A metro Atlanta hearth-products dealer showed up on a ransomware leak-site tracker Tuesday afternoon. Ransomware.live indexed Graves Fireplaces, Inc. (gravesfireplaces.com) as a claimed victim of Global Secret Group at 2026-10-20 19:53 UTC (about 3:53 p.m. ET Tuesday), with an estimated attack date of Oct. 20. The listing describes the victim as a Cumming, Georgia business in "Hearth Products, Fireplace Sales and Installation."
Graves Fireplaces says on its own website that it has supplied hearth products to homeowners, builders, and contractors in Cumming, Alpharetta, Roswell, Marietta, and the greater metro Atlanta area since 1977. It runs a showroom on Aaron Sosebee Road in Cumming with more than 45 product examples and takes estimate and service requests online. The public site was up (HTTP 200) when we checked Wednesday morning. This is the same group that listed Rosenberg & Pittinsky, a New York law firm, a day earlier.
What's claimed, and what's confirmed
Claimed: Global Secret Group's post says it holds 76.1 GB of data, which it describes as 77,117 files in 5,170 folders. The post also gives revenue and headcount estimates for the company. All of that is an actor assertion. A leak-site listing is not proof of what was taken, whether any systems were encrypted, or whether the files are what the group says they are.
Not confirmed: As of Wednesday morning we found no statement from Graves Fireplaces, no news report confirming an incident, and no regulator or state notice. The only coverage we found came from tracker sites repeating the listing. There is no confirmed encryption, no confirmed theft of customer or employee data, no reported disruption to installs or service calls, and no word on any payment. Treat this as a claim until the company says otherwise.
Why it matters to hearth, home-improvement, and installation businesses
Fall is typically the busy season for fireplace, stove, and chimney work across north Georgia. A hearth dealer's files typically hold the details that make homeowner scams convincing: customer names and addresses, estimates, job schedules, installer assignments, builder and contractor contacts, and invoices. Dealers that sell through builders and contractors also share drawings, purchase orders, and payment details with those partners by email. Whatever the truth of this claim, those records are why installation businesses get targeted, and why a listing about one dealer is a question for the builders and homeowners who work with it.
The quickest harm after a listing is usually fraud, not encryption. Homeowners and builders should expect texts or emails about "rescheduled installs," deposit or balance-due requests with new payment links, fake invoices that look like they came from a dealer they know, and calls asking to confirm card details. Hearth shops, remodelers, HVAC and chimney contractors, and builders across Forsyth County, metro Atlanta, and Northwest Georgia should confirm any payment change with a phone number already on file, not the one in the message.
Ask the practical question: if your estimating and scheduling systems went dark during the busiest month of the season, could you still run tomorrow's installs and tell customers when crews will arrive?
Clear takeaway
Use Global Secret Group's claim against Graves Fireplaces as a peak-season drill for hearth, home-improvement, and installation businesses. Put MFA on email and job-management systems, keep a customer and schedule backup you can actually restore, and call back on any payment change, whatever a leak site alleges.
Actions to take this week
- Require MFA on email, your CRM or job-scheduling platform, accounting software, and payment processor, starting with owners, office managers, and anyone who can issue refunds.
- Test a restore of customer, estimate, and scheduling data this month. Keep one copy that can't be changed or deleted and that isn't reachable with the same logins as the office PCs.
- Review remote access to showroom and office computers. Remove remote-support tools nobody uses, and retire shared logins at the front counter.
- Print a fallback schedule: the next two weeks of installs and service calls, crew assignments, and customer phone numbers, so crews can keep working if systems are down.
- Warn customers through your usual channels that you will never change payment instructions by text or email, and give them a number to call.
- Write a one-page incident card: who leads, who calls your insurer and IT provider, and what the front desk tells customers who call.
Brotherly Technology helps contractors, installers, and home-services SMBs across Rome, Northwest Georgia, Atlanta, Chattanooga, and the Southeast turn ransomware headlines into a short readiness review covering MFA, backups, remote access, and payment-change controls. If you want a second set of eyes before the next claim lands, give us a call.
Sources:
- Ransomware.live: Graves Fireplaces, Inc. / Global Secret Group. Discovered 2026-10-20 19:53 UTC; est. attack date 2026-10-20; 76.1 GB claimed; claim-level only.
- Graves Fireplaces (gravesfireplaces.com). Context: metro Atlanta hearth-products sales and installation since 1977; showroom in Cumming, GA. No incident acknowledgment cited here.