DistributionNOW (DNOW Inc.) Listed by Falcon Ransomware Group

Your account credentials with DistributionNOW may now be part of an extortion attempt. The ransomware group Falcon has listed DNOW Inc. on its leak site, claiming to hold 182 GB of compressed data belonging to the energy and industrial distribution company. As of today, DistributionNOW has not publicly confirmed the claim.

This means the passwords you use for your DistributionNOW account could be at immediate risk of being tested elsewhere.

What a Leak-Site Listing Actually Establishes

Falcon’s post is an accusation, not evidence. Ransomware and extortion crews routinely publish listings on leak sites to pressure victims into paying. These claims are often exaggerated, recycled from older incidents, or entirely fabricated. The presence of a company name on such a site does not prove that a breach occurred, that data was successfully exfiltrated, or that the claimed 182 GB even exists.

Real confirmation would require an admission from DistributionNOW, a regulatory filing detailing the incident, or independent verification by a third-party investigator. None of those have happened. Until they do, this remains an unverified claim. The absence of any enumerated data categories in the public record further limits what can be assumed. The filing does not state how many people were affected, nor does it describe the origin of the claimed data.

The Wider Ransomware-Extortion Pattern

Groups like Falcon increasingly use leak sites as a standard pressure tactic rather than solely as a data dump. Publishing a company’s name creates public doubt and internal urgency even when the underlying claim is weak. This blurs the line between genuine compromise and extortion theater, making it harder for customers to know how seriously to take any single listing.

The pattern is now familiar: a large compressed volume is announced, dramatic screenshots sometimes appear, and the company is given a deadline. Many such listings never lead to confirmed breaches.