Blog: BORIS for SolidWorks - Secure Your CAD Designs

Ransomware Groups Now List CAD Drawings as Loot: What SOLIDWORKS Teams Should Do | SolidWorks | Register and Certify IP of CAD design

2026-10-14 14:32 News
On 12 October 2026, the Interlock ransomware group added a US piping and fabrication contractor, Engineers Contractors Fabricators Inc. (ECF), to its leak site. The group claims it holds proprietary pipeline designs, CAD drawings, customer lists, pricing models and trade secrets. A week earlier, the same group claimed an attack on H&L Manufacturing, a precision machining company in Michigan.
Neither company has published a statement that we could find, and none of the claims has been independently confirmed. Ransomware groups exaggerate, and a listing on a leak site is not proof of what was taken. But the wording matters. When a criminal group advertises "CAD drawings" and "proprietary designs" as the first items on its list, it is telling every engineering company what it thinks is worth money.
For SOLIDWORKS users, especially job shops, fabricators and contract manufacturers that hold their customers' models, this is a useful moment to check where design files live, who can reach them, and how you would prove what you own if a copy ends up on a leak site.
TL;DR: ransomware and your SOLIDWORKS files

Interlock claimed ECF on 12 October 2026 and H&L Manufacturing around 5 October 2026. For ECF it lists CAD drawings and pipeline designs among the stolen data. These are unconfirmed claims. Industrial security firm Dragos counted 1,140 ransomware incidents against industrial organisations in Q2 2026, 65% of them in manufacturing, and reports a shift towards data-theft-only extortion. Backups help you recover files, but they cannot un-leak them. Lock down vault and share access, put MFA everywhere, keep offline backups, and keep independent, dated proof of ownership of the designs that matter.

What did the Interlock ransomware group claim?

According to the leak-site tracker ransomware.live, Interlock posted ECF on 12 October 2026 at 15:47 UTC, listed in the manufacturing sector in the United States. The group describes ECF as a piping and insulation contractor that builds terminals for transshipping liquid hydrocarbons. In its post, reported by the threat-intelligence site DeXpose the same day, Interlock claims to hold proprietary pipeline designs, CAD drawings, customer lists, pricing models, financial records, employee information and trade secrets. It also says the company "has completely failed to ensure the security of its systems", standard pressure language used to push a victim to pay.
Around 5 to 6 October, Interlock also listed H&L Manufacturing, a precision contract manufacturer in Michigan. Breach tracker BreachSense gives a leak size of 170GB but does not say what kind of files are involved. We do not know whether either company's data has been published, what exactly was taken, or whether any ransom was discussed. Treat every detail above as an allegation by a criminal group.

Who is Interlock and how does it get in?

Interlock is not new. A joint #StopRansomware advisory from CISA and the FBI published in July 2025 says the group was first seen in late September 2024 and targets businesses and critical infrastructure in North America and Europe. The FBI assesses that the group picks victims by opportunity and is financially motivated. In other words, you do not need to be famous to be on the list. You need to be reachable.
The advisory describes initial access methods that are uncomfortable for engineering teams, because they target ordinary users rather than servers:
  • Drive-by downloads from compromised but legitimate websites.
  • Fake browser updates for Chrome or Edge, and more recently fake updates for common security software.
  • "ClickFix" social engineering, where a page tricks the user into pasting and running a malicious PowerShell command as a "fix".
Once inside, Interlock uses double extortion: it copies data out first, then encrypts systems, including virtual machines. The victim is pressured twice, once to get systems back and once to stop the stolen files from being published. A CAD workstation where an engineer installs tools, add-ins and drivers with local admin rights is exactly the kind of machine these tricks aim for. Our guide to endpoint protection for CAD workstations covers the basics.

Why are CAD drawings so valuable to ransomware groups?

