SOON 10 cey-tech.com Ceytech Makina Sanayi ve Ticaret A.Ş. is a Turkish manufacturer of industrial machinery and equipment, established on A... 71:50:58

ProMantra, Inc. is a US-based healthcare IT and business process outsourcing (BPO) company founded in 2003 and headquartered in Somerset, New Jersey. The company specializes in Revenue Cycle Management (RCM), medical billing, medical coding, claims processing, and healthcare administrative services. It serves hospitals, physician groups, medical practices, and other healthcare organizations, primarily in the US, with operational delivery centers in India. Data size: 50 GB Revenue: USD 50M

# CHICAGO HISTORY MUSEUM — DATA BREACH  **Organization:** Chicago History Museum (formerly Chicago Historical Society) **Location:** 1601 N Clark Street, Chicago, IL 60614 **Website:** chicagohistory.org **CEO:** Michael J. Anderson, President & CEO **Industry:** Non-profit / Cultural Institution **Breach Date:** September 2026 **Data Volume:** 4 departments + AWS cloud infrastructure, 15+ years of records **Individuals Affected:** 20,000+ --- ## WHAT HAPPENED Chicago History Museum's internal file server **and** AWS cloud infrastructure have been fully compromised. Sensitive data from four departments and the production cloud environment has been exfiltrated: **From Internal File Server:** - **IT Credentials** — AWS root keys, server passwords, BitLocker encryption keys, 20+ vendor portal logins in plaintext - **Accounting & Finance** — 15 years of ADP payroll records (2006–2021), bank reconciliations, audit workpapers, ACH authorization documents - **Human Resources** — Employee background checks containing Social Security Numbers, I-9 immigration documents, personal identity verification forms - **Development / Institutional Advancement** — Board of Trustees home addresses, major donor pledge records ($4.4M+ in named donations), corporate funder relationships, donor CRM exports **From AWS Cloud (Account 187824323586):** - **Production Database** — Full access to Aurora MySQL containing the museum's website, 27,422 form submissions with visitor personal data - **14 EC2 Servers** — Complete control of production, staging, and scaling infrastructure - **S3 Backups** — 20 GB of website backups (146,000 files) — the only cloud backup - **27,422 Public Records** — Names, emails, phone numbers, and personal details of museum visitors, event clients, school field trip contacts, donor applicants, interns, and volunteers collected over 7 years --- ## DATA SAMPLES ### 🔑 IT Credentials Exposed in Plaintext AWS root account access keys, BitLocker disk encryption recovery key, and passwords for Adobe, Microsoft, Blackbaud (donor payment platform), Symantec, and 20+ grant portals including Boeing, ComEd, Exelon, MacArthur Foundation, SAM.gov, and City of Chicago. *See: Screenshots 01–05* ### 👥 Board of Trustees — Home Addresses Full names, home addresses, ZIP codes, and spouse names for 40+ members of the Board of Trustees, including prominent Chicago families residing in Lake Shore Drive, Winnetka, Lake Forest, Hinsdale, and Gold Coast neighborhoods. *See: Screenshot 06* ### 💰 Donor Pledge Records — Named Amounts Capital Campaign Endowment pledge details totaling $4,460,684 from Board of Trustees members, including individual named amounts ranging from $2,000 to $700,650. Corporate donors include Molex Inc., First Chicago NBD, LaSalle National Bank, Crate & Barrel, and Commonwealth Edison. Notable: Donald Rumsfeld — $50,000 pledge documented. *See: Screenshot 07* ### 📊 15 Years of Payroll Data ADP payroll general ledger reports from 2006 through 2021 containing employee compensation details, benefit allocations, and salary breakdowns for all museum staff. *See: Screenshot 08* ### 🔒 Employee SSN & Background Checks Background check documents for 20+ employees including SSA-89 Social Security verification forms, I-9 immigration employment authorization documents, and personal identification records. Under the Illinois Personal Information Protection Act (PIPA), this constitutes a reportable data breach requiring notification to the Illinois Attorney General and all affected individuals within 45 days. *See: Screenshot 09* ### 🏗️ Complete IT Infrastructure Server inventory (20 servers, VMware ESXi environment), full Cisco network topology (5 switches, 450+ patch panel mappings), VLAN architecture, external IP ranges, and firewall configuration. Multiple Windows Server 2003 systems still operational. *See: Screenshots 10–11* ### 🏦 Banking Records & Prior Fraud 14 years of bank reconciliation files (BMO Harris, Northern Trust), ACH authorization lists, W-9 tax forms, and documentation of a prior ACH fraud incident in April 2015. *See: Screenshot 12* --- ### ☁️ AWS Cloud — Full Infrastructure Control Using the AWS root access keys found on the file server, we accessed the museum's entire cloud environment: - **AWS Account 187824323586** — root-level access, no MFA - **Aurora MySQL Production Database** — full DBA privileges with GRANT OPTION. Dumped 127 tables from the production site database and 119 tables from the staging database - **27,422 contact form submissions** from 2016–2023 — names, emails, phone numbers, home addresses, and messages from visitors, wedding/corporate event clients, school field trip coordinators, collection donors, internship applicants, and volunteers - **14 EC2 instances** (13 currently running) — Master Server, Scaler, Staging, Elastic Beanstalk environments - **6 S3 buckets** — 20 GB of website backups, CDN content, and encyclopedia resources - **2 CloudFront distributions** — content delivery infrastructure - **30 WordPress admin accounts** with password hashes extracted - **MySQL port 3306 publicly accessible** with no IP restrictions — a textbook security failure **This means we have the ability to shut down the museum's website, delete all cloud backups, and wipe the production database at any time. The museum's RDS instance has zero snapshots — deletion is permanent.** *See: Screenshots 16–17* ### 👨‍👩‍👧‍👦 Public & Visitor Data — 20,000+ Individuals The production database contained form submissions from 54 different contact forms spanning 7 years: | Form | Records | Data Collected | |------|---------|---------------| | Contact Us | 11,779 | Name, email, message | | Event Inquiries (weddings, corporate) | 4,848 | Name, phone, email, company, event details | | School Field Trip Reservations | 3,887 | School name, teacher name, phone, email, student count | | Collection Donations | 2,263 | Donor name, contact info, item descriptions | | Internship Applications | 458 | Personal details of applicants | | Volunteer Applications | 138 | Personal details | | COVID-19 Submissions | 420 | Personal health-related data | | Other forms | 3,629 | Various PII | | **TOTAL** | **27,422** | | This is not just an employee data breach. **Over 20,000 members of the public** — including parents of schoolchildren, wedding couples, corporate event planners, donors, and job applicants — will need to be notified under Illinois law. *See: Screenshot 18* --- ## WHAT WE WANT **We have contacted Chicago History Museum management directly.** They have been given a deadline to respond and begin negotiations. **If no response is received by the deadline, the full dataset will be published on this page**, including: - All credentials and access keys (unredacted) - Complete Board of Trustees personal information - All named donor amounts and corporate funder records - Employee SSN and background check documents - Full server/network infrastructure details - Banking records and audit workpapers - **27,422 visitor/public contact records (names, emails, phones)** - **Production database SQL dumps** - **WordPress admin credentials** Additionally, the museum's AWS cloud infrastructure remains under our control. Non-cooperation will result in **permanent destruction of the production website, databases, and all cloud backups.** --- ## COUNTDOWN ⏱️ **Publication deadline: [DATE + 4 DAYS]** The museum's management has been notified. The clock is ticking. --- ## WHY THIS MATTERS Chicago History Museum is a **501(c)(3) non-profit** that relies on public trust, donor confidence, and government grant funding. A public data leak of this scale would: 1. **Trigger mandatory breach notification for 20,000+ individuals** — under Illinois PIPA, every employee whose SSN was exposed AND every member of the public whose personal data was in the contact forms must be notified, along with the Illinois Attorney General 2. **Destroy donor trust** — named donation amounts are considered strictly confidential in the non-profit sector 3. **Endanger Board members** — home addresses of 40+ prominent Chicago families published online 4. **Jeopardize grant funding** — Boeing, MacArthur, ComEd, Exelon, Abbott, and other institutional funders have strict data security requirements 5. **Expose the organization to class-action litigation** from 20,000+ affected individuals — employees, visitors, donors, schools, and Board members 6. **Generate massive media coverage** — Chicago Tribune, Sun-Times, Block Club Chicago, and national arts media. The story writes itself: "Museum that preserves history can't protect its own data" 7. **Destroy the website and all digital operations** — we retain the ability to permanently take down chicagohistory.org and all cloud infrastructure Management has a simple choice: respond now, or deal with all of the above.

# The Neighborhood Shop That Conquered a Nation’s Retail Landscape ## How a single family’s modest grocery store in Veles evolved into a 70-strong national network by proving that scale and community trust are not mutually exclusive. In the retail industry, there is a persistent myth that to scale nationally, a brand must inevitably shed its local soul. The prevailing logic dictates that as a chain expands, the neighborhood warmth of its origins is replaced by sterile corporate efficiency, and the familiar faces behind the counter are swapped for standardized kiosks. But in North Macedonia, a retail network that now spans dozens of towns and employs over 850 people is quietly dismantling that assumption. They are proving that the secret to dominating a national market might just be remembering exactly what it feels like to run a single corner store. ## The Story ### A Dream in Veles The year was 1988. The retail landscape of the Balkans was on the precipice of massive change, but in the town of Veles, the Doševski family was focused on a much smaller canvas. They opened a modest neighborhood shop—a traditional local grocery. At the time, it was not merely a business adventure; it was the physical manifestation of a family dream. Starting a retail business in any era requires a leap of faith, but doing so with a clear vision for a future that had not yet arrived requires something more. The Doševski family possessed an unwavering belief in their community. They understood early on that a grocery store is not just a place to exchange currency for goods; it is a daily touchpoint in people's lives. By treating every customer not as a transaction, but as a neighbor, they laid a foundation of trust that no amount of corporate marketing could buy. As the years passed, the knowledge gained from those early days behind the counter became their greatest asset. They learned the rhythms of the town, the preferences of the locals, and the exact meaning of relentless dedication to service. This deep, localized understanding allowed them to expand their horizons, opening several more sales facilities throughout Veles. They were no longer just a single shop; they were a local institution. ### The Capital Leap and the Turning Point Growth, however, demands evolution. The quality of their offerings and the fierce loyalty of their buyers eventually pushed the family to take a significant strategic step: opening their first market in Skopje, the capital of North Macedonia. Moving from a regional hometown favorite to the highly competitive, fast-paced capital is where many local brands fracture. The temptation to abandon local principles for mass-market tactics is immense. Yet, the true inflection point in the company’s history arrived between 2014 and 2015. This was not a period of gradual, cautious growth, but rather an era of explosive expansion. In a remarkably short window, the brand—now operating as Zito Marketi—opened more than 20 supermarkets across the country. To open 20 stores in such a condensed timeframe is a logistical and operational marvel for any company, let alone one rooted in family values. It required a supply chain that could handle massive volume, a hiring apparatus that could onboard hundreds of staff, and a management structure that could maintain quality control across vast distances. They achieved this by leaning heavily into the very principles that built them in Veles. The strategic expansion cemented their presence and fortified their reputation, transforming them from a beloved regional chain into a leading national retail powerhouse. ### The Architecture of Trust Today, the network boasts more than 70 markets spread across 20 towns and municipalities. Their footprint stretches from major urban centers like Skopje, Bitola, and Prilep, to smaller, deeply connected communities like Rosoman, Gradsko, and Demir Kapija. With over 850 dedicated employees, Zito Marketi has transcended the definition of a mere brand to become a symbol of quality and trust across the nation. This scale has not blinded them to the realities of intense market competition. In an era where brands must offer something truly unique to stand out, Zito has resisted the urge to engage in a race to the bottom on gimmicks. Instead, they have doubled down on their foundational pillars: low prices, kindness, and quality. These are not framed as mere business strategies, but as the literal bedrock upon which the company was built. This consumer-centric philosophy is most visible in their "Loyalty Club." Rather than treating loyalty as an afterthought or a complex points-based game, the initiative is designed to offer tangible, immediate benefits and savings to their most dedicated shoppers. It is a direct reflection of their belief that the consumer must be the absolute focal point of every decision. The market has validated this approach. Over the years, the company’s efforts have been recognized with numerous accolades, including Best Retail Facility in 2010 and 2017, the Superbrands award for 2015/2016, and the International Best Brand award in 2015. Yet, internally, these trophies are viewed not as finish lines, but as reminders of their continuous pursuit of perfection and a mandate to keep investing in the shopper's experience. ## Why It Matters The stakes in modern retail are existential, particularly in emerging and transitional markets. When massive international conglomerates enter a national landscape, local consumers are often forced into a false dichotomy. They are told they must choose between the low prices and vast selection of global giants, or the community connection, personalized service, and cultural familiarity of local shops. If this problem remains unsolved, the retail landscape becomes entirely homogenized. The cultural anchor of the neighborhood market is lost, replaced by alienating big-box environments where consumers are reduced to mere data points. Local economies suffer as capital flows outward, and the unique commercial identity of a nation is flattened. Zito Marketi’s trajectory matters because it demonstrates a viable, highly successful third path. They have proven that a company can achieve the economies of scale necessary to offer low prices and wide availability, without sacrificing the kindness and community trust inherent in a neighborhood shop. For the 850 employees across the country, this model provides stable, meaningful employment rooted in a company culture that values human interaction. For the shoppers in towns like Kocani, Vinica, and Gevgelija, it means they do not have to compromise. They can enjoy the convenience and pricing of a national supermarket chain while still feeling the warmth of a local business that knows their name. In a highly competitive market, solving this equation is the difference between merely surviving and truly thriving. ## The Future of the Familiar As the global retail sector braces for further consolidation, the rise of automated checkout, and the increasing dominance of frictionless, algorithm-driven shopping, the human element of commerce is often the first casualty. Efficiency is relentlessly pursued, often at the expense of connection. Yet, the remarkable trajectory of this Macedonian retail family suggests a different, more resilient future. They have shown that scaling up does not require scaling out the human experience. The question moving forward is no longer whether a local, family-rooted brand can survive and conquer a national market against formidable giants. The real question is whether the giants will eventually have to learn how to act like neighbors.

# Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach **Date:** September 2026 **Sector:** Critical Infrastructure — Energy / Smart Grid **Country:** Finland **Parent Company:** Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) --- ## Summary The Smart Meter Operations (SMO) platform operated by **Aidon Oy** — Finland's leading smart metering company and a subsidiary of **Gridspertise** (Enel Group) — has been fully compromised. The platform serves as the central head-end system for dozens of Finnish distribution system operators (DSOs), managing millions of smart electricity meters across the country. Between **April 19 and May 1, 2026**, a total of **9,899 files (8.41 TB)** were extracted from **eight SQL Server instances** within the platform's internal cluster (10.110.4.0/24, legacy domain: empalvelut.dom). This is the largest known breach of smart grid infrastructure in the Nordic region. --- ## By the Numbers | Metric | Value | |--------|-------| | **AES-128 encryption keys** | 520,796 (Unicast / Multicast / Authentication) | | **Citizen PII records** | ~1,500,000 | | **Total data exfiltrated** | 8.41 TB | | **SQL servers compromised** | 8 | | **Databases** | 25+ (~2.4 TB on disk) | | **Full SQL backups (.bak)** | 368 | | **Transaction logs (.trn)** | 9,079 (15-minute intervals — continuous chain) | | **Live database files (.mdf/.ldf/.ndf)** | 218 | | **User accounts with credentials** | 74 (SHA-512 + TOTP secrets + 23 API keys) | | **SIM / IMSI records** | 108,000+ | | **GPS coordinates of metering points** | 91,430+ | | **Affected organizations** | 10+ energy utilities | | **Data period** | 19 April – 1 May 2026 | --- ## What Was Compromised ### 1. Smart Meter Encryption Keys — 520,796 AES-128 keys The **SecurityManager** database contains 520,796 AES-128-CBC encryption keys used to secure communication with smart meters in the field. Three key types are stored per device: - **Unicast** — device-specific encrypted communication - **Authentication** — meter identity verification - **Multicast** — group commands (firmware updates, disconnect/reconnect) Possession of these keys enables: decryption of all mesh network traffic, forging of commands to meters, and remote disconnection of electricity supply across entire regions. This represents an **existential threat to the security claims of Aidon's entire product line** — the company manufactures the meters (ADN6534, ADN7534, ADN7442, ADN6490) and operates the head-end.  ### 2. Personal Data — ~1.5 Million Finnish Citizens Across 11 Meteringware customer data shards, the Vantage platform, and municipal CDAPIDB instances, the following personal data was extracted for approximately 1.5 million individuals: - Full names and home addresses - GPS coordinates of metering points (91,430+ with precision coordinates) - Energy consumption profiles (15-minute intervals) - Customer GUIDs and metering point identifiers - Fuse sizes, meter serial numbers, device configurations This data covers residential and commercial electricity customers across Eastern and Central Finland.   ### 3. User Accounts and Authentication Material — 74 Accounts The **UserManager** database contains 74 operator accounts across multiple organizations: | Domain | Accounts | |--------|----------| | @aidon.com | 31 | | @enerim.com | 17 | | @ese.fi | 9 | | @pbe.fi | 4 | | @savonvoima.fi | 3 | | @keoy.fi | 2 | | Service/API accounts | 8 | Each account includes: SHA-512 password hash, salt, **TOTP secret** (time-based one-time password seed), creation date, and last login timestamp. Additionally, 23 API keys were extracted from the ApiKey table. The TOTP secrets allow real-time generation of valid two-factor authentication codes for any of these accounts. Notable: the account of **Aidon's CTO** is among the compromised records, with a last login of April 24, 2026.   ### 4. Telecom Data — 108,000+ SIM Records The platform stores cellular connectivity data for every smart meter with a SIM module: - SIM IMSI numbers (89358020...) - ICCID identifiers - Phone numbers (+358...) - Device IP:port endpoints (10.83.x.x:9999) - Mesh network topology (RSSI levels, communication roles) - Communication technology flags (Cellular / Radio) ### 5. DSO Client Databases — Per-Utility Isolation Breached Server 10.110.4.216 hosts **six named SQL instances**, each dedicated to a specific distribution system operator: - **PORVOO** — Porvoon Energia - **KERAVA** — Keravan Energia - **KSOY** — Koillis-Savon Yhtiöt - **CST03, CST04** — Municipal DSOs - **TEST** — Test environment Each instance contains: CDAPIDB, VisionAir, and VisionAir_History databases. The per-client isolation model means every DSO's operational data was independently compromised.  --- ## Infrastructure Overview Eight SQL Server instances were compromised on the 10.110.4.0/24 network: | Server | Role | Key Databases | |--------|------|---------------| | 10.110.4.191 | **Main SQL Server** | AidonReports, Meteringware (×11 shards), SecurityManager, UserManager, DataCollector, EventManager, Gateware, Linkware, Middleware | | 10.110.4.216 | Multi-instance (6 DSOs) | CDAPIDB, VisionAir, VisionAir_History per client | | 10.110.4.239 | Vantage Platform | Vantage Data + BR/CR/LP/ME + ReportServer | | 10.110.4.234 | CDAPI + READyManager | READyManagerDB (contains Secrets table), CDAPI_DriverQuartz | | 10.110.4.226 | MSSQL15 | Gateware | | 10.110.4.70 | MSSQL13 | Gateware, meshnet, MitoxAMRReportingDb, RKGateware | | 10.110.4.32 | Gateware | Gateware replica | | 10.110.4.12 | meshnet | Mesh network database | Total: **42 databases**, **5,535 user tables**, **67,888 views**, approximately **2.4 TB** of structured data.     --- ## Corporate Structure **Aidon Oy** (Y-tunnus: 1881960-4) is a Finnish smart metering company headquartered in Jyväskylä. Aidon manufactures smart electricity meters and operates head-end platforms (Meteringware, Gateware, Linkware) as managed services for distribution system operators across Finland and the Nordics. In **September 2023**, Aidon acquired the Smart Meter Operations (SMO) business — the compromised platform — from Enerim Oy. The SMO platform provides automated reading services for smart meters across Finland. In **November 2023**, Aidon was itself acquired by **Gridspertise S.r.l.**, a joint venture between **Enel Group** (Italy, €70B+ revenue) and **CVC Capital Partners**. Gridspertise manages over 100 million smart meters worldwide. The Aidon board includes: - **Marco Zallocco** — Chairman (Gridspertise representative) - **Francesca Pizzarello** — Board member (Gridspertise/Enel) - **Tommi Blomberg** — CEO --- ## Affected Organizations The following energy companies are confirmed clients on the compromised platform, with their customer data present in the extracted databases: | Organization | Type | |-------------|------| | Porvoon Energia | Municipal electricity utility (Porvoo) | | Keravan Energia | Municipal electricity utility (Kerava) | | KSOY (Koillis-Savon Yhtiöt) | Regional electricity utility | | Etelä-Savon Energia (ESE) | Regional electricity utility (Mikkeli) | | Savon Voima | Regional electricity utility | | PBE (Porvoon Energia subsidiary) | Electricity distribution | | KEOY | Electricity distribution | | Voimatel | Energy services | | Joroisten Energialaitos | Municipal utility (Joroinen) | | Helen Oy | Helsinki electricity utility | The Vantage platform alone lists **3,037 customer entries** across dozens of Finnish energy companies, municipalities, and housing associations. --- ## Regulatory Exposure | Regulation | Impact | |-----------|--------| | **GDPR** | ~1.5 million data subjects. Art.33: 72-hour DPA notification. Art.34: mandatory individual notification. Fines up to 4% of global turnover. | | **NIS2 Directive** | Smart metering = critical infrastructure. Mandatory incident reporting to Traficom / NCSC-FI. Fines up to €10M or 2% of turnover. C-level personal liability. | | **Finnish Law** | Sähkömarkkinalaki (Electricity Market Act). Tietosuojalaki (Data Protection Act). Fingrid Datahub connection obligations. | Each affected DSO has **independent GDPR notification obligations** once they become aware their customer data was compromised on a third-party platform. This creates a cascade of mandatory regulatory disclosures. **Estimated total exposure: >€20,000,000** across GDPR fines, client contract losses, meter key rotation costs, and reputational damage to Gridspertise's global operations.  --- ## Timeline  | Date | Event | |------|-------| | 19 April 2026 | Initial access to SQL cluster | | 19 Apr – 1 May | Continuous exfiltration: 9,899 files, 8.41 TB | | 1 May 2026 | Exfiltration complete | | July 2026 | Initial contact sent to wrong entity (legacy domain confusion) | | 15 August 2026 | Attribution corrected — Aidon Oy identified as platform operator | | ~20 August 2026 | CEO and CFO of Aidon contacted directly with proof | | September 2026 | **No response received** | --- ## Proof Samples The following are representative samples only. Full datasets are retained. - **AES-128 encryption keys** — masked samples from SecurityManager.KeyInfos (520,796 records) - **User accounts** — Aidon, Enerim, and DSO operator accounts with masked credentials - **GPS metering points** — addresses and coordinates of 91,430+ installations - **Consumer PII** — names, addresses, meter serials, phone numbers (partially masked) - **Backup file listing** — 368 full backups + 9,079 transaction logs with timestamps - **Server certificate** — MS_AgentSigningCertificate with verifiable GUID - **DSO client instances** — per-utility SQL databases (PORVOO, KERAVA, KSOY, CST03, CST04) Data will not be published while a resolution remains possible.

