www.goodmanmfg.com

www.goodmanmfg.com was compromised in a ransomware attack attributed to stormous in December 2025. The organization, operating in the Manufacturing sector in United States, was added to the group's data leak site as part of an extortion campaign.

stormous operates as a financially motivated ransomware-as-a-service (RaaS) operation, exfiltrating sensitive data and threatening public disclosure to pressure victims into paying ransom demands.

Administrative/System Files/ADMIN, DOAS,General operational, administrative records, and potential system configuration files /Proprietary Engineering Drawings/IP/Highly specific technical documents, schematics, and design files (Intellectual Property). The (MklUp) indicates marked-up or working drafts.Product Line/System Data /RoofTop Systems Folder, Goodman Models, Goodman 12.5 /Confidential information related to specific product lines,Systematically numbered Bitmap image files (BMP), which function as internal references for parts, components, or quality checks/Goodman LC