The Recycler Core Listed by ElDorado Ransomware Group

On November 18, 2024, The Recycler Core appeared on the ElDorado ransomware group's leak site, claiming that the Virginia-based scrap-metal and catalytic-converter supplier had been hit by a ransomware operation. The company, which reported $20.4 million in revenue last year, supplies cores, used equipment, and scrap materials to multiple industries. The listing states that internal files were exfiltrated during the attack; the exact number of records exposed and the specific data types remain undisclosed by both the group and the victim.

Primary Disclosure Details

The ElDorado leak site entry, mirrored on ransomware.live, explicitly lists The Recycler Core and claims successful data exfiltration following a ransomware deployment. It does not quantify affected records, name the systems compromised, or reveal the ransom demand. The disclosure indicates that internal files were taken; no further technical details about the initial access vector or exfiltration method are provided in the primary listing. As of the publication date, The Recycler Core has not issued a public breach notification detailing the incident.

Why This Matters for You and Your Family

When a company like The Recycler Core that handles supplier contracts, customer invoices, and employee payroll data is breached, the information can quickly reach identity thieves, fraud rings, and extortionists. Even though the precise data set is unknown, internal files almost always include names, addresses, Social Security numbers, financial account details, or vendor records that can be used to file fraudulent tax returns, open accounts in your name, or pressure you with personalized threats. If you or your family have done business with scrap-metal recyclers, catalytic-converter suppliers, or any of The Recycler Core’s industrial customers, your information may be among the stolen material. The breach therefore creates direct exposure for ordinary people whose data travels through supply chains most never think about.

Doxxing and Identity-Chain Risks

Stolen internal files frequently contain email addresses, phone numbers, and employee or customer usernames that link disparate online handles to real-world identities. Once attackers correlate these fragments, they can hijack accounts across services, escalate privileges, and build detailed profiles for long-term fraud or extortion. Credential leaks of this kind routinely cascade into gaming-account takeovers; children’s usernames and shared family passwords become entry points for further doxxing. The identity chain that begins with one supplier breach can expose your home address, family relationships, and financial footprint faster than most people realize.

ElDorado Ransomware Group Track Record

Public reporting attributes ElDorado as a relatively new ransomware-as-a-service operation that emerged in 2024. The group follows a double-extortion playbook: deploy ransomware to encrypt systems, exfiltrate sensitive files beforehand, then threaten to publish the data unless payment is made. Notable prior victims listed on their leak site include mid-sized manufacturing, logistics, and service companies. Their typical pattern involves phishing or exploited remote-access tools for initial access, followed by quiet data theft before encryption. The group’s leak-site postings are used both to pressure victims and to advertise their affiliate program to other criminals.

What to do

• Run a DoxxScan to map every link between your handles, emails, phone numbers, and real identity, with cleanup handled by the service.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next exposure surfaces in hours rather than months.
• Rotate any password you have reused at The Recycler Core or its vendor portals, then enable 2FA through an authenticator app everywhere that credential was used.
• Cover the entire household with DoxxScan family protection that extends to dependents and children’s gaming accounts tied to the same address or shared credentials.
• Let remediation specialists manage data-broker takedown requests and follow-up monitoring for you instead of attempting manual removal across dozens of sites.

The incident underscores how supply-chain breaches now reach ordinary families through vendors they rarely consider. Starting proactive defense today limits the damage from leaks that have already occurred and from those still to come. DoxxScan by GalaxyWarden delivers continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping, hands-on remediation by specialists, and full household coverage that includes children’s gaming accounts at risk of cascading takeovers.