For a manufacturer, design files are often the most valuable data on the network, and the hardest to replace. They hold years of engineering decisions, tolerances, suppliers and know-how. For a contract manufacturer, many of those files belong to customers. A leak becomes a problem with every customer whose models were in the folder, not just your own.
The Dragos industrial ransomware analysis for Q2 2026 puts numbers on the trend. Dragos identified 1,140 ransomware incidents affecting industrial organisations in the quarter, up 12% from 1,020 in Q1. Manufacturing was the most affected sector, with 747 incidents, or 65%. Engineering firms, system integrators and equipment makers in the industrial control systems ecosystem accounted for another 117.
Dragos also says extortion continued to shift from encryption to data-theft-only attacks. These cause no downtime, so they can go unnoticed for longer, and they expose customers, suppliers and partners through leaked schematics, specifications and credentials. If your security plan is built around "we have backups", it covers only half of this risk.
We looked at the business impact in understanding IP theft in the CAD industry and the cost of CAD file breaches.

What can backups fix, and what can they not fix?

Most SOLIDWORKS teams already think about recovery. Fewer think about what happens after the files are copied. The table compares the two halves of a modern ransomware attack.
Risk after a ransomware attackDo backups help?What actually helps
Encrypted vault, file server or workstationYes, if they are offline or immutable and testedOffline backups, a tested restore plan, segmented PDM and file servers
CAD files copied and published on a leak siteNo, the copy is already outsideLeast-privilege access, MFA, monitoring of large file transfers, fewer copies on laptops and shares
Customer models leaked from a supplierNoNeed-to-know sharing, contract terms on security, access reviews for external partners
A competitor or copier claims your designNo, backups show content, not reliable proof of date or authorshipDated, independent records of each important version, such as a blockchain timestamp
Uncertainty over which revision existed whenPartly, if backup history is long enoughPDM version history plus an immutable audit trail
Our article on recovering previous versions of CAD files covers the first row. The rest of this article focuses on the rows backups cannot fix.

Where are SOLIDWORKS files exposed in a typical company?

Ransomware groups rarely target SOLIDWORKS itself. They target the places where SOLIDWORKS files pile up. In most small and mid-sized companies, that means:
  • Mapped network drives and shared folders that every user can read, often with years of projects in them.
  • PDM vaults with broad permissions, where a single stolen account can browse almost everything. See our SolidWorks PDM security configuration guide and the common PDM security mistakes we see most often.
  • Local copies on laptops, from Pack and Go exports, local caches and "just for this weekend" working folders.
  • Email attachments and file transfer links to suppliers that never expire.
  • Neutral exports such as STEP and PDF drawings, which are easier to reuse than native files. Read neutral CAD formats and their security risks.
You cannot remove all of these. You can make sure that one compromised account or one infected workstation does not open the door to all of them.
Keep your own proof of every design that matters.

BORIS for SOLIDWORKS registers your CAD files with a blockchain timestamp, so you hold a certificate of ownership that stays valid even if a copy of the file leaks.

👉 Try BORIS for SOLIDWORKS

What should SOLIDWORKS teams do now?

  1. Train for the first click. Show engineers what fake browser updates and ClickFix prompts look like. Nobody should ever paste a command from a web page into PowerShell or the Run box.
  2. Remove local admin rights where you can. Install SOLIDWORKS, add-ins and drivers through IT, keep Windows and SOLIDWORKS patched, and check our notes on SolidWorks plugin security.
  3. Put MFA in front of everything remote. VPN, email, remote desktop and PDM. SOLIDWORKS PDM 2027 adds single sign-on with your identity provider's MFA, which is worth planning for now.
  4. Apply least privilege to vaults and shares. Users should see the projects they work on, not the whole archive. Our guide to role-based access control for CAD shows how.
  5. Keep offline or immutable backups and test a restore. Include the PDM database and archive server, not only the file share.
  6. Watch for large outbound transfers. Data-theft-only attacks are quiet. Unusual uploads from a file server or a CAD workstation at night deserve an alert.
  7. Review who outside the company has access. Expire old transfer links and remove former suppliers. See managing CAD file access for external collaborators.
  8. Keep dated proof of ownership. Register the versions that matter before you share them, so a leak does not turn into a dispute about who designed what.
If you are hit, involve your customers early when their files may be affected, and check your legal obligations after a CAD file breach. The full baseline is in our CAD security checklist for engineering teams.

