Was Kingcan Holdings Limited , Fuzhen Group hit by ransomware?

Kingcan Holdings Limited , Fuzhen Group was listed by the radar ransomware operation (China), and stolen data was published on the group's leak site. Darkfield tracks this disclosure with the original leak post, screenshot and group context.

Who is the radar ransomware group?

radar is a ransomware operator tracked by Darkfield. See the full operator dossier for its known victims, sectors targeted, IOCs and leak-site infrastructure.

What data was leaked in the Kingcan Holdings Limited , Fuzhen Group breach?

radar published data attributed to Kingcan Holdings Limited , Fuzhen Group. Darkfield captured the leak post and a screenshot of the listing.

Ransomware victim disclosure

← All victims

Fuzhen Group (Kingcan Holdings Limited)

listed as Kingcan Holdings Limited , Fuzhen Group · Claimed by Radar · listed 8 months ago

Age

since listed · data leaked

Status timeline

ListedNov 3, 2025
Data leakeddate unknown

At a glance

Group: Radar
Status: Data leaked
Country: China
Sector: Manufacturing
Listed on leak site: Nov 3, 2025

About the victim

AI dossier — public-source company profile

Fuzhen Group, operating under Kingcan Holdings Limited, is a Chinese metal packaging manufacturer founded in 1993 and headquartered in Fujian, China. The group specializes in producing three-piece tinplate beverage and food cans and two-piece aluminum beverage cans, with an annual production capacity of 5 billion cans across five production bases in China. Its products are distributed domestically and exported internationally to markets including the United States, Canada, Japan, India, and Pakistan.

Industry: Metal Packaging Manufacturing (Tinplate & Aluminum Cans)
Address: Fujian, China (primary base; additional bases in Shandong, Hubei, Guangdong, and Henan provinces)
Founded: 1993

Attack summary

Severity: medium — Data is marked as published (disclosed status: data_published), confirming some level of exfiltration; however, no specific sensitive regulated data categories (e.g., PII at scale, financial, medical) are enumerated, no ransom amount is stated, and no data size or proof file count is provided, limiting severity assessment to medium.

The ransomware group 'radar' claims to have compromised Kingcan Holdings Limited / Fuzhen Group and has published data, indicating confirmed exfiltration of company data. The exact nature and volume of the exfiltrated data are not specified in the post.

medium

Data the group says was taken

AI dossier — extracted from the leak post

Company internal documents
Business records

What the group claims

https://web.archive.org/web/20210624183642/http://www.kingcan.net/ Fuzhen Group Founded in 1993, with quality as the cornerstone, specializes in the production of various types of fully open three-piece tinplate beverage cans, food, fruits and vegetables cans and two-piece aluminum products beverage cans and other metal packaging containers, and also provides professional one-stop food and beverage filling and filling foundry business. Fuzhen Group currently has five production bases in Fujian, Shandong, Hubei, Guangdong and Henan, which can produce more than 54 kinds of cans, with an annual production capacity of 2.5 billion three-piece tinplate tinplate cans and 2.5 billion two-piece aluminum cans, of which three tinplate tin cans account for more than 15% of China's three-piece tinplate market, and is the best in mainland China's tinplate industry! The production is not only highly automated, but also introduces six-color printing presses, high-frequency welding machines and high-speed tank lines with a capacity of 1,000 cans imported by world-renowned manufacturers such as the United Kingdom, Switzerland and Germany. In addition to one-stop production advantages, more to save the transmission costs between the production lines, production integration and production management control degree is also more effective, with perfect one-stop service and strict quality management, to win the long-term trust of customers. The main operating position in the Group - Fujian Fuzhen Metal Packaging Co., Ltd. was certified by IS09000 quality system in 1996, and is a pioneer in China's tank manufacturing industry certification. Fuzhen Group has always adhered to the business philosophy of "integrity and pragmatism, sustainable management", and aims to "quality first, customer first, international standards", and has provided customers with high-quality metal packaging materials with large shipments and stable quality over the years, and the quality of products has been recognized by the client. In addition to the domestic demand market in mainland China, Fuzhen cans are more marketed globally, including the United States and Canada, Japan, India, Pakistan, Yemen and other places; customers throughout the two sides of the well-known beverage and food manufacturers.

Sources

Victim siteweb.archive.org

Source

Indexed 8 months ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About radar

Radar is an emerging ransomware group that first appeared in September 2025, operating with apparent financial motivations based on their targeting patterns across multiple sectors and countries. The group's origin and affiliations remain unclear due to limited public documentation from established threat intelligence sources, though their geographic targeting suggests a focus on English-speaking nations and select international markets. Based on available victim data, Radar appears to employ opportunistic targeting methods that have successfully compromised 23 organizations across diverse sectors including construction, financial services, transportation/logistics, and technology, with operations spanning the United States, United Kingdom, Australia, Kuwait, and other regions. The group's attack methodology, encryption techniques, and whether they employ double or triple extortion tactics have not been extensively documented by major threat intelligence firms or law enforcement agencies. No significant high-profile campaigns, major ransoms, or law enforcement disruption actions against Radar have been publicly reported by CISA, FBI, or established security research organizations. Given the group's recent emergence and limited public intelligence reporting, Radar's current operational status and long-term capabilities remain under assessment by the cybersecurity community. The group has been linked to 26 public disclosures across our corpus. First observed on a leak site on September 10, 2025; most recent post May 18, 2026. The operation is currently active.

Timeline of this disclosure

November 3, 2025Kingcan Holdings Limited , Fuzhen Group listed by radaron the group's public leak site

Sector and geography

This disclosure adds to ransomware activity in the Manufacturing sector, which has 3,681 disclosures indexed across all operators we track. Geographically, Kingcan Holdings Limited , Fuzhen Group is reported in China, a country with 72 ransomware disclosures in our corpus.

If your organisation is affected

A listing by radar means Kingcan Holdings Limited , Fuzhen Group appeared on a ransomware extortion site and data attributed to it has been published. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
Monitor for the data appearing on radar's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.