Ransomware Attack on Jewett Cameron Highlights Evolving Cybercriminal Tactics On October 15, 2025, Oregon-based manufacturer Jewett Cameron disclosed in an SEC filing that it had fallen victim to a ransomware attack by a sophisticated cybercriminal group. The breach, which encrypted sensitive company data, included screenshots of internal meetings raising concerns about the exposure of confidential financial and strategic information. While the exact entry point remains under investigation, initial suspicions point to a potential phishing campaign, insider threat, or exploitation of a vulnerability in the company’s screen monitoring software. Despite the severity of the attack, Jewett Cameron reported that no sensitive employee, customer, supplier, or partner data was compromised, mitigating risks of further extortion or identity theft. The incident underscores a troubling shift in ransomware tactics. Beyond traditional data encryption, attackers now exfiltrate sensitive material to pressure victims into faster payments. This evolution demands heightened security measures, particularly around internal communications and network defenses, as cybercriminals refine their methods to maximize impact.

Jewett-Cameron Trading, an Oregon-based producer of outdoor fence products, suffered a ransomware attack on October 15, where hackers breached its IT systems, encrypted corporate data, and installed monitoring software. The attackers exfiltrated images of video meetings, screenshots containing sensitive company information, and non-public financial documents—including data prepared for the company’s upcoming SEC 10-K annual fiscal report. The threat actors demanded a ransom, threatening to publicly release the stolen data if unpaid. The incident caused operational disruptions, forcing the company to take critical business applications offline as a precaution. While no personal data of employees, customers, suppliers, or vendors was confirmed stolen, the attack materially impacted operations and is expected to affect Q1 2026 financial results. Law enforcement and cybersecurity experts were engaged, and the breach was contained, though system recovery remains ongoing. The company’s cyber insurance is expected to cover most recovery costs. The FBI had previously warned (2021) that ransomware gangs exploit financial reporting periods to extort companies by threatening to leak material nonpublic information, risking investor backlash and reputational damage.