victim idA2242861-3499) - security failures never remediated; SQL credentialsand Windows OEM keys stored in plaintext.Confidential pipeline of Japan's Big-5 contractors incl. site names. More
Posted by the rhysida threat actor on its public leak site. This is the group's own statement and has not been independently verified by HackerFeeds.
Sources
Leak post (onion / Tor)
http://rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion/archive.php?company=301
Open this URL in Tor Browser. Browsing leak sites carries real risk — view passively, never click further.
Disclaimer
HackerFeeds does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.