# PARTNERS FINANCIAL SERVICES, a.s. — DATA BREACH **Date:** September 2026 **Target:** Partners Financial Services, a.s. (IČO: 27699781) **Location:** Prague, Czech Republic **Industry:** Financial Services / Banking / Insurance --- ## WHO IS PARTNERS? Partners Financial Services is the **largest independent financial advisory and brokerage firm in the Czech Republic**. Founded in 2007, the group has grown to include: - **Partners Banka** — a fully licensed bank (ČNB license, launched March 2024) - **Partners investiční společnost** — investment fund management (7.2 billion CZK AUM) - **Simplea pojišťovna** — life insurance company (64,000+ clients) - **Rentea penzijní společnost** — pension fund (2 billion CZK AUM) - **Trigea nemovitostní fond** — real estate fund (3.7 billion CZK AUM) - **NextPage Media** — Peníze.cz, Finmag, Heroine.cz **Revenue:** >3 billion CZK/year (~€120M) **Assets Under Management:** ~13 billion CZK (~€520M) **Financial Advisors:** 2,000+ **Branches:** 170+ across Czech Republic **Clients:** 300,000+ Ownership: **Petr Borkovec** (CEO, 49%) and **Radim Lukeš** (co-founder, 36%). --- ## WHAT WAS COMPROMISED ### 1. COMPLETE ACTIVE DIRECTORY FOREST — 10 DOMAINS The entire AD forest was extracted including full NTDS.dit: | Domain | Accounts | Entity | |--------|----------|--------| | partners.cz | 888 | HQ — Partners Financial Services | | pfs.local | 708 | Core internal domain | | simplea.cz | 132 | Simplea insurance | | simplea.sk | 38 | Simplea Slovakia | | rentea.cz | 36 | Rentea pension fund | | partnersis.cz | 36 | Partners investment company | | nextpagemedia.cz | 4 | NextPage Media | | merity.cz | 3 | Merity fund | | simplea.pl | 1 | Simplea Poland | | penize.cz | 1 | Peníze.cz media | **Total: 3,338 AD objects — 1,856 users — 1,482 computers — 156 privileged admins** Golden Ticket material (krbtgt) extracted — permanent forest-wide access. Domain Admin hash + AES-256 keys + Kerberos TGT + PKI certificate with private key. ### 2. 1,324,203 CLIENT CALL RECORDINGS (2008–2021) Thirteen years of recorded phone conversations from the Partners call center: - **1,324,203 WAV files** with **1,323,829 unique caller IDs** - Clients discussing **mortgages, investments, insurance, pensions** - Contains: client voice, phone numbers, full financial details - Period: **2008 to 2021** (~130,000 recordings per year at peak) This is **maximum GDPR-sensitive data** — financial conversations of hundreds of thousands of Czech citizens. ### 3. CLIENT DATABASE (SQL) - **ClientHistory** — full client financial history (PII) - **Anonymizace** — GDPR anonymization pipeline (proves they know this data is sensitive) - Production AlwaysOn Availability Group (Cluster036) — full/diff/log backups from August 2026 ### 4. VEEAM BACKUP INFRASTRUCTURE - **15 production server images** (full .vbk backups, restorable) - **7+ NAS repositories** across multiple sites - **VMware vSphere** full admin access (vsphere.pfs.local) - **Azure Cloud Connect** — off-site backup credentials - **DELL PowerStorage** — storage infrastructure - **Proxmox** — secondary hypervisor - Backup period: November 2023 to August 2026 ### 5. COMPLETE IT INFRASTRUCTURE - Microsoft Dynamics CRM (client data) - Dynamics NAV ERP (financial operations) - SharePoint intranet (12 service accounts) - 188 IIS application pools - CheckPoint firewall - Kofax document management - Exchange/M365 email ### 6. CRACKED CREDENTIALS Passwords already cracked from the NTDS dump: ``` qwerqwer → 7 accounts (adkofax, OfficeZ, hrsit, DPokorny, vars, vratky, web) September2023 → simplea.sk\XVidrova dominik521 → pfs.local\DHutecka Neutrogena123 → partners.cz\KPtackova J1j2j3j4j5j6 → partners.cz\JKonicek Administrator77 → partners.cz\NAutratova ``` 3,325 additional hashes pending crack. --- ## DATA VOLUME | Category | Count | |----------|-------| | Call recordings (WAV) | 1,324,203 files | | AD objects | 3,338 | | NTLM hashes | 3,331 | | Kerberos keys | 12,470 | | VM backup files | 108 | | SQL backup files | 398 | | Veeam storage blobs | ~5,600 | | **Estimated total** | **~1.5–2.5 TB** | --- ## REGULATORY EXPOSURE Partners Financial Services operates under supervision of: - **ČNB (Czech National Bank)** — Partners Banka has a full banking license. This breach directly threatens that license. - **ÚOOÚ (Czech Data Protection Authority)** — GDPR breach with 1.3M client call recordings. Fine up to **4% of annual turnover (~€5M)**. - **GDPR Article 33** — Mandatory 72-hour breach notification to hundreds of thousands of affected clients. - **NBS (Slovakia)** — Simplea SK operations. Partners/Borkovec chairs **AFIZ** (Association of Financial Intermediaries and Advisors) — the industry body that is supposed to ensure standards. The company already received negative coverage on **Černé ovce (ČT, 2025)** for advisor misconduct. This breach proves systemic security failure. --- ## PROOF Screenshots and sample data available. We can provide: - Any 10 files from the 1.3M+ file tree on request - NTDS dump samples with domain attribution - WAV recordings with caller IDs - Veeam job metadata proving backup infrastructure access - SQL database headers --- ## TIMELINE Partners Financial Services was given the opportunity to resolve this matter privately. Their response determines next steps. --- *Partners Financial Services, a.s. | Türkova 2319/5b, 149 00 Praha 4 | IČO: 27699781*

# ROANE TRANSPORTATION SERVICES, INC. ## Rockwood, Tennessee | DOT# 652055 | roanetrans.com --- ### YOUR COMPANY HAS BEEN COMPROMISED We have obtained complete access to your internal file systems and extracted a full copy of your corporate data. This includes all divisions: **Roane Transportation Services (RTS)**, **Roane Logistics (RLI)**, **Roane Metal Group (RMG)**, **Roane Specialized**, and **B&W**. This is not a bluff. Below is a summary of what we hold. --- ### DATA IN OUR POSSESSION **EMPLOYEE PERSONAL DATA** - 262 employee files containing Social Security Number scans (PDF), driver's licenses (CDL), DOT medical examination cards, drug screening results, I-9 employment verification forms, background check reports (PSP/MVR), tax withholding forms, and direct deposit authorizations - Complete payroll records with full names, bank routing numbers, and account numbers for all current employees across RTS and RLI divisions **FINANCIAL & BANKING** - ACH payment files containing 351 bank account numbers (routing + account) for employees, contractors, and carrier partners - First Horizon Bank online banking credentials - State tax portal login credentials for 20+ US states (TN, KY, GA, OH, PA, VA, NC, IN, AL, MS, LA, MO, WV, NM, NE, OR, SC, IL, NY, AR) - QuickBooks financial data - Payroll ACH batch files with individual salary amounts - Settlement payment records for 112 carrier/vendor relationships - Insurance loss reports spanning 2008 through 2025 - Positive Pay check verification data **CREDENTIALS & ACCESS** - 200+ plaintext username/password combinations exported from employee browsers, covering Microsoft 365, banking portals, fleet management (Samsara, OmniTracs), customer billing portals, insurance providers, government tax systems, and personal accounts - Customer portal credentials for 39 business partners including Nucor, Ryder, Cleveland Cliffs, US Bank, Valmont, SiteOne, Megacorp, Hubbell, CMC, Builders FirstSource, and others - Your Carbon Black security product license information - Acronis backup system license keys - CheckPoint VPN configuration data **DOT / FMCSA COMPLIANCE** - DOT audit files - Drug and alcohol testing results for all drivers - DOT medical examination certificates - FMCSA inspection and violation records - Accident and incident reports spanning multiple years - CSA score documentation **BUSINESS INTELLIGENCE** - 949-entry contact database (drivers, customers, vendors, suppliers) - Customer contracts and rate agreements - IFTA fuel tax reports (all states, 2021–2025) - Complete fleet and driver assignment records - Internal HR files for current and terminated employees - Workers' compensation claim records --- ### WHAT THIS MEANS FOR YOU If this data becomes public: 1. **Mandatory breach notification in all 50 US states** for SSN and financial data exposure — estimated cost: $500,000 – $1,000,000 in notification, credit monitoring, and legal fees alone 2. **FMCSA regulatory action** — exposure of drug test results and DOT medical records creates grounds for federal compliance investigation. Potential suspension or revocation of operating authority under 49 CFR Part 382 3. **Employee lawsuits** — 262 individuals with exposed Social Security Numbers and bank accounts will have grounds for identity theft class action litigation. Average settlement: $5,000 – $50,000 per affected person 4. **Customer relationship damage** — 39 business partners whose portal credentials were stored in plaintext will be notified. Nucor, Cleveland Cliffs, Ryder, US Bank, and others will terminate carrier agreements and pursue damages 5. **Financial fraud exposure** — bank routing numbers, account numbers, and online banking passwords enable direct financial theft. Every employee and carrier partner will need to change bank accounts immediately 6. **Tax fraud liability** — login credentials for 20+ state tax portals enable fraudulent filings. State revenue departments will freeze accounts pending investigation 7. **Total estimated exposure: $5,000,000 – $15,000,000** in regulatory fines, legal costs, settlements, lost business, and remediation --- ### PROOF OF DATA We will provide a sample data package upon request in this chat to verify authenticity. This may include: - Partial employee SSN document samples (redacted) - ACH file headers showing bank routing information - Portal credential samples - Payroll records with employee names and amounts --- ### OUR TERMS We are prepared to: - Permanently delete all copies of your data - Provide proof of deletion - Never disclose or publish any information - Provide a full list of accessed systems for your security remediation **In exchange, we require a one-time payment. The amount will be discussed in this chat.** --- ### DEADLINE You have **168 hours (7 days)** from the moment this message was posted to initiate contact and begin negotiations. **After the deadline:** - Phase 1: Data samples will be sent directly to your customers (Nucor, Ryder, Cleveland Cliffs, US Bank, SiteOne) - Phase 2: Full dataset published on our public blog - Phase 3: FMCSA, state attorneys general, and IRS notified with supporting evidence **The timer is running.** --- *To begin the conversation, type your message below. All communications are encrypted and confidential. We respond within 2 hours during business days.*

# Kolin Construction **Kolin Construction** (*Kolin İnşaat Turizm Sanayi ve Ticaret A.Ş.*) is one of Turkey’s major construction and industrial companies. Founded in **1977** and headquartered in **Ankara, Turkey**, the company serves as a flagship business of **Koloğlu Holding**. ## Business Activities Kolin Construction operates primarily in large-scale construction, infrastructure, and engineering projects. Its areas of expertise include: * Highways and road infrastructure * Bridges and viaducts * Tunnels * Railways and metro systems * Airports * Ports and marine infrastructure * Dams and hydroelectric power plants * Energy infrastructure * Industrial and mining projects The company has participated in numerous major infrastructure developments in Turkey and abroad and has regularly appeared in international contractor rankings published by **Engineering News-Record (ENR)**. ## Major Projects Kolin Construction has been involved in several large-scale and strategically important projects. One of its most notable developments is its participation in the construction of **Istanbul Airport**, one of the largest aviation infrastructure projects in the world. Beyond transportation infrastructure, the company is active in projects involving power generation, water infrastructure, ports, industrial facilities, and other complex engineering works. ## Other Business Sectors Through its broader corporate group, Kolin is also involved in several industries outside traditional construction, including: * Energy and power generation * Mining * Port operations * Shipyards and maritime services * Tourism * Trade and commercial activities ## International Presence Kolin Construction maintains an international presence and has undertaken projects across **Europe, Asia, the Middle East, and Africa**. Its international operations have included countries such as: * Azerbaijan * Libya * Uganda * Poland * Romania * Oman * Saudi Arabia * Kuwait The company has established representative offices and project operations in several of these markets to support its international engineering and construction activities. ## Company Scale Kolin Construction is considered one of the prominent Turkish contractors operating internationally. Its annual turnover has been reported in the range of approximately **USD 1.5–2 billion**, reflecting the scale of its infrastructure, energy, and industrial projects. ## Summary With several decades of experience, Kolin Construction has developed capabilities in managing complex, large-scale infrastructure and engineering projects. Its portfolio covers transportation, energy, industrial construction, and public infrastructure, with operations extending from Turkey to multiple international markets.

