M.C.S. Steel Public Company Limited Data Breach: Rhysida Ransomware Claim (Nov 2026)
Summary
In the latest cybersecurity news, M.C.S. Steel Public Company Limited — an organization based in TH — has fallen victim to a ransomware attack conducted by the group rhysida. This data breach, discovered on 2026-11-09T17:27:39.431342+00:00, underscores the increasing need for proactive cybersecurity defenses as we continue through 2026.
Incident Report
| Attribute | Information |
|---|---|
| Target Organization | M.C.S. Steel Public Company Limited |
| Threat Group | rhysida |
| Summary | M.C.S. Steel Public Company Limited M.C.S. Steel Public Company Limited – largest structural-steel fabricatorin Thailand, SET-listed (ticker MCS).Total files: 2,314,625Total volume: 4.2 TB’Senior Advisor to Chairmen of the Board’ paid 800,000 JPY/month viaTrust Engineering K.K. (Tokyo) to Keiyo Bank Chiba account 5376091,term Nov-2025..Oct-2027 – while Mr. Yokoyama Yukio also sits on MCSpayroll. Related-party flow outside SET disclosures.Chairman & CEO Dr. Naiyuan Chi carries a PAYROLL ‘advisor’ gross of12.92M THB/yr (2023-2026); lifetime net receipts ~79M THB (2015-2026).Advisor/consultant contracts to Haneishi, Iijima, Ogilvie, Yang -overlapping the company’s Japanese payroll.Identity documents of staff incl. Chairman’s daughter (Thai nationalIDs, passport, house registration), foreign managers’ work permits.Myanmar workshop staff charged 500-800 THB per clinic visit (signedmemo, 2023) – labour-protection exposure.Prior Faust ransomware infection inside the network (victim idA2242861-3499) – security failures never remediated; SQL credentialsand Windows OEM keys stored in plaintext.Confidential pipeline of Japan’s Big-5 contractors incl. site names. More |
| Date of Breach | 2026-11-09T17:27:13.431792+00:00 |
| Discovery Date | 2026-11-09T17:27:39.431342+00:00 |
| Region | TH |
| Business Sector | Manufacturing |
How to reduce your ransomware risk
Most ransomware intrusions start with a stolen password or a phishing email. A few proactive steps sharply cut your exposure:
- real-time breach alerts — close the gap attackers exploit.
- phishing simulations — close the gap attackers exploit.
Want to know if you’re already exposed? Run a free scan with the HookPhish data breach checker.
Disclaimer
HookPhish does not engage in the exfiltration, downloading, taking, hosting, viewing, reposting, or disclosure of any stolen information. All breach data reported here is sourced from publicly available threat intelligence feeds for awareness purposes only.
Related articles
Ransomware Group BYOD Hits: Texas HHSC
Ransomware Group HYFLOCK Hits: Cameroon government troops leaked