How do you prove a leaked design is yours?

Once files are on a leak site, anyone can download them. Most will never be used. But leaked designs can turn up later in quotes, copies or patent filings, and then the question is no longer "were we hacked?" but "can you prove this was yours, and when?"
File dates are easy to change, and copies of a leaked file carry whatever metadata the copier wants. PDM history is useful, but it sits on the same network the attacker was in. What helps is a record that was created before the leak, outside your own systems, and that cannot be quietly edited.
BORIS for SOLIDWORKS, the add-in by CADChain, registers your CAD files with a blockchain timestamp from inside SOLIDWORKS and gives you a certificate of ownership for each registered version. It does not stop ransomware and it does not replace backups or access control. It gives you dated, independent evidence of what you designed and when. For the background, read how to prove authorship of CAD designs, why blockchain timestamping proves "first in time" and our guide to trade secret protection for CAD files.

How does this fit the bigger picture for design IP?

Ransomware is one route by which designs leave a company. This week our sister sites covered others, and the lesson is the same: know where your design data is and who can reach it.
For SOLIDWORKS-specific plans, see our overview of SOLIDWORKS 2027 for your design data and IP, which covers PDM single sign-on, Auto-Save and partner access.

Conclusion

The October 2026 claims against ECF and H&L Manufacturing are still unconfirmed, and both companies deserve the benefit of the doubt. The pattern behind them is not in doubt: ransomware groups go after manufacturers, and they now advertise CAD drawings and designs as loot.
Backups bring files back. They do not bring back control. Close the easy doors, limit who can reach the vault, watch what leaves, and keep dated proof of the designs you would least like to see on a leak site.
Protect your SOLIDWORKS designs before they leave the building.

BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files, right inside SOLIDWORKS.

👉 Get BORIS for SOLIDWORKS

FAQ: ransomware and CAD drawings

Which companies did Interlock claim in October 2026?

Interlock listed Engineers Contractors Fabricators Inc. (ECF), a US piping and fabrication contractor, on 12 October 2026, and H&L Manufacturing, a precision machining company in Michigan, around 5 to 6 October. Both are claims by the group and have not been confirmed by the companies.

Were CAD files really stolen?

We do not know. For ECF, the group claims it holds CAD drawings and proprietary pipeline designs. For H&L, a breach tracker lists a 170GB leak size without describing the files. Treat both as allegations until the companies or investigators confirm them.

How does Interlock usually break in?

According to the CISA and FBI advisory, through drive-by downloads from compromised websites, fake browser and security-software updates, and ClickFix tricks that get users to run a malicious PowerShell command.

Is SOLIDWORKS itself vulnerable to ransomware?

These claims do not point to a SOLIDWORKS flaw. Attackers usually reach design files through stolen accounts, infected workstations and shared folders. Keep SOLIDWORKS and eDrawings patched anyway, because file-parsing flaws are fixed only in supported releases.

Are backups enough to protect SOLIDWORKS files from ransomware?

No. Offline or immutable backups help you recover encrypted files, but they cannot stop stolen files from being published. You also need access control, MFA, monitoring and independent proof of ownership.

How common is ransomware in manufacturing?

Dragos counted 1,140 ransomware incidents affecting industrial organisations in Q2 2026. Manufacturing accounted for 747 of them, or 65%.

What should a contract manufacturer do with customer CAD files?

Keep them on a need-to-know basis, delete what you no longer need, limit external access, and agree in advance how you will inform customers if their files may be affected.

How can I prove a leaked SOLIDWORKS design is mine?

Keep a dated record created before the leak and stored outside your network. BORIS for SOLIDWORKS registers CAD files with a blockchain timestamp and gives you a certificate of ownership for each registered version.