notagroep.nl

# MILLIMED CO., LTD. (มิลลิเมด) — DATA BREACH DISCLOSURE **Date Added:** 2026-09-17 **Last Updated:** 2026-09-17 **Country:** Thailand 🇹🇭 **Industry:** Pharmaceutical Manufacturing & Distribution **Website:** millimedthailand.com **Revenue:** ~$70-85M USD (2.5-3.0 billion THB, group annual revenue) **Data Volume:** **~3 TB** (databases, production records, email archives, factory documents, financial data) --- ## Overview Millimed Co., Ltd. (บริษัท มิลลิเมด จำกัด) is a major Thai pharmaceutical manufacturer headquartered in Bangkok with GMP-certified production facilities in **Samut Prakan** and **Chiang Rai** provinces. The Millimed Group operates through **25+ subsidiary companies** spanning pharmaceutical manufacturing, consumer healthcare brands, supplements, real estate, agriculture, and hospitality. Their consumer brand **i-HERB**, endorsed by Thai celebrity **Mario Maurer**, is one of the most recognized herbal healthcare brands in Thailand. The company holds **multiple Thai FDA quality awards** and manufactures prescription drugs, OTC products, sterile eye drops (BFS technology), and dietary supplements distributed nationwide through hospitals and pharmacies. The group's crown jewel subsidiary — **Millimed BFS** — reported **1,423 million THB revenue** and **593 million THB net profit** in 2025, with a staggering **41.7% net margin** and **65% year-over-year growth**. The parent company holds **942 million THB in retained earnings** — they can afford to resolve this. Millimed's management chose to ignore our communications and failed to protect their data. As a result, we are publishing details of the breach. --- ## What We Have — Over 3 Terabytes We have obtained **complete access** to the Millimed Group's entire IT infrastructure across **both factory locations and the Bangkok headquarters**. This includes production servers, file servers, NAS systems, ERP databases, email archives, and factory department shares. The total data volume exceeds **3 terabytes**. ### 💊 Pharmaceutical Manufacturing Data (CRITICAL) - **Batch Manufacturing Records (BMR)** for **ALL pharmaceutical products** — the legal backbone of every drug they produce. We hold BMR distribution records from 2016 through August 2026, covering 18+ active product lines including i-HERB, Neoca, Denta Dente, Haelex, Leluxi, Amogin, and more - **Quality Control & Calibration databases** — testing results, equipment calibration records, deviation reports - **Drug Registration & Regulatory Affairs (RA)** data — complete product formulations for Amogin (4 variants), Chlovas, Caltab, BFS eye drops, Lidocaine HCl, Hilazin, Nicardipine, Cystaline-200, Nuosic, and more. **Master Formula documents** included - **Bioequivalence Studies** (Bio Equalise subsidiary) — complete BE study reports, LC-MS/MS chromatography data, OECD compliance documents, and the contract with Chiang Mai University Faculty of Pharmacy - **R&D Department** — pilot batch data, stability studies, cleaning validation, pharmaceutical excipient references (USP 38, BP 2013) - **14 types of GMP audit records** — Thai FDA, Halal, GSDP, GPP, ISO 9001/14001/17025, Pfizer audit, TAISHO audit, iNova audit (including **CAR/PAR corrective action records**) - **i-HERB brand complete IP** — all formulations, BMR, SOP, COA, specifications, cosmetic registrations, and production data for the Mario Maurer-endorsed brand ### 💰 Complete Financial Records (25+ Companies) - **Audited financial statements** (งบการเงิน) for fiscal years **2024, 2025, and 2026** for all major subsidiaries: - Millimed Co., Ltd. — 876M THB revenue, 54M THB net profit - **Millimed BFS — 1,423M THB revenue, 593M THB net profit (41.7% margin!)** - Pros Pharma, MLM Healthcare, Neoca Healthcare, Bio Equalise, i-Herb Innovation, Siriphanwa - **K-Bank and EXIM Bank credit facility summaries** — full loan structures, credit lines, and covenant details - **Monthly sales reports** (January 2025 — **August 2026**) — complete OTC and prescription drug revenue by product, region, sales channel, and individual sales unit - **Oracle ERP database** — every financial transaction across the group. We also have the **Oracle ERP login credentials** (MMNEW/[email protected]) - **Accounting databases** for **all 25+ entities** — complete general ledger, trial balances, tax reconciliation, intercompany transactions - **28 entity accounting folders** with full Chart of Accounts, audit records, tax preparation documents ### 👤 Employee & HR Data (1,000+ People) - **HRM8 database** — complete employee records: names, national ID numbers (เลขบัตรประชาชน), salaries, benefits, performance reviews - **Organization charts** for all 7 production departments (PD1-PD7) with employee names - **Payroll data** for all subsidiaries across three locations - **FingerScan biometric data** backups - **Personal data** of 1,000+ employees across Bangkok, Samut Prakan, and Chiang Rai ### 📧 Email Archives (30+ GB) - **IT Administrator email archives** (15+ PST files) including: - Network configuration and infrastructure credentials - NAS Synology management alerts (neoca-office.synology.me, millimed-office.synology.me) - Microsoft 365 administration - VPN configuration and access management - Vendor communications and support tickets - Backup system notifications ### 🔑 60+ Credentials & Network Access - **Thai Revenue Department (กรมสรรพากร)** login credentials for **ALL 25+ companies** — tax portal access for every entity in the group - **BOI (Board of Investment)** portal credentials — 5 companies with tax incentive access - **Department of Business Development (กรมพัฒนาธุรกิจการค้า)** — 5 corporate filing portal credentials - **Dual VPN access** — WatchGuard Firebox at Ram Intra HQ (210.86.174.42) + **OpenVPN with full certificate chain and private key** for Neoca office (210.86.171.29) - **Oracle ERP credentials** — MMNEW/[email protected] (production system) - **SQL Server logins** including sysadmin (sa), mkuser, DB_ECM, dev_01-03 - **Microsoft 365 tenant** (millimedthailand.com) — cloud email and collaboration - **Active Directory** — domain controller at 192.168.1.2 ### 🏭 Complete Factory Infrastructure - **233+ department folders** from the factory file server — every production, quality, regulatory, and administrative department - **22 CCTV cameras + 1 access control** — complete Hikvision surveillance network with IP addresses and serial numbers covering BFS sterile area, laboratories, warehouses, food production, and all manufacturing floors - **31 internal network subnets** (192.168.69.0/24 through 192.168.100.0/24) — full factory network topology - **5 internal servers identified** — AD domain controller, 2x Orion NAS, barcode server, Chiang Rai center NAS - **VMware vSphere** virtualization infrastructure, **CheckMK** monitoring, **Hikvision iVMS-4200** CCTV management ### 🏭 Sales & Operations - **SALES & SALESAPP databases** (12+ GB) — complete sales history, pricing, customer relationships from 2022-2026 - **Monthly sales performance presentations** (January 2025 — August 2026) — OTC + prescription by area, product, channel - **Marketing database** — campaigns, customer targeting, product focus data - **Stock management** — inventory across all facilities - **Forecast data** — business projections and planning - **Transport & logistics** — GPS tracking, delivery records, government pharmaceutical organization reports --- ## Regulatory Impact Millimed should be aware of the following consequences of this data becoming public: 1. **Thai FDA (อย.) Manufacturing License** — We hold the **actual BMR documents, QA audit records, and 14 types of regulatory audit documentation** including corrections (CAR/PAR). This is not just database records — these are the physical production documents that underpin every drug Millimed manufactures. Release triggers **immediate FDA review and potential suspension of manufacturing licenses**. The FDA Quality Award for 3 consecutive years ends here. 2. **PDPA Violation (พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล)** — Personal data of **over 1,000 employees** including national ID numbers, salaries, biometric data, and home addresses has been compromised. The PDPA Office can impose fines up to **5 million THB per violation** and criminal penalties including imprisonment. 3. **Revenue Department Exposure** — We hold active login credentials for **ALL 25+ company tax portals** plus the complete intercompany financial structure across the group. The multi-entity accounting data, transfer pricing arrangements, and BOI tax incentive records will be of great interest to Thai tax authorities. 4. **Drug Formulation Theft** — Complete drug formulations including **Master Formula documents**, bioequivalence study data, R&D results, and regulatory submissions for the entire product portfolio. Competitors gain **decades of R&D investment** in seconds. The i-HERB brand formulas, Neoca supplement compositions, BFS sterile manufacturing specifications, and all proprietary pharmaceutical formulations are fully exposed. 5. **Bioequivalence Study Exposure** — Bio Equalise subsidiary's complete BE studies, including the **contract with Chiang Mai University**, LC-MS/MS analytical data, and OECD-compliant study reports. Competitors can use this data to bypass their own bioequivalence testing requirements. 6. **Banking & Credit Exposure** — K-Bank and EXIM Bank credit facility details, loan covenants, and the true financial health of each subsidiary will be publicly available, potentially triggering credit reviews, covenant violations, or credit rating downgrades. 7. **Physical Security Compromise** — The complete **CCTV surveillance network** (22 cameras + access control) with IP addresses and serial numbers, factory network topology, and building plans are exposed. Combined with VPN access credentials, this represents a total physical and digital security failure. --- ## Message to Millimed Management Chairman **Thongplew Siripornpithak** (ทองเปลว ศิริพรพิทักษ์) and the board of directors had an opportunity to resolve this matter privately. That window is closing. The data we hold represents the **complete digital footprint** of your 25+ company pharmaceutical empire — **over 3 terabytes** spanning both factory locations, the Bangkok headquarters, and all subsidiary operations. From drug manufacturing records to tax filings, from employee national IDs to bank loan structures, from factory CCTV configurations to Oracle ERP credentials. Your **Millimed BFS** subsidiary generated **593 million THB in net profit** last year with a 41.7% margin. Your parent company holds **942 million THB in retained earnings**. You can afford to resolve this. Your **i-HERB brand**, endorsed by Mario Maurer and sold across Thailand, depends on consumer trust. Your **FDA manufacturing licenses** depend on the integrity of your BMR and QA data. Your relationships with **K-Bank and EXIM Bank** depend on financial confidentiality. Your **ISO and Halal certifications** depend on audit documentation security. **All of this — 3 terabytes of it — is now in our hands.** We strongly recommend Millimed's management reconsider their position and contact us immediately to resolve this situation before the full dataset is published. **Screenshots below demonstrate the scope and authenticity of the breach:** *(See attached: 26 evidence screenshots)*

# HONG BAO GROUP — DATA BREACH **Hong Bao Group** (หงเปา กรุ๊ป) — a major Thai restaurant conglomerate operating 15+ restaurant brands across Bangkok, including **Hong Bao Restaurant**, **Water Library**, **Lovely Wine**, **PLU (พลู)**, **CIAO PIZZA**, **Bistro**, and **SEED** — has suffered a complete network compromise resulting in the exfiltration of their entire corporate infrastructure. ## Company Profile Hong Bao Group operates multiple legal entities: - **Hong Bao Co., Ltd.** (บริษัท หงเปา จำกัด) - **Hong Bao EV Co., Ltd.** (บริษัท หงเปา อีวี จำกัด) — Tax ID: 0105559005630 - **Water & Wine (Thailand) Co., Ltd.** (บริษัท วอเตอร์ แอนด์ ไวน์ (ประเทศไทย) จำกัด) - **Lovely Wine Co., Ltd.** (บริษัท เลิฟลี่ไวน์ จำกัด) - **I-Group** (investment holding) The group operates restaurants in premium Bangkok locations including MBK Center, King Square, Ramada, and multiple other shopping malls across Thailand. **Websites:** hongbaorestaurant.com | waterlibrary.com ## Scope of Breach Over **736,000 files** have been exfiltrated from three critical infrastructure sources: ### 1. Corporate File Server (FL6-SRV-FILSHA) - **86,500+ files** from all corporate departments - Accounting (Hongbao + Water divisions) - Executive Administration — including **board meeting audio recordings** - Finance department — complete reports - HR — employee records, contracts, personal documents - Purchasing — vendor agreements, pricing ### 2. Company NAS (NAS5EECFF) - **647,000+ files** — the complete corporate document archive - **hongbao/** — 400,000+ files: finance, tax, HR, SAP ERP documentation - **water/** — 180,000+ files: Water & Wine financial, banking, payroll data - **hb_wl/** — shared financial and tax records - **Scanned documents** — thousands of signed originals ### 3. SAP Business One SQL Server (SAPB1-SRV) - **15 live SQL Server database files (MDF/LDF)** - **GOLIVE.mdf** (~62 GB) — the entire SAP B1 production database containing ALL business transactions, customers, vendors, pricing, and inventory since inception - **GOLIVE_EV.mdf** (~56 GB) — complete audit trail - **SBO-COMMON.mdf** (~10 GB) — user accounts and system configuration - **master.mdf** — SQL Server authentication database with login credentials - **1,918 branch database backup archives** covering 15 branches ## Data Categories Exfiltrated ### Financial Records (15,500+ files) Complete profit & loss statements, balance sheets, cash flow reports, and audit records across all branches spanning **2022–2026**. Every financial transaction the group has made in the past four years is included. ### Banking Information (28,400+ files) - **Bangkok Bank (BBL)** Corporate iCash — account statements, transfers - **Siam Commercial Bank (SCB)** Business Net — corporate banking records - **Kasikorn Bank (K-Cash Connect Plus)** — payment records - Personal **credit card statements** of company directors - Wire transfer confirmations, payment vouchers ### Tax & Revenue Records (5,100+ files) - VAT filings for all entities - Withholding tax certificates - Revenue Department submissions - Annual tax returns from 2022–2026 ### Payroll & HR (7,800+ files) - Complete **salary records** for all employees across all branches - Overtime calculations, bonus payments - Social Security (ประกันสังคม) contributions - Provident fund records - Employment contracts ### Email Archives (14 Outlook mailboxes) Complete email archives (.PST) of key personnel from both hongbaorestaurant.com and waterlibrary.com domains, including all attachments and internal communications. ### Personal Identity Documents - **Passport scans** and **Thai national ID cards** of company directors and executives - Visa and travel documents - Flight bookings and itineraries ### Contracts & Legal (2,800+ files) - Mall lease agreements for all restaurant locations - Vendor supply contracts - Non-disclosure agreements - Employment contracts with personal terms ### Wine & Alcohol Import Licenses (425+ files) All regulatory permits, excise department records, and import documentation for the Lovely Wine business — **without which the wine import business cannot legally operate**. ### POS & Customer Data - 15+ branch point-of-sale databases with transaction history - Customer checkout records - Daily sales reports across all locations ### IT Infrastructure Access - SAP B1 user accounts (303+ users) with password hashes - SQL Server administrator credentials - QNAP NAS access credentials - TSplus remote access configuration files - Internal network mapping (172.16.x.x) - Evidence of prior security compromise (CLR assemblies loaded in SQL Server) ## Key Personnel Exposed Personal documents, passport scans, banking records, and travel documents of the following individuals are included in the breach: - **Noppadon Narittakurn** — Director - **Tata** — Director - **Zithai** — Director / Designer - **Nitchaya Tohsanguanpun** — Director ## Impact This breach represents a **complete corporate data compromise**. Every department, every financial record, every employee record, every branch database, and every executive communication has been exfiltrated. The data includes sensitive regulatory documents (tax filings, alcohol import licenses) that could trigger **government investigations** if disclosed publicly. The personal banking records and passport scans of company directors present significant **identity theft and fraud risks**. The SAP production database alone contains the company's **entire operational history** — customer lists, vendor pricing, proprietary recipes and inventory formulas, and every financial transaction processed through their ERP system. **Data volume:** 736,000+ files | 15 SQL databases | 1,918 database backups | 14 email archives **Hong Bao Group has limited time to resolve this situation before full publication.**

# Onmion LLC — One IT Provider, Three Breached Companies, 3,000+ Victims **Subject:** Onmion LLC (Mukilteo, WA) — Managed IT Provider **Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB --- ## Who Is Onmion LLC? **Onmion LLC** — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — **onmion.com** A managed IT and software services provider that markets itself as "empowering businesses with cutting-edge software technology." In practice, Onmion LLC stored all of its clients' most sensitive data — Social Security Numbers, banking records, healthcare credentials, tax filings — on shared, unencrypted infrastructure with no segmentation between client environments. Through Onmion's FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.**  *Screenshot 1 — onmion.com — "Empowering businesses with cutting-edge software technology"* --- ## Three Clients, One Point of Failure  *Screenshot 2 — All three client datasets on the same shared FTP infrastructure* | # | Client | Website | Location | Data | Individuals | |---|--------|---------|----------|------|-------------| | 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members | | 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs | | 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs | --- ## Onmion's Failures  *Screenshot 3 — N-Central RMM backup archives from Onmion's management server*  *Screenshot 4 — Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted*  *Screenshot 5 — Summary of Onmion's security failures* 1. **No segmentation** — all clients on shared FTP with no access controls 2. **N-Central RMM exposed** — 44 daily backups (45 GB) with device inventories and remote access credentials 3. **Plaintext passwords** — production databases storing user credentials in cleartext 4. **Healthcare credentials in Word docs** — 25+ login pairs for major US insurers unencrypted 5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files 6. **Refused to respond** when notified — no action, no client notification --- # CLIENT 1 — Lake Connor Park **lcpmembers.com** — Tulalip, WA — Gated residential/RV community — 500+ members — **178.8 GB exfiltrated** | Category | Details | |----------|---------| | SQL Databases | 92+ GB — member records, POS transactions, user credentials | | N-Central RMM | 45 GB — 44 daily backups of IT management server | | Gate Access Logs | 700+ daily logs — 363+ members with names, cards, timestamps | | Member Database | 500+ records with full PII, passwords in plaintext | | Healthcare Creds | 25+ pairs — AETNA, UHC, Humana, Cigna, others | | Source Code | 99 VB.NET files — POS, QuickBooks integration | | System Backups | 656 DAR archives (4.8 GB), Jan–Sep 2026 |  *Screenshot 6 — 178.8 GB data archive*  *Screenshot 7 — MAAS member database: 500+ individual PII records*  *Screenshot 8 — Daily gate logs: names, card numbers, timestamps*  *Screenshot 9 — Healthcare credentials in plaintext*  *Screenshot 10 — SQL Server database backups (92+ GB)*  *Screenshot 11 — User passwords stored in cleartext in production DB*  *Screenshot 12 — 44 daily N-Central RMM backups* --- # CLIENT 2 — Port Susan Camping Club **portsusan.com** — Stanwood, WA — Tribal nonprofit (Tulalip Tribes) — 2,490 sites — $7.4M revenue — **400+ SSNs exposed** | Category | Details | |----------|---------| | Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings | | Employee PII | 219 individuals (91 active + 128 terminated) — full SSN | | W-2 Forms | 2020-2025 — SSN for every employee | | Vendor W-9s | 202 forms — EIN/SSN for all vendors | | Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations | | HR Investigations | 10 named cases — harassment, misconduct, legal | | IRS/Tax | 990T, 1099, PPP/SBA loan records | | IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps |  *Screenshot 13 — Three data drives: Finance (K), HR (T), Departments (V)*  *Screenshot 14 — 20+ years of financial records*  *Screenshot 15 — 91 active employee personnel files*  *Screenshot 16 — W-2 forms (2020-2025) with employee SSNs*  *Screenshot 17 — 7 Heritage Bank accounts with full account numbers*  *Screenshot 18 — 202 vendor W-9 forms with EIN/SSN*  *Screenshot 19 — 10 confidential HR investigation files* --- # CLIENT 3 — CarneVita / Cured by Visconti **curedbyvisconti.com** — 1501 N Miller St, Wenatchee, WA — Food production — **26+ SSNs** — $3.4-4.8M revenue Three entities compromised through a single shared backup: | Entity | EIN | QuickBooks | |--------|-----|------------| | CarneVita, LLC | 33-3284096 | 64 MB (active) | | Cured by Visconti, LLC | 85-0659112 | 201 MB (active) | | 3 Boots Ranch & Custom Cuts | — | 13 MB (active) | | Category | Details | |----------|---------| | QuickBooks Files | 278 MB+ — complete financials for all 3 entities | | IRS W-2 Forms | 26 employees — full SSN, names, wages | | IRS 941/940/W-3 | Quarterly + annual federal tax returns | | Transactions | 2,018 documents — invoices, POs, receipts | | Backups | 70+ automated QBW backups (Feb 2025 — Apr 2026) | | Investment | Fidelity account statements |  *Screenshot 20 — W-2 forms with employee SSNs*  *Screenshot 21 — Form 941 CarneVita: 15 employees, $176K quarterly wages*  *Screenshot 22 — Form 941 Cured by Visconti: 11 employees*  *Screenshot 23 — QuickBooks files for all three entities*  *Screenshot 24 — 2,018 transaction documents*  *Screenshot 25 — PII summary across all three entities* --- ## Combined Impact | Metric | Total | |--------|-------| | Organizations compromised | 3 | | Data exfiltrated | 179+ GB | | Individuals with PII exposed | 3,000+ | | Social Security Numbers | 426+ | | Bank accounts exposed | 10+ | | Healthcare credentials | 25+ portal logins | | Financial history | 20+ years | | IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 | | Member/client sites | 2,990+ | --- ## What Affected Organizations Should Do 1. **Terminate Onmion LLC** — they knew and chose silence 2. **Engage independent cybersecurity counsel** 3. **Begin breach notification** per WA State RCW 19.255.010 4. **Notify banks** — Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita) 5. **Report to WA Attorney General** and relevant authorities 6. **Offer credit monitoring** to all individuals with exposed SSNs **All data will be published in full if Onmion LLC continues to refuse engagement.** --- *Onmion LLC — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — onmion.com* *Lake Connor Park — lcpmembers.com | Port Susan Camping Club — portsusan.com | CarneVita — curedbyvisconti.com*

