A West Tennessee casework manufacturer showed up on a ransomware leak-site tracker early Friday. Ransomware.live indexed Campbell Rhea (campbellrhea.com) as a claimed victim of The Gentlemen ransomware group at 2026-10-16 09:30 UTC (about 5:30 a.m. ET), with an actor-posted date of Oct. 14. The tracker leaves the country and sector fields blank. No data size, ransom demand, or file inventory is shown.
The company's own sites describe CampbellRhea as "an ICI Scientific Company," the wood science and laboratory casework brand of Institutional Casework, Inc. ICI lists its corporate headquarters and wood plant at 1865 Highway 641 North in Paris, Tennessee, and a steel plant in Union City, Tennessee. Products include wood and steel lab casework, fume hoods, work surfaces, and athletic lockers sold through a national dealer network to schools, universities, and research labs. Both public sites were up (HTTP 200) when we checked Saturday morning.
What's claimed, and what's confirmed
Claimed: The Gentlemen listed Campbell Rhea with a long company profile. Parts of it mirror the company's public history; the revenue, headcount, and leadership details in it are the actor's text, and we have not verified them or repeated them here. A listing is an actor assertion that the company is a victim. It is not proof of what, if anything, was taken.
Not confirmed: As of Saturday morning we found no statement from Campbell Rhea or ICI Scientific, no news report, and no state or federal filing. There is no confirmed encryption, no confirmed theft of customer, dealer, or employee data, no reported plant or ordering outage, and no word on any payment. Separately, trackers show a February 2024 8Base listing for iciscientific.com; we found no company confirmation of that one either. Treat this as a claim until the company says otherwise.
Why it matters to casework, millwork, and industrial manufacturers
Built-to-order manufacturers run on files. Shop drawings, CAD and BIM libraries, CNC programs, finish specs, and bid packages move every day between the plant, independent dealers, architects, general contractors, and school or university owners. Dealers often hold portal logins, and project teams share folders that outlive the job. A headline about any manufacturer in that chain is a question for everyone on the other end of those emails and links.
Construction-season timing makes it worse. Education and lab projects run on tight install windows, so a manufacturer that can't release drawings, schedule trucks, or invoice for a few days ripples out to GCs and owners fast. Criminals know that. After a listing, expect fake "updated remittance" letters, spoofed dealer emails, and phony change orders aimed at accounts payable on both sides.
The same pattern fits plants across Tennessee, Georgia, Alabama, and the Southeast: a shared Microsoft 365 tenant, plant-floor PCs running CNC and finishing equipment, an ERP that both plants rely on, and remote-access tools left in place for machine vendors. Ask the practical question: if email and the ERP went dark for a week, could you still find the current drawing revision, run the saw schedule, and confirm a payment change by phone?
Clear takeaway
Treat The Gentlemen's claim against Campbell Rhea as a continuity and payment-fraud drill for casework, millwork, and industrial manufacturers and their dealers. Protect MFA on email, ERP, and dealer portals; keep restorable backups of CAD, CNC, and order records; and verify every bank or remittance change by phone — no matter what a leak site alleges.
Actions to take this week
- Require MFA on email, ERP, dealer and customer portals, file-sharing, and VPN or remote-access tools. Retire shared shop-floor logins.
- Check leaked-credential exposure for your domain and force resets on anything that shows up, starting with owners, AP, estimators, plant managers, and IT admins.
- Confirm backups you can restore of ERP, CAD/BIM libraries, CNC programs, and email, with one copy that cannot be changed or deleted. Test a restore this month.
- Separate plant-floor machines from office and finance systems where you can, and review which equipment vendors still have remote access.
- Lock down payment changes: any new bank account or remittance address from a dealer, supplier, or customer gets a call-back to a number already on file.
- Write a one-page incident card: who leads, who calls your insurer and IT provider, and how you reach plant leads, dealers, and drivers if email is down.
Brotherly Technology helps manufacturers, distributors, contractors, and other SMBs across Rome, Northwest Georgia, Chattanooga, Tennessee, and the Southeast turn ransomware headlines into a short readiness review — MFA, backups, vendor access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Campbell Rhea / The Gentlemen. Discovered 2026-10-16 09:30 UTC; actor date 2026-10-14; country and sector blank; claim-level only (no data size disclosed).
- CampbellRhea (campbellrhea.com) and ICI Scientific contact page. Company context: CampbellRhea is an ICI Scientific (Institutional Casework, Inc.) brand; HQ and wood plant in Paris, TN; steel plant in Union City, TN. No incident acknowledgment cited here.
- Ransomfeed: Institutional Casework, Inc / 8Base (Feb. 2024). Earlier tracker listing for iciscientific.com; claim-level only.