Pillar Resource Services Listed by Royal Ransomware Group

On January 21, 2023, Canadian steel fabrication company Pillar Resource Services appeared on the leak site operated by the Royal ransomware group. The listing states that internal files were exfiltrated during a ransomware attack on the firm’s Edmonton, Alberta facility. The disclosure does not specify the number of people affected, the exact volume or types of documents taken, or any ransom demand.

Details in the Leak-Site Listing

The primary source, hosted on the Royal ransomware leak portal and indexed by ransomware.live, states that Pillar Resource Services was listed following a successful compromise of its networks. The entry includes the company’s full street address at 4155-84th Avenue in Edmonton, along with main phone, fax, shipping fax, and two email addresses: orderdesk@pillar.ca and info@pillar.ca. No sample data files are publicly shown in the initial listing, and the disclosure does not quantify how many internal documents were allegedly stolen or whether customer, employee, or vendor records were included. The incident is classified by the threat actor as a ransomware event involving both encryption and data exfiltration.

Why This Matters for You and Your Family

When a regional manufacturer like Pillar Resource Services loses control of internal files, anyone whose personal information passed through that company may now face long-term exposure. Suppliers, contractors, employees, and even local residents whose data appeared in invoices, contracts, employment records, or safety documentation could see their details surface later in identity-theft operations. Because the leak-site listing does not detail what was taken, you cannot assume your information is safe simply because you have not yet received a direct notification. Any records shared with the company before January 2023 must be treated as potentially compromised until proven otherwise.

Doxxing and Identity-Chain Risks

Internal files from fabrication firms routinely contain names, addresses, dates of birth, phone numbers, email accounts, and sometimes driver’s license or SIN references tied to employment, insurance, or background checks. Once such data reaches a ransomware leak site, it becomes raw material for doxxing chains that link workplace identities to home addresses, family members, and online handles. A single leaked work email can be cross-referenced with gaming accounts, social-media profiles, or reused passwords, allowing attackers to map an entire household. Credential leaks of this nature frequently cascade into account takeovers on personal services that have no direct connection to the original victim company.

Royal Ransomware Group Track Record

Public reporting attributes the Royal ransomware group with emerging in early 2022 as a double-extortion operation that combines file encryption with public shaming on its dedicated leak site. The group has targeted organizations across North America and Europe, including manufacturing, healthcare, and professional-services firms. Its typical playbook begins with initial access gained through phishing, remote-desktop protocol brute force, or exploited vulnerabilities, followed by lateral movement, data exfiltration, and deployment of custom ransomware. Royal operators then wait for payment deadlines to expire before publishing victim data in batches, using the threat of further leaks or sale to third parties as leverage. The group’s leak site continues to list new victims on a regular basis, indicating sustained operational capability.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Rotate any password you ever used at Pillar Resource Services or its associated domains, then enable 2FA through an authenticator app rather than SMS.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours instead of months.
• Cover the household with DoxxScan family protection that extends to dependents and children’s gaming accounts, which often chain back to the same leaked address or parent email.
• Let DoxxScan remediation specialists manage takedown requests for any exposed personal records appearing on data-broker or extortion sites.

The incident underscores that even mid-sized industrial companies hold sensitive personal data whose compromise can ripple outward for years. Treating every vendor breach as a personal exposure event, rather than waiting for formal notice, remains the most practical defense. Start your DoxxScan trial today for continuous monitoring, AI-powered identity-chain mapping, and hands-on remediation by specialists that protects both you and your family, including gaming accounts vulnerable to credential-stuffing attacks that follow leaks like this one.