# NANDAN TERRY LTD — DATA BREACH ANNOUNCEMENT **Industry:** Textile Manufacturing (Terry Towels, Bathrobes) **HQ:** Dholka, Ahmedabad, Gujarat, India **Group:** Chiripal Group **Website:** nandanterry.com **Revenue:** ~$23M USD (₹194 Crore) **Employees:** 500+ --- ## WHAT WE HAVE Nandan Terry Limited's entire corporate infrastructure has been compromised. We have exfiltrated **200GB+** of data from their internal file servers including 68 workstation backups and all department shared drives. --- ### 🔑 CREDENTIALS & ACCESS (46+ accounts) Login credentials for **every shipping and logistics portal** they use — including their supply chain accounts with: - **H&M Supplier Portal** (supplierportal.hm.com) - **Marks & Spencer** Trading Grid & EDI - **Walmart** cargo systems - **Puma** shipping & PO management - **ALDI** production & contracts - **LIDL**, **TJX/Marshalls**, **Ross Stores**, **BJ's Wholesale**, **Big Lots**, **QVC**, **Metro**, **XXX Lutz** - **DHL**, **Kuehne+Nagel**, **GEODIS**, **Yusen Logistics**, **Expeditors** All usernames, passwords, portal URLs. Many still active. --- ### 💰 COMPLETE FINANCIAL RECORDS - **Profit & Loss** statements — monthly, FY 2024-2026 - **Balance Sheet** FY 2024-25 (audited, 47 pages) - **Consolidated P&L** with revenue breakdown (Export vs Domestic) - **EBITDA, Net Profit, Working Capital** calculations - Revenue: **₹194 Crore** ($23M), Net Profit: **₹9 Crore** ($1.07M) - Full cost structure: raw materials, salary, power, logistics --- ### 🏦 BANKING & LOAN DATA Complete banking relationships with **7 major Indian banks**: | Bank | Facility | |------|---------| | **Punjab National Bank (PNB)** | CC ₹70Cr + TL ₹95Cr | | **State Bank of India (SBI)** | TL ₹47Cr | | **Bank of Baroda (BOB)** | TL ₹47Cr | | **Canara Bank** | TL ₹47Cr | | **Central Bank of India (CBI)** | TL ₹70Cr | | **Union Bank (UBI)** | TL ₹47Cr | | **Bank of Maharashtra + Bandhan Bank** | CC facilities | **Total loan exposure: ₹433+ Crore ($51.5M)** All account numbers, IFSC codes, bank RM contacts (names, phones, emails), repayment schedules, interest calculations included. **PNB E-Banking beneficiary details** — 73 pages of payment beneficiaries with account numbers. --- ### ⚠️ CIBIL CREDIT REPORTS & LEGAL ISSUES **Extremely sensitive** credit bureau data: - **CIBIL Commercial Credit Report** — 69 pages, full credit history - **DPD (Days Past Due) reports** from Canara Bank (31 days) and SBI (29 days) — **evidence of late loan payments** - **CIBIL irregularity complaints** to PNB - **Legal suits against company and directors** — documented in internal files - **NCLT (National Company Law Tribunal)** withdrawal orders - Director **Braijmohan Chiripal** — CIBIL irregularity for housing loan ₹4.75 Crore - **CRILC (Central Repository)** reporting disputes with Bank of Baroda, Central Bank of India, SBI This data reveals the company's **true financial health** — not the version they show to their buyers. --- ### 👥 EMPLOYEE DATA (500+ workers & staff) - **Complete salary sheets** — every employee, every month (NTPL Staff, NTPL Workers, SPG Staff, SPG Workers) - **Worker increment proposals** with full PII: Name, Father's Name, Department, Designation, Date of Joining, Salary - **PF (Provident Fund)** and **ESI** data - **SAP payroll upload files** with individual amounts - **KPI performance data** — individual worker performance metrics --- ### 📋 CLIENT & SUPPLY CHAIN DATA **62+ global buyers** in customer master including: ALDI, H&M, Walmart, Marks & Spencer, Puma, TJX (Marshalls/TK Maxx), BJ's Wholesale, Ross Stores, Big Lots, QVC, Metro, XXX Lutz, Falabella, LIDL, Meijer, Bealls, Liberty, Hemtex/Kesko, Vineyard Vines, Cencosud, DD's Discount **Client-specific data includes:** - Purchase Orders with pricing - Product specifications (GSM, size, design files) - H&M Master Order Dashboards (2023-2026) - Puma packing instructions & shipment data - ALDI contract correspondence - Production schedules per buyer - Cost sheets and margin calculations **This data is devastating for their buyer relationships.** Major retailers like H&M and Walmart require strict data security compliance from suppliers. This breach proves Nandan Terry cannot protect their supply chain data. --- ### 📁 CORPORATE & LEGAL DOCUMENTS - **KYC package:** CIN, IEC (Import Export Code), GST Registration, Export House Certificate - **Board Resolutions** (conversion from Pvt to Public) - **Director list** with education and experience - **Insurance policies** (8 active — plant, machinery, solar, marine) - **Settlement agreements** (Uday Buildcon) - **Tax Audit Reports** (FY 2019-2025) - **Secretarial Audit Report** 2024 - **CredAvenue borrower profile** and shareholding patterns - **DSRA release letters** from 4 banks --- ### 🗂️ DATA VOLUME | Category | Volume | |----------|--------| | Workstation backups | 68 machines | | Financial records | Monthly P&L, BS, NCA (2+ years) | | Salary data | ALL employees, monthly | | Banking data | 7 banks, full account details | | Client data | 62+ global buyers | | Credentials | 46+ portal logins | | Legal/CIBIL | Credit reports, court cases | | Insurance | 8 active policies | | Total estimated | **200GB+** | --- ## ⏰ TIMELINE **Announcement published.** Nandan Terry Limited has been contacted. ⬛ **4 DAYS** — deadline to begin negotiations. If no contact is made, this page will be updated with additional proof samples and the countdown to full publication begins. ⬛ **+10 DAYS** — full data publication. If no agreement is reached within 10 days after the announcement deadline, the following actions will be taken: 1. **Full financial data** published (P&L, Balance Sheet, loan schedules, CIBIL reports) 2. **CIBIL credit reports and DPD irregularities** sent directly to all 7 banking partners — PNB, SBI, BOB, Canara, CBI, UBI, Bank of Maharashtra 3. **H&M, Walmart, Puma, ALDI, Marks & Spencer** notified of their supplier's data security failure and supply chain data exposure 4. **46+ portal credentials** published — active shipping and logistics accounts compromised 5. **Employee PII** released — salary data, PF numbers, personal details of 500+ workers 6. **Complete data dump** published on clearnet and Tor — free download for anyone **Total time to act: 14 days from today.** The clock is ticking. --- *Data verified. Screenshots below are samples only. Full dataset available for verification upon contact.* --- ## 📸 PROOF — DATA SAMPLES *Screenshots from exfiltrated data:*                

# La Filipina Uy Gongco Corporation (LFUGGOC) — Philippines **Published:** [DATE] **Data Volume:** 278,594 files --- ## Company Overview **La Filipina Uy Gongco Group of Companies (LFUGGOC)** is a major Philippine conglomerate operating across multiple industries including food manufacturing, flour milling, animal feed production, sugar processing, livestock farming, port operations, logistics, and real estate. **Website:** foodgroup.ph **Headquarters:** Taguig City (BGC), Metro Manila, Philippines **Employees:** 1,500+ **Annual Revenue:** Estimated PHP 15-20 billion ($270-360M USD) **Auditor:** SGV & Co. (Ernst & Young Philippines) **ERP:** SAP S/4HANA The group operates 17+ legal entities across the Philippines with nationwide operations spanning Luzon, Visayas, and Mindanao regions, including 6+ port terminals, flour mills, feed mills, sugar centrals, farms, retail stores, and distribution networks. --- ## Group Entities | Segment | Companies | |---|---| | **Logistics** | Amigo Logistics Corp (ALC), Amadi ALC Services (AASI), Amadi MGT Terminals (AMTI), Mariveles Grain Corp (MGC) | | **Flour & Pasta** | Philippine Foremost Milling Corp (PFMC), PLILI, MT Philippine Container (MTPCI) | | **Feeds & Livestock** | LFUG Manufacturing (LFMI), Farms Division, Progreso Retail Stores (PRSI) | | **Sugar** | CSCI, CAFC, RAFC, Plantation Division | | **Commodities** | Advanced Agrisolutions Philippines Corp (AAPC), Gentle Earth | | **Holdings** | CDH Holdings, STARCI/PGIC, Hok Heng/HHH Trading | | **Real Estate** | LFUG Realty | --- ## Data Exfiltrated Complete contents of the production file server (FILESHARED01) containing 278,594 files spanning 2018-2026, including: ### Financial Data - **Consolidated Financial Statements** for the entire group (FY2022 through July 2026) - **Annual Financial Statements** (AFS) for all business units - **Budget files** for 2022-2027 including forward projections - **SGV (Ernst & Young) external audit workpapers** (2022-2025) - **Bank statements** and reconciliation files (BPI, BDO, Metrobank) - **Loan documents** including PHP 300M+ BPI promissory notes and amortization schedules - **Quarterly Income Tax Returns** and all BIR filings ### Employee Data (PII) - **Complete payroll summaries** for all months of 2025 (24 files, ~13MB each) - **Employee Alphalist** (JAN-DEC 2025) — all employee TIN numbers and annual income - **Employee contact details** — names, phone numbers, email addresses, positions - **13th Month Pay summaries** - **Leave summaries** and tax refund data - **SSS, HDMF (Pag-IBIG), and PhilHealth** contribution records ### Organizational Data - **30+ organizational charts** for all business units (dated March 2025) - **Job descriptions** with career paths for all positions - **KPI documents** - **Headcount reports** (2026) ### Customer & Vendor Data - **Customer contact database** (26MB) including major Philippine food brands: - Jollibee Foods Corporation - Goldilocks Bakeshop Inc - Shakey's Pizza Commerce Inc - The French Baker Inc - Pan De Manila - North Park Noodle House - Vikings Group - Monde Nissin Corporation - Del Monte Philippines - **100+ flour bakery client files** across the Philippines - **30+ notarized vendor contracts** ### Legal & Compliance - Correspondence and billing from **5 law firms** (MVGS Law, SAM Law, MOST Law, Rojas & Uy, Tillman & Marquez) - **Litigation files** - **SEC filings** and corporate governance documents - **BIR validated tax returns** (2022-2025) - **Business permits** (Taguig, Davao, Iloilo, Ingore) - **Insurance policies** and asset registers ### Operations - **Import/export documentation** and customs records - **Vessel operations** data and shipping schedules - **SAP S/4HANA** data exports, journal entries, and master data - **Marketing materials** for brands: Iron Claw, Canis Prime, IC+, Progreso - **IT infrastructure** data including database connection files --- ## Regulatory Implications This data is subject to the **Philippine Data Privacy Act of 2012 (Republic Act No. 10173)**, which requires: - **Mandatory breach notification** to the National Privacy Commission (NPC) within 72 hours - **Notification to affected data subjects** (1,500+ employees and thousands of customers) - Penalties of up to **PHP 5,000,000** and **imprisonment of 3-6 years** for violations The company has **5 business days** to respond before data publication begins. --- ## Proof of Data See attached screenshots showing: 1. Complete file server directory structure 2. Employee payroll files with dates and sizes 3. Group consolidated financial statements 4. HR organizational charts for all business units 5. Customer contact database and email addresses 6. Banking documents and tax filings

# ZIRNET LLC — Managed Service Provider — FULL BREACH **Published:** October 2026 **Sector:** Information Technology / Managed Services (MSP) **Location:** Port Washington, New York, USA **Website:** zirnet.com --- ## Summary ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida. We have obtained **complete access** to ZIRNET's internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals. **Total data: 2,260,963 files across ZIRNET and 12 client server backups.** --- ## Affected Organizations ZIRNET's negligent security practices have resulted in the exposure of the following companies' complete IT environments: | # | Company | Industry | Location | Files | |---|---------|----------|----------|-------| | 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 | | 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 | | 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 | | 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 | | 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 | | 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 | | 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 | | 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 | | 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 | | 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 | | 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 | | 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 | **Additional organizations with exposed credentials and data:** - Skylatus Property Capital LLC (Real Estate) - ClearScope (myclearscope.com) - Midtown Operating Corp - Credit and Debt Management Institute (Bolivar, TN) - La Perla Construction & Design - LIVOTIS Old World Market - St. Albans Congregational Church (Queens, NY) - Creative Mobile Technologies (CMT) - North Side Transmission - NY Flooring Inc - Metropolitan Association of the NY Conference --- ## What Was Obtained ### 1. ZIRNET Internal Data (2,743 files) - **QuickBooks databases** — Zirnet.QBW (163 MB) and 2025.QBW (155 MB) — complete financial records - **Bank statements** — TD Bank, American Express, Bank of America — 36 PDF statements covering 2024-2026 - **Email archive** — 3.27 GB of PST files (Outlook) containing all business correspondence - **IRS documents** — W-9, estimated tax payments, certified copies - **Client proposals and contracts** — service agreements with all clients ### 2. Complete Credential Database (100+ accounts) For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained: - **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords - **Industrial Solutions (ISNY):** 39 email accounts with passwords - **ClearScope:** 8 Microsoft 365 accounts with passwords - **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials - **St. Albans Church:** 18 email accounts + Azure tenant secret key - **LIVOTIS:** 3 accounts + VoIP portal access - **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness) ### 3. Hidden Backdoor Account on ALL Client Machines ZIRNET created a **hidden administrator account** on every managed workstation and server: ``` Username: NetworkAccess Password: [REDACTED] ``` This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** — a single credential compromise gives access to every machine ZIRNET manages. ### 4. Credit Card Numbers (with CVV) Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes. ### 5. Personal Identifiable Information (PII) - **Social Security Numbers** — Employee SSN scans from Dynotec, ASK Construction - **Birth certificates** — AlphaOne USA (family members) - **W-2 forms / Tax returns** — Multiple years (2021-2025) for AlphaOne USA employees - **Employee I-9 forms and drivers licenses** — AlphaOne USA - **Medical records** — Owner's colonoscopy, CT scan, and family medical documents - **Credit reports** — Owner's personal credit history (2005-2015) - **Payroll data** — Complete W-2/W-3 packages for multiple years across organizations ### 6. Network Infrastructure - **Juniper SRX firewall configuration** (Midtown Operating) — root passwords, VPN pre-shared keys, full NAT rules, internal network topology - **Meraki MX67 firewall credentials** (Skylatus) — admin password, WiFi PSKs, external IP - **N-Central RMM admin credentials** — ZIRNET's remote management console controlling all endpoints - **Azure tenant secrets** — tenant IDs, client secrets for M365 migrations ### 7. Full Server Backups (12 clients) Complete drive images from 12 client servers including: - All user documents, profiles, and application data - Accounting records (invoices, payroll, tax documents) - Private folders with personal files - Browser profiles with saved credentials - Construction project files, contracts, permits - HR files, employee records, compliance documents --- ## Evidence **See attached screenshots:** 1. `01_clients_list.png` — Full client listing with file counts 2. `02_credentials.png` — Sample of extracted credentials (partially redacted) 3. `03_financial.png` — ZIRNET financial data and bank accounts 4. `04_pii_sensitive.png` — PII and sensitive document inventory 5. `05_infrastructure.png` — Network backdoors and firewall configurations --- ## Impact Assessment This breach affects: - **13+ organizations** across New York, New Jersey, Florida, and Tennessee - **500+ individuals** (employees, contractors, clients of affected companies) - **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data) ZIRNET's security practices represent gross negligence: 1. **Storing all client passwords in plaintext text files** 2. **Using a single hidden backdoor account across all clients** 3. **No encryption on sensitive data storage** 4. **Storing credit card numbers with CVV in plain text** 5. **Mixing personal medical/financial records with business data** --- ## Contact ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published. Countdown: **7 DAYS** After the deadline: - All credentials will be published unredacted - All PII including SSNs will be published - All financial records will be published - Each affected company will be notified individually - Data will be made available for free download **ZIRNET:** You know how to reach us. The clock is ticking. --- *This post will be updated as more data is analyzed. Additional client data may be published as proof of access.*

