us-duct.com Listed by lockbit5 Ransomware Group

On January 21, 2026, the LockBit ransomware group added us-duct.com to its leak site, claiming that it had exfiltrated internal files from US Duct Inc., a manufacturer of industrial duct systems based in the United States.

What's Publicly Reported from Reporting

Public reporting indicates the company designs and manufactures industrial duct products. The listing appeared on the LockBit 5 leak site, hosted on the dark web address lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion. Available reporting describes the data as internal files obtained during a ransomware attack, although the exact volume and full list of exposed records have not been independently verified. No customer count or specific data types such as names, addresses, or payment details have been publicly detailed in the initial posting.

Why This Matters for You and Your Family

When a company like US Duct suffers a breach, the information it holds about suppliers, partners, employees, and customers can end up in the hands of criminals. Internal files often contain spreadsheets, contracts, emails, or employee directories that include personal details. If your employer, your child’s school vendor, or a business you deal with uses similar suppliers, your information may already be one step removed from public exposure. Once that data reaches criminal forums, it rarely stays contained. Families end up dealing with spam, phishing attempts, or worse long after the initial breach is announced.

The Doxxing and Identity-Chain Risks

Stolen internal files frequently contain email addresses, phone numbers, and employee names that attackers link to personal accounts elsewhere. A single work email from the breach can be matched to your home address, social-media handles, or children’s gaming usernames. These connections create what security analysts call an identity chain. One exposed credential leads to account takeovers on email, banking, or gaming platforms. Gaming accounts belonging to you or your children are especially vulnerable because kids often reuse simple passwords or email addresses tied to family domains. Public reporting shows these chains frequently escalate into full doxxing, where attackers publish home addresses, phone numbers, and family member names to pressure victims or sell the information.

LockBit’s Publicly Known Track Record

Public reporting attributes the LockBit ransomware operation to a group that first emerged in 2019. It has targeted organizations across healthcare, manufacturing, education, and government sectors. Notable prior victims include numerous private companies whose data appeared on successive versions of the LockBit leak site. The group’s typical playbook involves gaining initial access through compromised credentials or vulnerable remote desktop services, exfiltrating sensitive files before encrypting systems, then publishing samples on its dark-web portal with an extortion deadline. In many cases the group demands payment to prevent full data release. The exact operators behind LockBit 5 remain under active investigation by law enforcement.

What to do

• Run a DoxxScan to map every link between your emails, phone numbers, handles, and real-world identity so you can see exactly what this claimed breach connects to.
• Rotate any password you used at US Duct or related vendor accounts and enable 2FA through an authenticator app rather than text messages.
• Enable continuous DoxxScan monitoring across 13.1B+ breach records and 100+ platforms so the next leak exposing you or your family is caught within hours instead of months.
• Cover the household with DoxxScan family protection that includes dependents and children’s gaming accounts which often chain back to the same addresses and emails.
• Let remediation specialists handle takedown requests for any personal information already appearing on data-broker or forum sites.

The speed with which ransomware groups publish stolen data continues to shrink. Taking concrete steps now limits how far this incident can reach into your life. DoxxScan by GalaxyWarden provides continuous monitoring across 13.1 billion+ breach records and more than 100 platforms, AI-powered identity-chain mapping that connects online handles to real identities, hands-on remediation by specialists, and full household coverage that protects both adult accounts and children’s gaming profiles. Starting that process promptly gives you and your family the clearest path forward.