By Gregory Hale
Pittsburgh, Pennsylvania-based refractory products maker, HarbisonWalker International (HWI), suffered a cyberattack where personally identifiable information ended up stolen in the hack.
Forensic disclosures confirmed on September 22–23, 2026, reveal an extortion-driven threat syndicate infiltrated HWI’s corporate enterprise network, traversed IT/OT boundaries, and exfiltrated over 450 gigabytes of sensitive corporate data, according to a report with Sh3llc0d3, an advanced offensive security research lab, threat intelligence platform, and cybersecurity blog focused on ethical hacking, vulnerability analysis, and APT (Advanced Persistent Threat) tracking.
Beyond proprietary refractory material formulas and industrial manufacturing schedules, the actors accessed and extracted executive treasury files, corporate banking ledgers, and wire transfer authorization manifests before deploying secondary extortion demands.
Stolen in the hack was the name of the individual, address, Social Security Number, driver’s license number, government-issued ID number (e.g. passport, state ID card), medical Information and health insurance information,
Initial Attack Method
The initial breach occurred via an external Fortinet SSL-VPN concentrator maintained for external maintenance contractors, according to Sh3llc0d3. Threat actors obtained valid credentials for an engineering vendor that had not enabled multi-factor authentication (MFA) on its contractor portal. The actors authenticated successfully, establishing an interactive session within the contractor staging VLAN.
Once inside the perimeter, the attackers deployed lightweight living-off-the-land utilities where they executed native PowerShell commands (Get-ADComputer, Get-ADUser) and deployed SharpHound to enumerate domain objects and service accounts.
Targeted unpatched domain member servers running Windows Server 2019, utilizing Mimikatz and LSASS memory dumping (procdump.exe -ma lsass.exe) to harvest plaintext service account passwords.
HWI’s network architecture maintained connections between the corporate Enterprise Resource Planning (ERP) network and regional plant distribution hubs, according to Sh3llc0d3. The attackers used stolen domain credentials to traverse internal firewalls over SMB (TCP 445) and Remote Desktop Protocol (RDP – TCP 3389).
Areas Attackers Reached
Upon reaching the industrial plant enclaves, the actors accessed engineering workstations hosting:
- CAD/CAM design specifications: Proprietary grain-size distributions and bonding matrix compositions for high-alumina refractory brick.
- Plant manufacturing schedules: Real-time production capacity data for critical steel mill customers across the Midwest and Southern industrial corridors.
HarbisonWalker International (HWI) is a manufacturer and the largest producer of refractory products (heat-resistant ceramic materials used in high-temperature industrial environments) in the United States.
To that end, it is a primary provider of high-temperature heat containment materials essential for operating blast furnaces, basic oxygen furnaces, aluminum smelters, and petrochemical cracking refineries.
No further information was immediately available on what kind of attack it was and who was behind it.
For more information on other incidents in the industry click on ICSSTRIVE.com.