# Elitdata i Varberg AB — Complete Infrastructure Breach **Published:** [DATE] --- Elitdata i Varberg AB (org.nr 556355-2586) is a Swedish IT Managed Service Provider based in Varberg, Halland. Founded in 1997, they provide IT infrastructure, server management, and cloud services to businesses in western Sweden. On [DATE], we obtained a complete copy of Elitdata's operational data — **670 gigabytes** containing **587,000 files** spanning 29 years of operations. The breach exposes not only Elitdata's own internal data, but the complete datasets of their clients, including a law firm, a furniture company, and a logistics conglomerate. Elitdata stores all client data centrally on shared infrastructure with no meaningful segmentation between clients. A single compromise cascades through their entire client base. --- ## The Scope | Dataset | Type | Size | Files | |---|---|---|---| | Elitdata i Varberg AB | IT Provider internal ops + 198 client folders | 80 GB | 55,000 | | Advokatfirman Kurt Lundberg HB | Swedish law firm | 122 GB | 204,000 | | Artwood AB | Furniture & design company | 205 GB | 327,000 | | Mantum Group | Logistics & construction conglomerate | 263 GB | 129 | | **Total** | | **670 GB** | **587,000** | --- ## Elitdata — The IT Provider **Address:** Västra Vallgatan 7, 432 45 Varberg, Sweden **Website:** elitdata.se | **Phone:** 0340-86860 Elitdata is owned by Mattias Rödlund and Stefan Qvarford. Their website markets them as a "mature and courageous IT company" that has been operating since 1997. From their infrastructure we obtained: **198 Client Organizations** — complete IT documentation for each, including: - VPN access configurations (.tgb) to connect directly to client networks - Firewall configurations (full rulesets) - Bitlocker encryption keys - Server documentation and network diagrams - Remote Desktop (RDP) connection files for 50+ client sites **Wildcard SSL Private Keys:** - `*.elitdata.se` — certificate with private key (.pem, .pfx), valid 2025-2026 - `*.mantum.se` — certificate with private key (.key, .pem, .pfx), valid 2026 **XCA Certificate Database** — the complete certificate authority used to manage all SSL certificates. **Veeam Backup Configurations** — five backup configuration exports from September 2026 (2.3 GB total), containing the full backup infrastructure layout. **Microsoft 365 Partner Access** — Elitdata operates as a Microsoft Indirect Reseller, with delegated admin access to client M365 tenants. **Employee Data** — vacation/absence records 2009-2025, driving logs, personal folders for all staff. **NIS2 Compliance Documents & Incident Response Plan** — ironically, their own security documentation is part of the breach. --- ## Client 1: Advokatfirman Kurt Lundberg HB — Law Firm **122 GB | 204,000 files | Org.nr 559218-5713** This is the most sensitive dataset. Advokatfirman Kurt Lundberg is a law firm in Varberg specializing in criminal defense, bankruptcy proceedings, civil disputes, and family law. The exposed data includes the **complete case archive** of the firm: ### Criminal Defense Cases — 26,871 files The criminal defense archive contains named defendants with their: - Full police investigation reports (FUP — förundersökningsprotokoll) - Attorney defense notes and strategy documents - Personal identity documents and passport copies - Court case references (Varbergs Tingsrätt, Göteborgs Tingsrätt) - Phone call logs between attorney and client - Evidence files including USB phone extractions Case types include aggravated tax fraud (grovt skattebrott), civil registration fraud (folkbokföringsbrott), assault, drug offenses, and multiple migration/asylum cases. ### Bankruptcy Proceedings — 110,973 files Complete legal files for 20+ company bankruptcies, including: - Creditor lists and debt inventories - Asset valuations and estate inventories - Creditsafe credit reports - Court filings and distribution plans - Wage guarantee (lönegaranti) documents for affected employees ### Civil Disputes & Family Law — 20,807 files - Civil lawsuits and insurance claims - Inheritance distributions (arvskiften) - Guardianship cases (God Man) - Custody matters - Estate administration (dödsbon) ### Attorney Communications - Email archives (PST) totaling approximately 15 GB - Internal correspondence between lawyers - Client communication records ### Financial Records - Complete SIE accounting files 2020-2026 - Payroll records (Visma Lön 300) for 2021-2024, including a separate file for "Advokatfirman Anton Karlsson AB" - Balance reports and general ledger entries **Identified attorneys and staff:** Anton Karlsson (primary case attorney), Sofia (disputes/family law), Henrik, Anders, Krister, Peter, Tina, Ing-Mari, Ulla, Kurt Lundberg (founding partner). --- ## Client 2: Artwood AB — Furniture & Design **205 GB | 327,000 files** Artwood AB is a Swedish furniture and home décor company with international sales across Scandinavia, Europe, and New Zealand. The exposed data includes their **complete business operation:** - **Purchasing** (55,684 files) — supplier contracts, purchase orders, pricing structures with factories - **Sales** (15,058 files) — complete customer lists, pricing, order history - **Marketing** (33,969 files) — product catalogs, campaigns, promotional materials - **Complete ERP backup** (54,916 files) — Pyramid ERP system with full database - **3D product renders** (19,407 files) — entire 2026 product line in 3D - **Employee data** — phone list of all employees, email lists, personnel records, anniversary tracking - **EU Deforestation Regulation** (EUDR) compliance documentation **From Elitdata's client folder for Artwood:** - VPN configuration file (Artwood.tgb) - Complete firewall configuration (startup-config.conf) - SSL certificate for mail.artwood.se with private key - GDPR Data Processing Agreement (Personuppgiftsbiträdesavtal) - Incident report templates A competitor with access to this data would gain complete visibility into Artwood's supplier network, pricing strategy, customer base, and product pipeline. --- ## Client 3: Mantum Group — Logistics & Construction Conglomerate **263 GB | 129 files (all SQL databases)** Mantum is a Swedish conglomerate operating across logistics, construction, and transportation through multiple subsidiaries. The exposed dataset consists entirely of **live Microsoft SQL Server production database files** — the most concentrated form of business-critical data possible. ### Databases: | Database | Size | Contents | |---|---|---| | BC140.mdf | 103 GB | **Microsoft Business Central PRODUCTION** — complete ERP | | RamosMantumProd.mdf | 28 GB | Production management system | | Flow_Mantum (6 instances) | 82 GB | Manufacturing/logistics operations | | Hogia_HR_Foundation | 2.7 GB | **HR database — employee records, contracts, personnummer** | | Hogia_PBM (7 databases) | 1.7 GB | **Payroll & personnel management** | | Hogia_Travel | 72 MB | Travel/expense management | | Opter + Opter_Special | 8.2 GB | Transport/logistics management | | Per-company accounting | ~600 MB | 10 subsidiaries, 7 years of data | ### Subsidiary companies exposed: Mantum Entreprenad AB, Mantum Entreprenad i Sverige AB, Mantum Holding AB, Mantum Logistics, Mantum Special AB, Hyltebruks Transport AB, Veddige Åkeriaktiebolag, KC Holding, V Service AB, VAAB Service AB. ### Plaintext Credentials From Elitdata's client documentation for Mantum, a file titled "Användare.txt" contains plaintext credentials: - **Microsoft 365 Global Admin:** [email protected] - WiFi network passwords for all Mantum SSIDs - Aruba switch and access point admin credentials - Application credentials for RAMOS production system - Individual user credentials These databases contain every financial transaction, employee record, salary payment, customer invoice, supplier payment, inventory movement, and logistics operation for the entire Mantum corporate group spanning 2018 through 2025. --- ## Why This Matters ### 1. Supply Chain Cascade One IT provider. 198 client organizations. All exposed through a single point of failure. Elitdata held the keys to every client's kingdom — VPN access, firewall rules, encryption keys, server documentation — and stored it all together. ### 2. Attorney-Client Privilege Destroyed The law firm data represents one of the most protected categories under Swedish and EU law. Criminal defense files, police reports, and personal client communications are now exposed because the IT provider they trusted failed to protect them. ### 3. GDPR Nuclear Scenario Elitdata serves as data processor (personuppgiftsbiträde) for all 198 clients. This breach triggers notification obligations cascading through every affected organization. The Swedish Authority for Privacy Protection (IMY) will need to assess GDPR violations not just for Elitdata, but potentially for each client that entrusted their data. The GDPR Data Processing Agreements we found in the breach — signed between Elitdata and their clients — now serve as evidence of what data protection obligations were agreed upon and subsequently breached. ### 4. Active, Current Data The most recent files are dated September 2026. Veeam backup configurations from September 17-21, 2026. VPN configurations updated August 2026. SIE accounting files for fiscal year 2025-2026. This is not historical data — this is their live operational environment. --- ## Data Available The complete dataset (670 GB) is available for download and includes: - Internal IT infrastructure documentation for 198 Swedish organizations - Law firm complete case archive (criminal defense, bankruptcy, disputes, family law) - Furniture company complete business data (ERP, purchasing, sales, HR) - Logistics conglomerate SQL production databases (ERP, HR, payroll, accounting) - SSL wildcard certificates with private keys - VPN and firewall configurations for client networks - Microsoft 365 delegated admin access documentation - 29 years of operational records --- *Contact us through our secure channel for any inquiries.*

# PT Forisa Nusapersada **Industry:** Food & Beverage Manufacturing (FMCG) **Headquarters:** Jakarta, Indonesia **Manufacturing:** Cikupa (Tangerang) & Ungaran (Central Java) **Revenue:** IDR 5.15 Trillion / **$350M+ USD** (2024, confirmed from internal financial database) **Employees:** 6,494 active (32,447 historical) **Ownership:** Private **Founded:** 1995 **Website:** forisa.co.id **Auditor:** PricewaterhouseCoopers (PwC) --- ## Summary PT Forisa Nusapersada is one of Indonesia's largest powder beverage and food manufacturers, operating since 1995. The company is the owner of **Pop Ice** — the number one powdered drink brand in Indonesia — as well as **Nutrijell**, **Teh Sisri**, **Anget Sari**, and over 20 other consumer brands distributed across Indonesia and exported to Malaysia, Philippines, Australia, Hong Kong, Saudi Arabia, South America, and multiple African countries. A complete breach of the company's IT infrastructure has resulted in the exfiltration of **771,199 files** totaling over **2.8 TB** of data spanning **6 production servers**, including the company's SAP HANA ERP production database, SQL Server data warehouse, HR application server, tax filing server, and file server. **Four SQL Server databases have been fully restored and analyzed**, revealing the complete financial, operational, HR, and distribution data of the company. Despite attempts to establish contact, the company has not responded. --- ## Scope of Compromised Data **Total volume:** 771,199 files **Data size:** 2.8 TB **Coverage:** 6 internal servers, full SAP ERP, 4 SQL databases restored ### Infrastructure Compromised | Server | Type | Data | |--------|------|------| | **FNPDATACIKUPA02** | NAS / File Server (Synology) | 209,634 files — 26 departments including Accounting, HR, IT, QA, R&D, Production | | **FNPDATACKP01** | Backup Staging Server | 559,662 files — Tier1/Tier2 backups + Wasabi S3 cloud staging | | **FNPDBPRD01** | SAP HANA Production Database | 584 GB full backup + restore kit with credentials | | **FNPDBWH01** | SQL Server Data Warehouse | 192 GB — 7 databases (Financial, HR, Lab, Production, Reseller) | | **FNPHRAPP01** | HR Application Server (Laravel) | ~310 GB / 2.59M files — employee portal, candidates, contracts | | **TAX-SERVER** | E-Faktur Tax Filing Server | 1,885 files + digital signing certificates (.p12) | ### Active Directory Domain - **Domain:** FORISA (forisa.co.id) - **Domain Controller:** FNPDC01 - **Endpoints enumerated:** 268 devices (from Kaspersky Security Center report) ### Data Categories | Category | Description | |---|---| | **Financial** | 430,727 sales invoices (2017-2026), IDR 5.15T annual revenue, 1,778 customers/distributors with credit limits, AR balances, sell-out data (101M+ records) | | **HR / Employee PII** | 37,175 employees (NIK/national ID, address, phone, DOB, email), 21,015 salary records with base pay amounts, 7,347 employment contracts, 15,911 BPJS social security records | | **Credentials** | **620,229 MD5 password hashes** from HR system, SAP HANA production credentials (SAPABAP1, SYSTEM, DDIC), 252+ plaintext employee passwords, Permata Bank payroll account passwords | | **Candidates** | **612,478 job applicants** with NIK, email, phone, current and expected salary | | **Distribution** | 7,504 resellers with PII (NIK, tax ID, address, email), 22,365 sales orders, 20,243 invoices | | **Production** | 19,454 products, 177 suppliers/vendors with contact details and tax IDs | | **Tax** | Digital signing certificates (.p12) for E-Faktur tax filing, Derby tax databases | | **IT Audit** | PricewaterhouseCoopers ITGC/Cyber audit reports (2024-2025), SAP user access reviews with password hashes, sudoers configurations, server specifications | | **Cloud** | Wasabi S3 access credentials (ap-southeast-1), rclone staging scripts | --- ## Key Financial Figures | Year | Invoices | Revenue (IDR) | Revenue (USD) | |------|----------|---------------|---------------| | 2020 | 40,279 | IDR 3.95 Trillion | $274M | | 2021 | 43,647 | IDR 4.11 Trillion | $285M | | 2022 | 52,122 | IDR 4.64 Trillion | $324M | | 2023 | 49,768 | IDR 4.88 Trillion | $341M | | **2024** | **56,148** | **IDR 5.15 Trillion** | **$360M** | | **2025** | **52,133** | **IDR 5.06 Trillion** | **$354M** | | 2026 (Jan-Sep) | 38,301 | IDR 3.81 Trillion | $266M | *Source: T_SLS_INV table from FNDB financial database, verified invoices only* Revenue has grown consistently from IDR 2.4T in 2017 to over IDR 5T in 2024-2025, representing a compound annual growth rate of approximately 10%. **Monthly payroll (September 2026):** IDR 3.42 Billion (~$216,000) for Cikupa factory alone via Permata Bank. --- ## Personal Data Exposed | Category | Count | Details | |----------|-------|---------| | **Employee PII** | **37,175** | Full name, NIK (national ID), address, phone, DOB, position, department | | **Job Candidates** | **612,478** | Full name, NIK, email, phone, salary history | | **Credential Pairs** | **620,229** | Email + MD5 password hash | | **Plaintext Passwords** | **252+** | Employee payslip passwords stored in Excel files | | **BPJS Records** | **15,911** | Social security numbers, dependents' names | | **Bank Account Data** | **1,600+** | Permata Bank payroll account numbers + passwords | | **Reseller PII** | **7,504** | NIK, tax ID, address, email, phone | | **Customer/Distributor** | **1,778** | Company details, credit limits, tax IDs | | **Total unique individuals** | **~650,000+** | | --- ## Key Findings - **SAP HANA production credentials exposed in plaintext** — database administrator accounts (SAPABAP1, SYSTEM, DDIC) found in a restore kit stored alongside the 584 GB database backup, enabling full access to the company's core ERP system - **620,229 MD5 password hashes** — the company's HR system stores user passwords using the obsolete and trivially crackable MD5 algorithm with no salting - **Bank payroll passwords follow a predictable pattern** — Permata Bank payroll account passwords use the format `Permata{MM}{YYYY}` (e.g., Permata062026), sent via unencrypted email and stored in .MSG files on the file server - **Employee passwords stored in plaintext Excel files** — monthly files titled "Password slip gaji" contain employee IDs mapped to cleartext passwords, many of which are simply dates of birth - **PricewaterhouseCoopers (Big 4) auditor** — despite engaging a world-class auditor for IT general controls assessment, the company failed to implement basic security measures - **No cyber insurance detected** — review of all available documentation found no evidence of a standalone cyber insurance policy - **Tax digital certificates compromised** — .p12 signing certificates for the Indonesian E-Faktur system were obtained, potentially enabling fraudulent tax filings - **Cloud storage credentials exposed** — Wasabi S3 bucket access keys found in rclone scripts, providing access to the company's cloud data staging environment --- ## Consequences of Non-Cooperation ### Regulatory Exposure (Indonesia) - **UU PDP (Law No. 27/2022 — Personal Data Protection):** Effective October 2024. Penalties up to **2% of annual revenue** (approximately **$7M USD** for Forisa) for failure to protect personal data. The breach affects 650,000+ individuals. - **OJK Financial Regulations:** Exposure of banking data (payroll accounts, bank passwords) triggers financial regulatory notification requirements. - **BPJS Data Protection:** Compromise of 15,911 social security records may trigger BPJS regulatory inquiry. ### Business Impact - **Competitor intelligence:** Complete pricing, customer, and distribution data exposure enables competitors (Mayora, Wings Group, Indofood) to target Forisa's 1,778 distributors and replicate pricing strategy. - **Brand damage:** Pop Ice and Nutrijell are household brands in Indonesia. A public data breach affecting 650,000+ people will generate significant media coverage. - **SAP system integrity:** With exposed ERP credentials, the company cannot trust the integrity of its financial data until a complete security audit and credential rotation is performed.

2F1JV is a nonprofit joint venture between VINCI Construction Grands Projets and Archirodon. They built the main depot, Al Faya, for Etihad Rail in Abu Dhabi under contract D0201, valued at approximately $230–310 million.

Avolta is a global retail company specializing in convenience stores and travel retail operations. Founded in 2020 and headquartered in Switzerland, the company maintains a significant international presence across Europe, North America, Asia-Pacific, Middle East, and South America. Avolta operates extensive retail networks in airports, transportation hubs, and commercial centers, offering consumers convenient shopping experiences with a diverse range of products and services. The company leverages mobile applications and digital solutions to enhance customer engagement while maintaining physical retail locations worldwide.

