Goodwill industries Listed by karakurt Ransomware Group

On December 21, 2022, Goodwill Industries appeared on the leak site operated by the karakurt ransomware group. The listing claims the attackers exfiltrated 403 GB of corporate data from Centrisys, a Wisconsin-based manufacturer of decanter centrifuges, and its subsidiary CNP Technology Water and Biosolids. Anyone whose personal or employment records passed through these companies may now face long-term exposure.

Details in the Leak Listing

The karakurt leak site states that internal files were taken during a ransomware attack. It does not specify the exact number of affected individuals, the precise data types beyond “corporate data,” or whether customer, employee, or vendor records were included. The posting offers 403 GB of material and follows the group’s standard practice of publishing proof-of-exfiltration samples after initial extortion attempts. No ransom demand figure is listed on the page, and the disclosure does not indicate whether any data has been sold to third parties.

Why This Matters for You and Your Family

When a manufacturer like Centrisys loses control of internal files, the information often includes employee names, addresses, Social Security numbers, payroll details, and vendor contracts. If you or a family member ever worked at Centrisys, CNP, or any of their wastewater-industry partners, your personal data may be sitting in an attacker-controlled archive. Even basic contact information can be combined with other breaches to build a complete profile that leads to identity theft, tax fraud, or targeted phishing. The uncertainty around the exact contents makes it impossible to dismiss the risk.

Doxxing and Identity-Chain Risks

Leaked corporate files frequently contain email addresses, usernames, and internal notes that link professional identities to personal ones. Attackers or buyers can chain these details with gaming accounts, social-media handles, and prior breach records to locate home addresses, family relationships, and children’s online profiles. A single exposed work email can unlock password-reset paths across personal services, turning one industrial breach into a gateway for account takeovers and doxxing campaigns.

Karakurt’s Known Track Record

Public reporting attributes the first karakurt activity to mid-2021. The group has targeted healthcare providers, manufacturers, and professional-services firms across North America and Europe. Its typical playbook involves gaining initial access through compromised credentials or vulnerable remote-desktop services, exfiltrating documents before encryption, then demanding payment to prevent publication. Karakurt rarely deploys ransomware payloads on victim networks; instead it relies on pure data extortion. The group maintains a leak site that lists victims who do not pay, sometimes adding fresh samples weeks after the initial posting.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you used at Centrisys or related systems wherever it has been reused, and switch to 2FA through an authenticator app instead of SMS.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same address or parent email.
• Let remediation specialists manage takedown requests for any exposed personal documents appearing on data-broker or extortion sites.

The Centrisys incident shows how quickly industrial data leaks can reach ordinary families through employment records. Acting promptly limits how far attackers can travel down the identity chain. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts. Start your DoxxScan trial today to lock down the exposure before it spreads further.