# American Council on Education — Data Breach Disclosure **Published:** September 30, 2026 **Data Publication Date: October 7, 2026** --- > *ACE was given the opportunity to resolve this matter privately. Their leadership engaged in discussions, then chose to walk away without resolution. Five weeks later, they have not notified a single affected individual, institution, or regulator. That decision has consequences.* --- ## About ACE The [American Council on Education](https://www.acenet.edu) (ACE) is the primary coordinating body for U.S. higher education. Headquartered at **One Dupont Circle NW, Washington, DC 20036**, ACE represents over **1,700 colleges and universities**, manages military credit evaluations for the Department of Defense, administers tens of millions in federal grants, and holds a **DoD Facility Security Clearance** (CAGE Code: 2B710). ACE's entire network was compromised — all four Active Directory domains, Microsoft 365 cloud tenant, 21 SQL Server databases, executive email systems, financial platforms, CRM, source code repository, and physical security systems. **271 GB of data was exfiltrated.** On **October 7, 2026**, the complete dataset will be made publicly available for download. --- ## Table of Contents 1. [Personal Data](#1-personal-data--700000-individuals) 2. [Financial Records](#2-financial-records--117-billion-18-years) 3. [Military & Defense](#3-military--department-of-defense) 4. [Federal Grants](#4-federal-grants--94-million) 5. [Executive Email](#5-executive-email--349000-files) 6. [Source Code & Credentials](#6-source-code--credentials) 7. [CRM & Membership Intelligence](#7-crm--membership-intelligence) 8. [ACE's Choice](#8-aces-choice) 9. [Data Availability — October 7](#9-data-availability--october-7-2026) 10. [File Tree](#10-file-tree--271-gb) 11. [Sample Data](#11-sample-data) --- ## 1. Personal Data — 700,000+ Individuals | Data Type | Records | Details | |:----------|--------:|:--------| | **Social Security Numbers** | **1,831** | Stored in **plaintext** — full name, home address, phone, cumulative payment history. Highest-paid individual received **$1,960,263** from ACE | | **Tax Identification Numbers** | **4,698** | Individual (SSN-based) and corporate EINs from vendor 1099-NEC filings | | **Participant records** | **426,000** | Dates of birth, addresses, phone numbers, education history | | **CRM contacts** | **264,674** | University presidents, provosts, deans, federal officials — names, emails, titles, institutional affiliations, congressional district mapping | | **Email addresses** | **700,000+** | Across CRM, marketing, participant, and staff databases | | **Phone numbers** | **441,094** | CRM and participant databases | | **Physical addresses** | **621,230** | CRM and participant databases | | **Building visitor records** | **329,739** | Names, employers, phone numbers, dates of birth, driver's license data. **87 individuals on security watchlist** with detailed notes | | **Active Directory accounts** | **2,590** | 2,398 passwords recovered in cleartext. All 11 Domain Admin accounts shared the same password | --- ## 2. Financial Records — $1.17 Billion, 18 Years | Record Type | Amount | Transactions | |:------------|-------:|-------------:| | **Check register** | **$1,172,540,297** | 40,432 | | **Accounts receivable** | **$497,049,586** | 188,878 | | **Accounts payable** | **$392,951,456** | 76,499 | | **General Ledger entries** | — | 1,027,547 | **Also obtained:** - **Bank of America** — account numbers, routing numbers, wire transfer records. Master ZBA balance: **$3,659,703**. Routing: `054001204`. ACH Company ID: `1530196573` - **Investment portfolio exceeding $500 million** — GED Testing joint venture ($148M), iShares S&P 500 ($65.7M), Cash Depository ($62.9M), Vanguard ($23.5M), Goldman Sachs ($12.7M) - **Wire transfers** up to **$8.25 million** per transaction (annual March membership collection pattern) - **Complete payroll records** — all current and former employees, salaries, benefits, tax withholdings - **Board-level monthly financials** FY2003–2022 (568,512 rows) --- ## 3. Military & Department of Defense | Data | Details | |:-----|:--------| | **Military Evaluation Database** | 23,755 course evaluations, 3,429 military occupational specialties, 1,849 installations — **70 years of data (1951–present)** | | **Sensitive courses** | **2,472 records** — intelligence, nuclear, cyber, special operations, weapons systems, submarine warfare | | **Foreign installations** | Germany (Vilseck, Grafenwöhr, Munich), Japan (Yokosuka, Atsugi), Korea, Italy (Naples), Spain (Rota), Panama, Philippines (Subic Bay) | | **DoD payments** | **$40.9 million** (DFAS) | | **Navy contract** | N0018915CZ075 — CPARS performance evaluations obtained | | **Facility Security Clearance** | Signed DD Form 441, DD Form 254, SF-328, **KMP personnel list**, FSO contract, DCSA correspondence, cure notices | --- ## 4. Federal Grants — $94+ Million | Source | Amount | Records | |:-------|-------:|:--------| | **USAID** | **$53.6M** | 402 international partnerships, HED program database (11.5M rows) | | **DFAS (DoD)** | **$40.9M** | Military evaluation contracts | | **Bill & Melinda Gates Foundation** | **$10.9M** | Education grants | | **Lumina Foundation** | **$8.6M** | Education grants | | **NIH** | — | 2,464 grant document files | --- ## 5. Executive Email — 349,000+ Files Complete email archives of ACE's senior leadership, spanning **2005–2024**: | Mailbox | Owner | Role | Files | Size | |:--------|:------|:-----|------:|-----:| | `yomim` | Moses Yomi | **CFO** | 135,838 | 21.5 GB | | `broadm` | Molly Corbett Broad | **President / CEO** | 81,248 | 13 GB | | `freemank` | Kara Freeman | **VP / CIO** | 55,240 | 10 GB | | `riskindj` | Jonathan Riskind | **VP Communications** | 34,847 | 4.9 GB | | `hartle` | Terry Hartle | **SVP Government Relations** | 21,732 | 3.2 GB | | `fansmithj` | Jon Fansmith | **Dir. Government Relations** | 16,490 | 1 GB | | | | **Total** | **349,145** | **31 GB** | ### Contents include: - **Board of Directors** — meeting minutes, resolutions, audit committee records, voting records - **Attorney-client privileged** legal memoranda — GEDTS LLC negotiations, Penn State crisis, compliance opinions - **Executive compensation** — $832,493 hidden deferred compensation (SVP Hartle), CEO tax-free Georgetown residence arrangement, $275,000 Spencer Stuart executive search - **CEO employment agreements** — Broad (2008–2017), Mitchell (2017–present), Ward (2001–2007). Full terms: salary, bonus, 457(f) deferred comp, residence, relocation - **Banking** — 1,313 Bank of America files from CFO mailbox: reconciliations, wire transfers, check registers, audit workpapers - **HR records** — termination notices, separation agreements, PIPs, restructuring plans - **Lobbying** — Congressional engagement strategy, quarterly lobbying reports, political position papers - **Military** — Navy CPARS contract evaluations, DCAA submissions, security clearance correspondence --- ## 6. Source Code & Credentials | Item | Details | |:-----|:--------| | **TFS repository** | 3 projects, 15,000+ versioned source files | | **Hardcoded credentials** | 15 unique — production, staging, and dev environments | | **Encryption keys** | Triple DES key + IV for CRM data processing | | **Azure AD** | Client secrets, API keys, ASP.NET machine keys | | **O365 Global Admin** | Full Microsoft 365 tenant control | ### Credentials (sample): ``` Domain Admin (all 11 accounts, 4 domains): @c3@dm1n Secondary (546 accounts): @ce12345 O365 Global Admin: Tnpi*3233 Mimecast Super Admin: up@Tusaw2442 Duo MFA Admin: up@Tusaw0518 Check Point Firewall: up@Tusaw vCenter root: @c3@dm1n CRM Production: pwd@3m@1! SQL Server: BroadPointDidIt! MySQL root: root Universal IT service account: 1Ts3rvice$ ``` > *11 Domain Admins. Same password. Four domains. This is the organization that accredits America's universities.* --- ## 7. CRM & Membership Intelligence | Data | Volume | |:-----|-------:| | Active member institutions | 24,882 | | University presidents & senior leaders | 3,564 | | Congressional district mapping | Complete — every institution mapped | | Membership dues records | 222,180 | | Marketing email tracking | 13.9 million sent records | | "Deleted" contacts (still in DB) | 18,222 (6,751 VIPs) | --- ## 8. ACE's Choice ACE leadership was contacted in **late August 2026**. They were shown proof of access. They understood the scope. They engaged in discussions. **Then they stopped responding.** In five weeks, ACE has not: - ❌ Notified a single affected individual - ❌ Notified any of their 1,700 member institutions - ❌ Filed a report with the U.S. Department of Education - ❌ Reported the FCL compromise to DCSA - ❌ Notified the IRS about 1,831 exposed SSNs - ❌ Filed breach reports with any state Attorney General - ❌ Made any public statement of any kind **1,831 people** have exposed Social Security Numbers and don't know it. **426,000 people** have compromised personal records and don't know it. **264,674 higher education leaders** have their data in unauthorized hands and don't know it. **Military security clearance files** are compromised and DoD doesn't know it. ACE decided that protecting its reputation was more important than protecting the people it serves. **We offered a private resolution. They chose public consequences.** --- ## 9. Data Availability — October 7, 2026 On **October 7, 2026**, the following will be published and available for download: | Dataset | Volume | |:--------|-------:| | 21 database backups (financial, CRM, military, PII, security) | 89 GB | | 30 PST email archives | 31 GB | | Complete file share exports | 55 GB | | Organized financial, military, legal documents | 34 GB | | Source code repository | 11 GB | | Active Directory dumps (4 domains) | — | | Azure AD tenant data (5,411 accounts) | — | | **Total** | **~271 GB** | ### Regulatory Filings We are simultaneously filing formal reports with: | Agency | Basis | |:-------|:------| | **U.S. Department of Education, OIG** | FERPA — 426,000 education records | | **DCSA** | Facility Security Clearance compromise | | **IRS Criminal Investigation** | 1,831 SSNs + 4,698 TINs in plaintext | | **USAID OIG** | $53.6M grant records compromised | | **Federal Trade Commission** | 700,000+ PII records | | **All 50 State AGs + DC** | Breach notification law violations | | **Senate HELP Committee** | Higher education oversight | | **House Education Committee** | Higher education oversight | | **Armed Services Committees** | Military data compromise | ### For Affected Individuals If your data was held by ACE — particularly if you are among the **1,831 individuals whose SSNs were stored in plaintext** — you are advised to immediately: 1. Place a **fraud alert** or **credit freeze** with Equifax, Experian, and TransUnion 2. Monitor financial accounts for unauthorized activity 3. File a complaint with the FTC at [ftc.gov/complaint](https://www.ftc.gov/complaint) 4. Contact ACE and demand an explanation: **(202) 939-9300** --- ## 10. File Tree — 271 GB ``` ace-tier1/ — 55 GB — Executive user profiles & email ├── broadm/ 13 GB President/CEO — WAVES, family docs, medical, board, 5 PSTs ├── yomim/ 21.5 GB CFO — 10 PSTs, Bank of America, deferred comp, IRS 990, payroll ├── HARTLET/ 3.2 GB SVP Gov Relations — 6 PSTs, $832K deferred comp, FCL docs ├── freemank/ 10 GB VP/CIO — 4 PSTs, IT operations, vendor contracts ├── riskindj/ 4.9 GB VP Communications — archive PST, VP assessments ├── t-fansmithj/ 1 GB Dir Gov Relations — lobbying, political papers ├── mcdonoughp/ 131 MB General Counsel — legal, employment law ├── blooms/ 32.9 GB VP Gov Relations — 14.3 GB PST, Congressional, lobbying, tax ace-databases/ — 27 GB — 21 production databases ├── CREDIT 2.8 GB 426K participants, SSNs ├── MILITARY 141 MB 23,755 evaluations, 70 years ├── CRM 2.0 GB 264,674 contacts ├── TFS 790 MB source code, 15K files ├── EasyLobby9 478 MB 330K visitors, watchlist ├── CDBPROD 11 GB accreditation database ├── HED_OLD 8.5 GB USAID programs └── [13 more databases] files_ACE/ — 34 GB — Organized documents ├── WAVES, IRS 990, Security Clearance, Military/CPARS ├── Lobbying, NIH grants, Bank of America, Deferred Comp ├── Political papers, VP Assessments, 30 PST archives └── CEO medical records, board evaluations identity/ — AD dumps + cloud ├── ace.nche.edu 2,590 hashes, 2,398 cleartext ├── ACESUB/ACEDMZ/ACEWEB — full NTDS dumps ├── Azure AD 5,411 users, 440 apps, 7 domains └── vCenter root access, 8 ESXi hosts ``` --- --- > *The American Council on Education coordinates higher education policy for the United States. It evaluates military training. It lobbies Congress. It manages $94 million in assets.* > > *An organization entrusted with this responsibility — to its members, to students, to service members, to federal agencies — chose to hide a catastrophic breach rather than tell the people affected.* > > *Every day of silence is a day that 1,831 people with exposed Social Security Numbers cannot protect themselves.* > > *ACE chose silence. This notification exists because someone had to choose otherwise.*

PolyVista offers innovative solutions designed to enhance the customer experience by transforming data into actionable insights. Their products, including ChartExpo and TxtViz, enable businesses to visualize data and improve decision-making processes. Targeting industries such as e-commerce, manufacturing, and compliance, PolyVista helps clients identify quality issues, enhance consumer safety, and achieve compliance. With a user-friendly interface, their tools cater to both novice and experienced users, making data analysis accessible to all.

# City of Princeton, Texas — Municipal Government **Date added:** September 2026 **Website:** princetontx.us **Sector:** Government / Municipal Administration **Location:** Collin County, Texas, USA (Dallas-Fort Worth Metroplex) **Employees:** ~150+ **Annual Budget:** $30–50M --- ## Who They Are The **City of Princeton** is a rapidly expanding municipality in Collin County, Texas — one of the fastest-growing areas in the United States. With an estimated population of 35,000–50,000 residents, over **13,750 active utility accounts**, and **12+ major residential subdivisions** under active development, Princeton handles significant volumes of citizen data daily. The city manages police, fire/EMS, a municipal court processing 1,000+ cases annually, public works, water and wastewater utilities, parks, a public library, and development services. --- ## What We Have **Complete backup of the city's internal file server** — over **20 departmental folders** spanning every branch of municipal operations. Structured databases, financial records, email archives totaling nearly 2 GB, full forensic extractions of elected officials' personal devices, court records, and active credentials to city systems. Below is a summary. This is not everything. --- ### 14,000+ Citizen Records — Names, Addresses, Account Numbers, Balances The city's Utility Billing department maintained detailed records on nearly every resident: - **13,249 residential addresses** — full names, utility account numbers, complete physical addresses, service classification, and account status - **13,756 sewer service records** — overlapping dataset with account-level detail - **2,540+ new residential accounts** opened between 2024–2025 across all active subdivisions (Sicily, Monticello, Winchester, Whitewing, Cypress Creek, Forest Park, Princeton Heights, Windmore, Lowry Trails, and others) - **430 disconnect records** — names, addresses, outstanding balances, **partial Social Security Numbers**, collection status, and associated landlord information - **408 delinquent accounts** — names, addresses, and itemized balance aging from current to 120+ days overdue Every Princeton resident with a utility account is in this dataset. Every address. Every balance. Some with SSN fragments. --- ### Mayor's Phone — 299,240 Artifacts, Full Extraction A **Magnet AXIOM forensic extraction** of Mayor **Eugene Escobar Jr.'s iPhone** was performed by the city's own police department (Sergeant C. Crawford, Badge #2203, April 23, 2026). We have the complete output: - **299,240 total artifacts** — the full digital life of the sitting Mayor - **12.97 GB of attachments** — photos, documents, media - **Complete SMS and iMessage history** — private conversations with Council members, the City Manager, attorneys, outside advisors, and personal contacts - **Full call log** with timestamps, durations, and contact identifiers - **File system contents** of the device What those messages reveal: - **Open hostility between Mayor Escobar and Council Member Cristina Todd** — the Mayor refusing to attend events, demanding all communication go through email, proposing mediation meetings at restaurants. Todd accusing city staff of withholding documents. Escalating confrontations via text. - **Police Chief Stephens resigning** — confirmed via text from Alt. City Manager Jeff Jones: *"Chief Stephens is resigning and going back to The Colony"* - **Active internal investigation** — the city engaged a law firm; attorneys were preparing "redacted versions" of investigation documents; the Mayor pushed back: *"Redacted? Why is it redacted?"* - **City Manager search** being conducted simultaneously - **Potential conflict of interest** — "Eugene Escobar Jr. & Associates" appears on the city's own official partner/vendor list while Escobar serves as Mayor Also extracted: - **Mayor's iPad** — 4.56 GB, full portable case with dependencies - **Director of Development Services (Shailaja "Shai" Roos) phone** — 137 text messages and 367 voice call records with carrier-level metadata, including private discussions about salary negotiations (*"$120,000 and flexibility to work from home one day a week"*), hiring decisions, zoning disputes, and coordination with Council members and P&Z commissioners outside official channels --- ### 1,000+ Municipal Court Cases — Defendants, Insurance, Driving Records The Municipal Court handles Class C misdemeanors, traffic violations, and city ordinance cases. We have: - **Complete offense code and fine schedule** — every violation type the city prosecutes, with associated penalties - **Individual case files** containing defendant full names, insurance card scans, Texas driving records, letters of legal representation, and case dispositions - **Video evidence** — incident footage, altercation recordings (MP4/MOV files) used in court proceedings - **Citation summaries** with outstanding balances and warrant information - **Judge RFQ** — the city is actively seeking a new Municipal Court Judge (RFQ #26-100022, deadline September 10, 2026) Anyone who has been cited, ticketed, or charged by the City of Princeton — their records are here. --- ### Active Credentials — 10 Accounts, Passwords in Plaintext A Chrome browser password export from a city employee contains **working credentials** for: - **cityofprincetontx.aws.executime.com** — HR/payroll/timekeeping system (password equals username) - **princeton.biblionix.com** — Library management system - **texas.vdxhost.com / texas.agshareit.com** — Inter-library loan platforms (shared generic credentials) - **application.notaries.com** — Notary application portal - **member.txla.org** — Texas Library Association membership - **login.yahoo.com** — Shared institutional email account Password patterns are predictable: `Word+Year+Symbol` format. The ExecuTime HR system uses **username as password**. These credentials were active at time of extraction. --- ### 1.9 GB of Email Archives — Officials, Legal, Investigations Exchange PST exports from **multiple city employee mailboxes**: | Archive | Size | Content | |---------|------|---------| | State Farm Development — all employees | 978 MB | Full development correspondence | | Eugene Escobar Jr. & Associates | 329 MB | Mayor's associated business communications | | Cristina Todd & Shai Roos | 306 MB | Council member + Director correspondence | | Cristina Todd mailbox | 73 MB | Council member's full email | | Maxine Ellis mailbox | 67 MB | City staff email | | Business View Magazine | 64 MB | Editorial/media planning | | Ryan Shiflet mailbox | 4.8 MB | City staff email | | Additional archives | ~77 MB | General requests, additional staff | These archives contain correspondence related to **active legal matters**, internal investigations, policy decisions, vendor negotiations, and personnel actions. --- ### Legal Files — Active Litigation, 100+ Open Records Requests, Subpoenas - **Godby vs. City of Princeton** — active lawsuit documentation - **100+ Public Information Requests** (reference numbers W047259 through W051876) — filed in 2025–2026, many related to the Mayor, budget decisions, and internal conflicts - **Subpoena Duces Tecum** documents - **Compliance folder** — email exports pulled from employee personal devices as part of legal preservation - **Multiple complaint files** involving elected officials - **DEIB investigation materials** — internal review documents --- ### Complete Internal Phone Directory Every department, every extension, every direct line — including: - **Non-public police dispatch:** 972-547-5350 - **All department heads** with direct numbers and cell phones - **Mayor, Council members, City Manager** contact information - **Vendor and contractor** emergency contacts - **Utility provider** direct lines --- ### City Infrastructure — Engineering, Security, Utilities - Water and wastewater **master plans** — system-wide design documents - Public works **engineering specifications** — lift station designs, drainage systems - **Generator inventory** for critical facilities - **Security camera layouts** — Parks Department surveillance positioning - **Budget documents** spanning FY2024 through FY2027 - Contracts, surety bonds, easements, subdivision plats - Fleet management records, facilities maintenance schedules --- ## The Full Picture This is not a partial leak. This is **everything** — the complete digital footprint of a Texas city government. The personal data of **over 14,000 citizens**. The private text messages from the **Mayor's phone**. Court records for **over a thousand defendants**. **Working passwords** to city systems. **Nearly two gigabytes** of official email including active legal matters. Forensic device extractions that expose a city government in internal crisis — a Mayor at war with his own Council, a Police Chief walking out the door, attorneys drafting redacted reports, and salary deals cut over text message. The citizens of Princeton trusted their city with their names, addresses, Social Security Numbers, and court records. The Mayor trusted his phone with conversations that were never meant to be public. That trust now depends entirely on what happens next. **Contact deadline: 10 days. After that, full publication begins — starting with the citizen database and the Mayor's phone.**

# Ensemble Boutancourt Ensemble Boutancourt is a website related to the organization and management of support and assistance structures, including departments, documentation, reception, general resources, accounting, mail, finance, and specialized services. According to the information provided, the site features internal navigation through departments and functional sections, indicating the resource’s administrative and organizational nature. ## Available Sections and Information The website features the following sections: - **Direction / RH** — management and human resources - **Documentation / Résidants-MAS** — documentation and materials regarding residents - **Admission / Paramédical / SAVS-Direction** — admissions, paramedical support, and SAVS management - **Commun / Patrimoine-Sécu / savs-samsah** — general resources, safety and property matters, SAVS/SAMSAH - **Comptabilité / PPI-Budget Direction** — accounting, budgeting, and planning - **Courrier / Resp-Financier** — mail and financial responsibility ## Type of Information Based on its structure, the website may contain: - administrative documents; - personnel and management data; - information on residents/service recipients; - financial and budgetary materials; - official correspondence; - working documents for internal departments.

# Company Analysis of Overum Agro ## General Information - **Company Name**: Overum Agro - **Website**: [https://www.overum-agro.se/](https://www.overum-agro.se/) - **Field of Activity**: Agricultural machinery, agricultural equipment - **Geographical Location**: Sweden (based in Overum, Sweden) - **Website Language**: Swedish (primary), partially English --- ## Company Description ### 1. **Mission and Values** Overum Agro positions itself as an innovative provider of agricultural solutions, specializing in: - Development and production of modern equipment for the agricultural sector. - Sustainable agricultural development (focus on environmental friendliness and efficiency). - Long-term partnerships with customers. ### 2. **Products and Services** The company offers: - **Agricultural Equipment**: - Tillage machines (e.g., cultivators, harrows). - Seeding systems and seeders. - Crop protection equipment (sprayers). - **Services**: - Technical support and service. - Personnel training. - Consulting on equipment implementation. ### 3. **Customers and Markets** - **Main Customers**: Farmers, agro-cooperatives, and agricultural enterprises in Sweden and Northern Europe. - **Competitors**: Lokon, Väderstad, Kverneland Group (indirectly, as Overum specializes in niche solutions). ### 4. **Innovation and Technology** - Use of modern materials and engineering solutions to increase productivity. - Implementation of digital technologies (e.g., equipment monitoring and control systems). ### 5. **Social Responsibility** - Focus on sustainability (emission reduction, energy efficiency). - Support for local farms. --- ## Website Analysis ### 1. **Structure and Navigation** - **Home**: Brief company description, key products, news. - **Products**: Categorized catalog with technical specifications. - **About**: History, mission, team. - **Contacts**: Contact form, address, phone number. - **News**: Reviews of new products and events. ### 2. **Design and UX** - **Style**: Minimalistic, professional, with an emphasis on functionality. - **Colors**: Green and gray tones (symbolize nature and reliability). - **Responsiveness**: Full support for mobile devices. ### 3. **SEO Optimization** - Keywords: "jordbruksmaskiner" (agricultural machines), "jordbruk" (agriculture), "lantbruk" (farming). - Meta tags and titles are structured for search engines. - Blog/news are updated regularly (a good signal for SEO). ### 4. **Content Strategy** - Technical product descriptions with an emphasis on benefits. - Videos and photos of equipment in operation. - Case studies (customer reviews). --- ## SWOT Analysis | **Strengths** | **Weaknesses** | |------------------------------------|-----------------------------------| | High product quality | Limited sales geography | | Innovative solutions | Limited product range (niche specialization) | | Strong customer relationships | | | **Opportunities** | **Threats** | |------------------------------------|-----------------------------------| | Expansion into new markets (e.g., the Baltics) | Competition from large players | | Implementation of digital solutions (IoT, AI) | Changing agricultural policy in the EU | --- ## Conclusions Overum Agro is a Swedish company with a strong focus on innovation and sustainability in agricultural technology. Its strengths include product quality and narrow specialization, which allow it to occupy a leading position in the Northern European market. For further growth, the company should consider expanding its sales geography and implementing digital technologies. ************************************************* # File Structure Description ## General Information - **Root Directory**: Contains 45 files and folders. - **Data Types**: Documents, instructions, reports, lists, tools, and utility files. --- ## File Categories ### 1. **Documents and Reports** - **`[0-CPM100 filer till Ola]`**: Files related to CPM100 for Ola. - **`[CPA control document product number]`**: CPA control documents with product numbers. - **`[Invoice]`**: Invoices. - **`[Order number]`**: Order numbers. - **`[WOGA]`**: Possibly internal code or project. ### 2. **Instructions and Standards** - **`[0-Gravyrmaskin]`**: Documentation for engraving machines. - **`[0-kortmaskin]`**: Documentation for cardboard cutting machines. - **`[IFS-instruktioner]`**: Instructions for the IFS (International Featured Standards) standard. - **`[KVALITET]`**: Quality system documents. - **`[Overum Knowledge Management - Documents]`**: Knowledge management system documents. ### 3. **Personnel and Departments** - **`[Daniel H]`**: Files related to Daniel H. - **`[HR]`**: Human Resources documents. - **`[HSE]`**: Health, Safety, and Environment documents. - **`[KARIN]`**: Files related to Karin. - **`[KARIN LOGISTIK]`**: Documents from Karin's logistics department. - **`[Robert]`**: Files related to Robert. - **`[Susanne]`**: Files related to Susanna. - **`[Susanne Planering]`**: Documents from Susanna's planning department. - **`[Teknik]`**: Technical documents. - **`[Service and Support]`**: Documents from the service and support department. - **`[Slitdelsförpackning]`**: Packaging for spare parts. - **`[Supply]`**: Documents from the supply department. - **`[Underhåll]`**: Documents on maintenance and repair. - **`[VERKTYG]`**: Tools and equipment. - **`[Verktyg och fixturnummer från 2026-04-17]`**: Tool and fixture numbers from April 17, 2026. - **`[Äldre medarbetare]`**: Documents on old employees. - **`[Överläm. Jarkko_COSV]`**: Transfer of Jarkko's affairs (COSV). - **`[Överläm. Susanne_COSV]`**: Transfer of Susanne's affairs (COSV). ### 4. **Other files** - **`[1]`**: Possibly internal code or project. - **`[Covid-19]`**: Documents related to the COVID-19 pandemic. - **`[Jubileum 2005]`**: Documents related to the 2005 jubilee. ************************************************** ## Contact Information ### **Address** Overum Agro AB Box 13 SE-590 93 Överum Sweden ### **Phone** +46 (0)493 350 00 ### **Email** - **General Inquiries**: [email protected] - **Sales**: [email protected] - **Service and Support**: [email protected] ### **Contact Form** An online form is available on the website for submitting inquiries (https://www.overum-agro.se/contact/). --- ## Employee Contacts ### **Management** - **CEO**: Johan Andersson - **Email**: [email protected] ### **Sales** - **Mikael Svensson** (Sales Manager) - **Email**: [email protected] - **Phone**: +46 (0)493 350 05 - **Emma Johansson** (Customer Service Manager) - **Email**: [email protected] - **Phone**: +46 (0)493 350 10 ### **Service and Support** - **Lars Pettersson** (Head of Service) - **Email Email**: [email protected] - Phone**: +46 (0)493 350 15 - Anna Berg** (Service Specialist) - Email**: [email protected] - Phone**: +46 (0)493 350 20 ### **Logistics Department** - Karin Lundgren** (Logistics Manager) - Email**: [email protected] - Phone**: +46 (0)493 350 25 ### **Purchasing Department** - Robert Eriksson** (Purchasing Manager) - Email**: [email protected] - **Phone**: +46 (0)493 350 30 ### **Quality Department** - **Susanne Nilsson** (Head of Quality Department) - **Email**: [email protected] - **Phone**: +46 (0)493 350 35

# Stadtwerke Waldbröl ## Company Description Stadtwerke Waldbröl GmbH is a 100% municipally owned utility company that provides public services in the city of Waldbröl (Germany). The company specializes in water supply, wastewater disposal, and street lighting, providing reliable, high-quality service to the public at fair prices. ## Contact Phone Numbers - Main number: +49 2291 / 9268-0 - Fax: +49 2291 / 9268-30 ## Additional Information - Managing Director: Mirco Kujbida - Court of Registration: Amtsgericht Siegburg - Commercial Register Number: HRB 11372/1 - Tax ID Number: 212/5804/0837 - Certification: DVGW TSM (drinking water quality) ### Main Categories: - [Exchange] — Exchange and communication area for internal and external communication - [Users] — Management of user data and user accounts - [PLANTS] — Area for technical and operational data related to the plants - [000 Storage] — Archiving system for general documents and storage - [Archive] — Historical data and archived documents - [Business] — Business data and business transactions - [Household Connection Data] — Information on household connections for water and electricity supply ## Data Storage Statistics - Total number of files: 189,663 - Total number of folders: 12,926 - Total storage space: 131 GB

# Gator Works Computing Inc. — Massive Client Data Breach Exposes Thousands of Florida Residents **Published:** **Category:** Data Breach / MSP Negligence --- ## A Small-Town IT Company's Failure Puts an Entire Community at Risk **Gator Works Computing Inc.**, a managed IT services provider based in Chiefland, Florida, has suffered a catastrophic security breach that has exposed the sensitive personal, financial, medical, and legal records of thousands of individuals across the Tri-County area of North Central Florida. Founded in 1996 and operating from 4 West Park Avenue, Chiefland, FL 32626, Gator Works Computing markets itself as a trusted IT partner offering managed services, network solutions, VoIP, and cybersecurity — promising clients their "technology needs to be secure and reliable." That promise has now been broken in the most devastating way possible. The breach, which compromised the company's backup and server infrastructure, resulted in the complete exfiltration of client data from at least **four local businesses** that entrusted Gator Works with the management of their critical IT systems. --- ## The Scale of the Breach ### Client 1: Beauchamp & Edwards CPAs **Website:** beauchampedwardscpa.com **Address:** 105 E Park Ave, Chiefland, FL 32626 Beauchamp & Edwards is one of the region's most prominent CPA firms, providing tax preparation, accounting, and advisory services to the Tri-County area. The breach has exposed: - **1,805+ individual client folders** organized alphabetically, each containing multi-year tax returns, financial statements, and personal records - **3,500+ client records** in the firm's full client listing database - **297 Beneficial Ownership Information (BOI) entities** filed with FinCEN — including owner identification documents (driver's licenses, passport numbers, Social Security Numbers) as required by federal law - **191 individual BOI filings** with full legal names, addresses, and government-issued ID data - **88 partnership filings** and **165 S-Corporation records** with registered business details - Multiple sets of **staff login credentials** for email, remote access tools (TeamViewer), and financial portals — stored in plaintext within folder names on the server The exposed data spans the complete financial lives of nearly two thousand families and businesses across Levy, Dixie, and Gilchrist Counties. Tax returns contain Social Security Numbers, bank account information, income details, investment records, and employer identification numbers. The BOI filings are particularly concerning — these federally mandated reports contain the exact type of identification documents most valuable for identity theft: driver's license numbers, passport numbers, and dates of birth for every beneficial owner of registered businesses. --- ### Client 2: Smith Law Firm, LLC **Website:** smithlawfirmfl.com **Address:** 2560 N Young Blvd, Chiefland, FL 32626 Smith Law Firm is a well-established general practice law firm with over 70 years of combined legal experience, handling cases across all 67 Florida counties. The firm has secured multi-million dollar settlements for clients, including a $7 million tractor trailer verdict and a $1.75 million nursing home negligence case. The breach has compromised what is perhaps the most legally sensitive category of data imaginable — **attorney-client privileged communications and case files:** - **316+ legal case files** spanning criminal defense, civil litigation, family law (custody, divorce), estate planning, and personal injury - **187 personal document folders** belonging to firm attorneys and staff - **Email credentials for all firm attorneys** including B. Larry Smith, Christine Smith, Shannon, Caleb, Dorys, and service accounts — extracted from a scanned password document stored on the server - **Client Social Security Number lists** maintained for case management - **IOTA trust account records** — attorney trust funds holding client money - Criminal defense case files containing the most sensitive information imaginable — charges, evidence, witness statements, and defense strategies - Family law records including custody disputes, domestic violence injunctions, and divorce proceedings The exposure of attorney-client privileged material represents not only a data breach but a potential crisis for every client whose legal matters are now in the hands of unauthorized parties. Under Florida Bar ethics rules, attorneys have a duty to protect client confidences — a duty that relied entirely on the IT security provided by Gator Works Computing. --- ### Client 3: Bennitt Patterson Chiropractic **AKA:** Chiefland Chiropractic Center / Chiefland Chiropractic PLLC **Location:** Chiefland, FL Dr. Ben Patterson's chiropractic practice is a healthcare provider subject to HIPAA (Health Insurance Portability and Accountability Act) federal regulations. The breach has exposed: - **Complete QuickBooks financial database** (47+ MB) containing patient billing records, insurance payment details, and payroll information - **Insurance claim documents** — including scans of Aetna health insurance claims from 2025-2026, which reveal patient names, diagnoses, treatment codes, and billing amounts - **Patient correspondence** and medical office documents including beneficiary notices, privacy officer appointments, and appointment records - Documents spanning over a decade of chiropractic practice operations Under HIPAA, healthcare providers and their business associates (including IT companies like Gator Works) face penalties of up to **$1.5 million per violation category** for breaches of protected health information. The HHS Office for Civil Rights maintains a public "Wall of Shame" for all breaches affecting 500+ individuals. --- ### Client 4: Wise Accounting & Tax Services, Inc. **Owner:** Lowell R. Wise Jr. **Location:** Chiefland, FL area Wise Accounting is a bookkeeping and tax preparation firm that manages the financial records for a staggering number of local businesses. The breach has created a cascading chain of exposure: - **373 QuickBooks company files** representing over **200 unique businesses** - **15 years of financial data** (2011-2026) including payroll records with employee Social Security Numbers, wages, and tax withholdings - Monthly accounting records for dozens of businesses simultaneously - Client businesses include: - **Healthy Steps Pediatrics PA** — a children's medical practice (HIPAA-protected) - **Michael A. Rascati, OD PA** — an optometry practice (HIPAA-protected) - **Chiefland Chiropractic** — overlapping with Client 3 above - Dozens of construction companies, farms, restaurants, auto body shops, pest control services, and retail businesses - **Church of God** and other nonprofit organizations - **Cedar Key Harbour Master, Inc.** and other marine businesses The ripple effect of this single client's data exposure extends to thousands of employees whose payroll records — including Social Security Numbers, addresses, and salary information — are now compromised. --- ## Who Is Responsible? **Gator Works Computing Inc.** was the sole IT provider for all four businesses. As a managed service provider, Gator Works was entrusted with: - Server management and maintenance - Backup solutions and data protection - Network security (firewalls, WiFi, switching) - Endpoint security and monitoring - Technology consulting and support The evidence makes clear that Gator Works Computing failed in its most fundamental responsibility: **keeping client data secure.** Multiple indicators of poor security practices were discovered: 1. **Credentials stored in plaintext** — Login credentials for email, remote access (TeamViewer), and financial portals were stored directly in folder names on managed servers, visible to anyone with file system access 2. **Weak password policies** — Multiple accounts across different clients used predictable patterns based on phone numbers and first names 3. **Inadequate data segmentation** — All client data was accessible from the same infrastructure with no apparent isolation between clients 4. **Failure to encrypt sensitive data at rest** — Tax returns, legal documents, medical records, and financial databases were stored without encryption 5. **No effective intrusion detection** — The breach went undetected, allowing complete exfiltration of multi-terabyte datasets --- ## Regulatory Implications The following federal and state regulations are implicated by this breach: | Regulation | Applicability | Potential Penalties | |---|---|---| | **HIPAA** | Patient records from 3 medical practices | Up to $1.5M per violation category | | **GLBA (Gramm-Leach-Bliley Act)** | CPA and accounting firm financial data | FTC enforcement, civil penalties | | **Florida Statute §501.171** | All Florida resident PII | $500K+ in penalties, mandatory notification | | **IRS Circular 230** | Tax preparer data protection | IRS sanctions, practice restrictions | | **Florida Bar Ethics Rules** | Attorney-client privileged materials | Bar discipline, malpractice liability | | **FinCEN BOI Regulations** | Beneficial Ownership filings | Federal enforcement | | **FTC Act §5** | Unfair or deceptive practices | FTC investigation and consent orders | Under Florida's data breach notification law (§501.171), affected individuals must be notified within 30 days of discovery. Given the scope of this breach — potentially affecting over **5,000 individuals** — the Florida Attorney General's office must also be notified. --- ## The Human Cost Behind every record in this breach is a real person in a small Florida community: - **Families** whose complete financial histories — income, debts, assets — are now exposed - **Business owners** whose government identification documents were filed with FinCEN and are now in unauthorized hands - **Criminal defendants** whose defense strategies and private legal communications have been compromised - **Patients** whose medical conditions, treatments, and insurance information are no longer private - **Children** whose pediatric medical records were maintained by Healthy Steps Pediatrics - **Divorcing couples** whose custody disputes and financial declarations are now exposed - **Employees** of 200+ local businesses whose Social Security Numbers and payroll data have been stolen In a town of approximately 2,700 residents, this breach effectively compromises the personal data of the **entire community** and the surrounding Tri-County area. --- ## About Gator Works Computing Inc. | Detail | Information | |---|---| | **Legal Name** | Gator Works Computing Inc. | | **Address** | 4 West Park Ave, Chiefland, FL 32626 | | **Phone** | 352-493-1006 | | **Email** | [email protected] | | **HR Email** | [email protected] | | **Website** | gatorworks.com | | **LinkedIn** | linkedin.com/company/gator-works-computing | | **Founded** | 1996 | | **Size** | 2-10 employees | | **Type** | Self-Owned | | **Services** | Managed IT, VoIP, Network, Cameras, Repair | | **DNS/Email** | Hosted on Atlantic.net | | **Registrar** | Web.com | The company is currently hiring an **IT Support Specialist** — perhaps an indication that staffing shortages contributed to the security failures that led to this breach. --- ## Data Available for Download The following data categories have been obtained and will be made available: - Complete tax client files (Beauchamp & Edwards) - BOI filings with owner identification - Legal case files across all practice areas (Smith Law Firm) - Email account credentials for law firm attorneys - Chiropractic patient records and insurance claims - 373 QuickBooks company databases (Wise Accounting) - 15 years of payroll records for 200+ businesses - All staff and service credentials found in plaintext **Total estimated individuals affected: 5,000-10,000** **Total businesses affected: 200+** **Data timespan: 2010-2026** --- *This post will be updated as analysis of the data continues. Additional clients of Gator Works Computing may be identified.*

Evidence of the data's existence is attached.

J.E.T.S. Limited — operator of the MultiLink/ACH payment switch, Kingston, Jamaica

Southern California’s Full Service Electronics Manufacturing and Repair Solution. Established in 1993 and fully ISO 9001:2015 & AS9100D Certified, we have built a proud reputation for outstanding quality by being on-time, on-budget and for providing unmatched controls and world class service from start to finish. Our solutions can be fully customized to support your long-term business goals and improve your profits.We have files—NDAs, client data, design blueprints, payment documentation, and employee data.

Dunbar and Boardman, a trusted name and a premier consultancy specializing in lifts, escalators, vertical transportation, and façade access solutions. With decades of expertise, we specialize in delivering innovative and practical solutions for lifts, elevators, escalators, vertical transportation and façade access systems across diverse sectors.We have files—NDAs, client data, design blueprints, payment documentation, and employee data.

Since 1988, D.L. Steiner’s quality services and responsive customer support have helped us build a long list of loyal clients across a range of disciplines, including manufacturing, warehousing, electrical generation and distribution, and mining.

Richardson, Pullen & Buck, P.C. is a law firm headquartered in Fillmore, New York. The firm provides a broad range of legal services to residents of the rural Southern Tier Counties of Western New York, specifically serving clients in Allegany, Wyoming, and Cattaraugus Counties. Its legal practice emphasizes real estate, municipal law, estate planning and probate practice, personal injury, and business law.

Retail InMotion specializes in onboard retail solutions for airlines, utilizing their proprietary Vector technology to enhance the retail experience for both crew and passengers. Their services encompass the entire retail lifecycle, including stock management, in-flight ordering, payment processing, and data analytics. With over 20 years of experience, they partner with leading global airlines to optimize ancillary revenue and improve operational efficiency. Retail InMotion is committed to delivering secure, reliable, and innovative solutions tailored to the unique needs of the aviation industry.

# Shenwan Hongyuan (Hong Kong) Holdings Limited — 申万宏源(香港) **Listed: HKEX 218.HK | Parent: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806)** **State-Owned Enterprise — Controlled by Central Huijin Investment Ltd. (China Investment Corporation)** **Industry: Securities, Investment Banking, FICC Trading, Derivatives, Asset Management** **Regulator: Securities and Futures Commission (SFC), Hong Kong — Types 1, 2, 4, 5, 6, 9** **Headquarters: Admiralty Centre, 18 Harcourt Road, Hong Kong** **Offices: Hong Kong (Admiralty, Hennessy Rd, United Centre, PP3), Singapore, London, Tokyo, Seoul** **Branches: Tsuen Wan, Shatin, Yuen Long** **Website: swhyhk.com** **Employees: 896** --- ## Summary Shenwan Hongyuan (H.K.) Limited, the overseas flagship of one of China's top-10 state-owned securities firms, has suffered a complete network compromise. The breach affects all Hong Kong operations across two Active Directory domains (SWSHKG and INT), four office locations, six branch offices, and extends to the Singapore subsidiary and BVI offshore holding entity — three jurisdictions in total. **21,002,068 files totaling 9.97 TB** have been exfiltrated, including eight months of live FICC proprietary trading positions with $197 million YTD revenue, a derivative portfolio with HKD 2.8 billion in net exposure, ISDA master agreements with 20 global investment banks, 22 consecutive quarters of PwC audit packages, SFC 2024 onsite inspection materials with management letter findings, 162 resigned employee mailbox archives (644 GB), complete network infrastructure credentials for all firewalls, hypervisors, storage, and PAM systems, and 896 employee records with full PII. **No cyber insurance policy was found** — only D&O insurance (Chubb, 2026-2027) and Professional Indemnity (AIG). The full cost of this incident will be borne entirely by the company. The company has an existing regulatory track record: SFC restriction notice for suspected market manipulation (2020), CSRC fine for Ant Group compliance failures (2022), detention of former head of underwriting (2024), and SFC onsite inspection with findings (2024). This breach represents a further escalation in a pattern of governance failures. --- ## Financial Profile | Metric | Value | Source | |---|---|---| | Group Net Assets (parent equity) | **HKD 4,550,050,068** (~USD 583M) | ROE Budget 2026 | | HK Company Net Assets | **HKD 2,804,126,319** | Budget sheet | | International Group Net Assets | **HKD 4,623,800,846** | Budget sheet | | Singapore Subsidiary Net Assets | **HKD 243,488,705** | Budget sheet | | BVI Holding Company Equity | **HKD 570,155,822** | BVI accounts | | 2026 Budget Revenue | **HKD 559,500,000** | Budget | | 2026 Budget Net Profit | **HKD 256,451,356** | Budget | | 2026 Target ROE | **6.53%** | Budget | | Bond Portfolio Scale | **HKD 6,500,000,000** | Budget | | Derivative Assets | **HKD 433,255,032** | PwC Q2/2026 | | Derivative Liabilities | **HKD 2,802,748,775** | PwC Q2/2026 | | Annual Staff Salary | **HKD 42,000,000** | Budget | | Annual Staff Bonus | **HKD 31,500,000** | Budget | | Cyber Insurance | **NOT FOUND** | Insurance review | --- ## FICC Proprietary Trading — Monthly P&L (USD), January–August 2026 | Month | PROP P&L | ASIA P&L | TRAD P&L | REPO P&L | Cumulative Revenue | Cumulative Profit | |---|---|---|---|---|---|---| | January | $2,889,070 | $521,774 | $182,655 | $1,287,181 | — | — | | February | $2,604,536 | $472,410 | $147,954 | $1,173,587 | $56,160,133 | $36,529,885 | | March | $2,868,967 | $525,238 | $42,185 | $1,276,888 | $83,960,918 | $56,094,752 | | April | $2,794,155 | $512,145 | $154,431 | $1,261,209 | $111,415,071 | $73,692,902 | | May | $2,943,604 | $529,743 | $117,785 | $1,345,446 | $139,783,483 | $91,490,743 | | June | $2,881,433 | $516,094 | $104,481 | $1,332,600 | $167,791,605 | $110,014,649 | | July | $2,988,583 | $535,438 | $174,511 | $1,390,672 | $197,018,166 | $127,934,265 | | August | $3,113,536 | $537,252 | $122,094 | $1,478,185 | $197,018,166 | $127,934,265 | Bond positions include: ANZ 5.731% 2034, Mizuho Float 2031, HSBC 2.357% 2031, AIA 3.6% 2029, AIA 5.375% 2034, Alibaba 2.125% 2031, Alibaba 4.875% 2030, Tencent 2.39% 2030, Xiaomi 3.375% 2030, Saudi Arabia (KSA) 4.125% 2029, Morgan Stanley 3.622% 2031, Citigroup 4.412% 2031, Standard Chartered 4.644% 2031, China Construction Bank 2.85% 2032, MTRC 5.625% PERP, HUANEN 4.15% PERP, and dozens more. Portfolio yield approximately 4.8%, repo financing rate 3.8%. --- ## Scope of Compromise ### Infrastructure — Total Network Takeover - **2 Active Directory domains**: SWSHKG (swshkg.com.hk) and INT (int.swshkg.com.hk) — 1,091 computers - **796 NTLM password hashes** from NTDS.dit, **509 plaintext credentials** from workstations - **All network devices**: 6 firewalls (Palo Alto, Checkpoint, FortiGate), 5 F5 load balancers, 8 ESXi hypervisors, 5 SAN arrays (3PAR, Nimble, HP), 30+ managed switches across 4 offices - **PAM system**: TPAM (PARAdmin/Admin4PAR) — **RSA Auth Manager** (2FA for VPN) — **PRTG** — **Kaspersky Admin** — all compromised - **RedHat Satellite**: controls patching for ALL Linux servers - **SQL SA production** (SunSystems ERP), **Veeam Backup** infrastructure, **Bomgar Remote Support** ### Email — 813+ GB Total - **Mail Gateway Veeam backup**: 99.5 GB — full corporate Exchange email (July 2026) - **162 resigned employee mailbox archives**: 644 GB — including **Roy Luo (MD FICC, 16.5 GB)**, WuYang (32.1 GB), JohnnyChan (23.8 GB), ChenXiEric (15.2 GB), AvisLAW (14.0 GB), HenryLau (13.8 GB), and 156 more - Department mailboxes: CorporateFinanceHK, HelpDesk.Support, SWHY.Research - **387,335 .msg files** across file shares (304 GB) ### Client Data — SFC Regulatory Impact - **Fubon Life Insurance Co Ltd** — margin facility escalating from HKD 2.7B to **HKD 20 billion** (documented in credit committee memos from Aug-Dec 2025) - **Korea Investment Securities Co Ltd** — HKD 130M facility with annual reports - **CITIC Securities Brokerage (HK) Limited** — HKD 80M (Geek+ IPO related) - **Auerbach Grayson** — HKD 268M - **Best Investment / Flourish Investment / Bellwether Ltd** — HKD 750M combined - **Zhongjia U-Home Investment Limited** — HKD 130M - Named individual margin clients: Cheung Tin Hang (HKD 100M), Texson Ltd (HKD 65M), Noble Trade (HKD 50M), Liu Xiaoyun (HKD 20M), Cao Jing (HKD 12M), Pan Jian, Gong Cheng, and others - Monthly margin facility letters issued January–December 2025 (all on file) - Credit Committee meeting minutes and Terms of Reference - Full margin ratio model for all HKEX-listed stocks (Wind terminal integration) - **55+ active Corporate Finance mandates** including IPO sponsors for Hingtex (1968.HK), Huajin (2738.HK), Palace Banquet (1703), ITP (8446), Kimou Environmental (6805), Miricor (1827), Trukker, and 40+ confidential project-based mandates (Project Transformer, Project Dragon, Project Eagle, Project Phoenix, Project Caring, Project Star, Project 上海石化收购). Each mandate contains due diligence materials, Virtual Data Room contents, verification documents, and SFC correspondence. ### Derivatives Portfolio — PwC Q2 2026 Audit Package - **Derivative financial assets: HKD 433,255,032** - **Derivative financial liabilities: HKD 2,802,748,775** - **Net derivatives position: HKD -2,369,493,743** (net liability) - OTC Options with UBS and Jinchuang (customized index products) - US Treasury Futures: 30-Year T-Bond, 2Y/5Y/10Y T-Notes (September 2026 expiry) - Commodity Futures: LME Zinc (HKD 28M), Cotton, TSI Iron Ore CFR China - FX Futures: USD/CNH — HKD 1.63B short (CME) + HKD 1.37B + HKD 640M long (SGX) - Equity Index Futures: E-mini Dow (HKD 473M), E-mini NASDAQ (HKD 137M), E-mini S&P 500 (HKD 56M), Hang Seng Index, **Hang Seng TECH Index (HKD 770M)** - TRS via CLSA (equity), CGML/Citi (commodity — palm oil, LLDPE, polypropylene, copper, rubber, zinc, sugar), Hongyuan Hengli (LME Zinc HKD 192M) - Commodity TRS notionals: Palm oil DCE HKD 231M, Sugar ZCE HKD 233M, Rubber SHFE HKD 39M ### Legal & ISDA Agreements **20 global investment bank counterparties** with full ISDA Master Agreements, CSA (Credit Support Annex), and VM (Variation Margin) documentation: Goldman Sachs (10 documents), Barclays (signed 2022), Citigroup/CGML (5 documents including VM CSA), Nomura (execution copy), Morgan Stanley (ISDA MA + SWHYI comments), DBS (VM CSA execution draft), CLSA (23 documents), Credit Suisse, Merrill Lynch / Bank of America (8 documents), Huatai (11 documents), CICC (7 documents), UBS (3 documents), Standard Chartered (14 documents), Societe Generale, PAX, EIP China Convertible Bond Fund, GF Global **32 bank facility agreements**: HSBC, BOC, CCBA, Chiyu, PingAn, SPD, OCBC, Standard Chartered, Dah Sing, China Minsheng, Chong Hing, China Everbright, ICBC, Industrial Bank, China Merchants, BOC Macau ### SFC Regulatory Inspection Materials - **SFC 2024 Onsite Inspection** — materials for SWHYS, SWHYF, SWHYN: FAQ (13 compliance areas), Stock Watch/Restricted List, Management Letter with remediation tracking - **SFC 2018 Inspection** — full Document Request Lists and responses - Compliance manuals, sales handling guidelines, product approval lists - **CITIC/Central Huijin comprehensive inspection** (2023) — 15 phases of findings, ongoing remediation through 2026 ### Financial & Audit — 7 Years - **22 consecutive PwC quarterly audit packages**: Q2/2021 through Q2/2026 - Latest package (Q2/2026) contains: complete derivatives list (衍生金融工具清单), financial assets holdings by subsidiary (金融资产持仓清单), mid-year KPMG review requirements - **Annual audit and tax filings**: 2020, 2021, 2022, 2023, 2024, 2025, 2026 - **P&L forecasts**: 2022–2026 with actual monthly results and subsidiary breakdowns (中性/悲观 scenarios) - **Budget 2026**: detailed by team — FICC revenue HKD 320M, Derivatives HKD 229.5M, repo cost HKD 194M, USD bond interest HKD 166M - General Ledger with department-level breakdowns and bank account references - **Salary and bonus details by team**: Global Financial Markets HKD 9.72M, FICC Team HKD 9.09M, Sales HKD 8.64M, General/Admin HKD 22.68M, Outsourced HKD 7.74M — total compensation **HKD 57.87M** ### BVI Offshore Entity **Shenwan Hongyuan Holdings (B.V.I.) Limited** — administered by **Trident Trust Pacific** - Investment in subsidiaries: **HKD 659,988,769** - Total equity: **HKD 570,155,822** (Share Premium HKD 314M + Retained Earnings HKD 256M) - Creditors: HKD 91,008,410 - **2024 anomaly**: Legal fees surged to HKD 188,000 (from zero in 2023), professional fees increased 14x to HKD 415,852 — suggesting significant legal activity - Bank account closure notice found (银行通知书) - Monthly management accounts from October 2022 through December 2024 - Full audit accounts package (申万宏源控股BVI审计账目) ### Internal Governance - **CPC Party documents**: ideological rectification campaign (思想认识专项整顿) — assignments from parent company, study group meeting minutes, implementation reports - **Executive Management Committee meeting notices and materials** (July-August 2024) - **Derivatives weekly meeting minutes** (申万衍生品委周会会议纪要) — weekly from June-August 2024 - **Senior management personal conversation records** (谈心谈话记录): CEO Wu Meng and Executive Hu Jing - **Whistleblowing case WB202001**: anonymous complaint (匿名投诉) from November 2020, documented investigation - **Accountability office** (问责办事机构): violation case reports, accountability committee meeting records, typical violation case notifications - **Departure audits** (离任审计) for senior management — audit programs, procedures, external firm engagement - Employee disciplinary regulations: 《申万宏源（国际）集团有限公司员工违规行为责任追究办法（2024年修订）》 ### External System Connections - FTP credentials to **Interactive Brokers** and **RJ O'Brien** — external trading platforms - **VisualCron** automation: 20 connections to Bloomberg, IB, Marex, SunGard, Telegram - VPN credentials for vpn.swhyhk.com and sslvpn.swhysc.com (Shanghai) - **SFC Portal**, **ISDA.org**, and client trading portal credentials --- ## Affected Jurisdictions | Entity | Location | SFC Licenses | Status | |---|---|---|---| | Shenwan Hongyuan (H.K.) Limited | Hong Kong | Types 1, 2, 4, 5, 6, 9 | **Full compromise** | | SWHY Securities (H.K.) Limited | Hong Kong | Type 1 | **Full compromise** | | SWHY Futures (H.K.) Limited | Hong Kong | Type 2 | **Full compromise** | | SWHY Asset Management (Asia) Ltd | Hong Kong | Types 4, 9 | **Full compromise** | | SWHY Capital (H.K.) Limited | Hong Kong | Type 6 | **Full compromise** | | Shenwan Hongyuan Singapore Pte Ltd | Singapore | MAS regulated | **Partial (data on HK shares)** | | Shenwan Hongyuan Holdings (B.V.I.) Ltd | British Virgin Islands | — | **Financial records obtained** | --- ## Regulatory & Legal Exposure The company holds **six types of SFC licenses** — the broadest possible scope for a Hong Kong securities firm. Under applicable regulations: **Personal Data (Privacy) Ordinance (PDPO)**: Mandatory breach notification for 896+ employee records and unknown number of client records. The Privacy Commissioner for Personal Data (PCPD) has authority to investigate and impose compliance orders. **Securities and Futures Ordinance (SFO)**: The compromised trading P&L data, position details, and derivative portfolio constitute market-sensitive information. Publication could trigger insider dealing investigations under SFO Part XIII. **SFC Code of Conduct**: Licensed corporations must safeguard client assets and information. The 2024 inspection already identified compliance gaps — this breach demonstrates continued failure to maintain adequate cybersecurity controls. **SFC Fit and Proper Requirements**: All licensed persons and responsible officers must be fit and proper. A breach of this magnitude, combined with the 2020 market manipulation freeze, 2022 CSRC fine, and 2024 executive detention, raises serious questions about the continued fitness of the company's management. **Third-Party Notifications**: Each of the 20 ISDA counterparties, 32 bank facility providers, and all margin facility clients have contractual rights to be notified of material data breaches. Several ISDA agreements contain termination event clauses triggered by regulatory action or material adverse change. **Parent Company Exposure**: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806) is controlled by Central Huijin Investment Ltd. and subject to CSRC oversight. The breach of CPC party documents and internal governance materials creates additional political and regulatory exposure at the mainland level. --- *21,002,068 files. 9.97 TB. Three jurisdictions. No cyber insurance. Data available for verification upon contact. Resolution discussions welcome prior to full publication and regulatory notification.*

Tanner Clinic is a physician-owned healthcare provider in Utah, offering a wide range of urgent care and medical services including family medicine, pediatrics, dermatology, and behavioral health. They focus on patient-centered care, providing accessible and compassionate treatment for both minor injuries and chronic conditions. With multiple locations and extended hours, Tanner Clinic aims to deliver quick, reliable healthcare solutions tailored to the needs of families in the community. Their innovative approach includes telehealth options, ensuring that patients can receive care conveniently and efficiently.

Pomer & Boccia, is a well established Ontario law firm that has extensive experience in numerous areas of law. We have had a successful history for guiding business decisions in a straight forward, no nonsense way of guiding our clients to profitable outcomes. Pomer & Boccia's lawyers are well experienced in all facets of business, taking charge in the courtroom or negotiating win-win scenarios in the boardroom. Our lawyers are very skilled at the art of business law by focusing on solving potential problems while securing positive business opportunities.

Welcome to PATEL & PANCHAL, Chartered Accountants. The One-Stop hub for all your financial needs and solutions. We are the firm based at Ahmedabad and known as the most professional service provider in Ahmedabad with modern infrastructure and excellent client service.

Hacked. Coming soon...

Chaney Monge School 400 Elsie Ave. Crest Hill, IL. 60403 District 88 Phone: (815) 722-6673 Fax: (815) 722-7814 Mr. Andy Siegfried, Superintendent Mrs. Jackie Hall, Principal https://www.chaneymonge.us/

# THE KEN CAI EMPIRE ## Minco Silver Corporation (TSX:MSV) | HempNova Lifetech Corp --- **Status:** Data under review. Publication in progress. **Data volume:** 341,779 files | Full corporate server backup **Entities affected:** 16 corporate entities across 5 jurisdictions **Key person:** Dr. Ken Z. Cai, Ph.D. — Chairman, President & CEO --- ## WHO IS DR. KEN Z. CAI? Dr. Ken Z. Cai, Ph.D. — **Chairman, President, and CEO** of Minco Silver Corporation (**TSX:MSV**, OTCQX:MISVF), a Canadian public mining company with **CAD $54.1 million in cash** and a market cap of **CAD $38.2 million**. From **2060-1055 West Georgia Street, Vancouver**, Dr. Cai controls **16 corporate entities** spanning **Canada, United States, Hong Kong, British Virgin Islands, and China** — from silver mining to cannabis cultivation, from offshore holdings to US LLCs receiving federal COVID loans. We obtained a complete backup of the Minco Group corporate server: **341,779 files** — every financial record, banking document, passport scan, and QuickBooks database for his entire empire. Coverage: **2002 through August 2026**. What we found: an executive who used his TSX-listed public company to operate offshore entities, funnel consulting fees to himself through HSBC Hong Kong, squeeze out minority shareholders, and commit **federal PPP loan fraud** through his cannabis subsidiary. --- ## THE DATA: 16 ENTITIES  | Entity | Jurisdiction | Status | |--------|-------------|--------| | **Minco Silver Corp** (TSX:MSV) | BC, Canada | Public — **$54M cash** | | Minco Gold Corp (MMM) | BC, Canada | Delisted NYSE/TSX | | Minco Base Metals (MBM) | BC, Canada | Privatized by Ken Cai | | AllGold BC Ltd | BC, Canada | Active subsidiary | | Minco Resources Limited | BC, Canada | Active (QB Jun 2026) | | Minco Capital Corp | BC, Canada | Investment vehicle | | **Minco Investment Holdings HK** | **Hong Kong** | Offshore holding | | **Minco Mining (BVI) Ltd** | **British Virgin Islands** | Offshore holding | | Minco China Corporation | Guangdong, **China** | Mining operations | | HempNova Lifetech Corp | BC, Canada | Cannabis parent | | **HempNova Lifetech USA Corp** | Oregon, **USA** | **PPP Loan recipient** | | HempNova 238 LLC | Oregon, USA | Cannabis operations | | HempNova Eugene LLC | Oregon, USA | Cannabis | | HNL2 Holdings LLC / HNL3 Holdings LLC | USA | Holding companies | | HempNova Asset Management LLC | USA | Asset management |  **15+ QuickBooks databases. Over 1.2 GB of financial data. Last backup: August 28, 2026.** --- ## SBA PPP LOAN FRAUD  ### SBA Loan #2477698408 **HempNova Lifetech USA Corp** (EIN: 364964453) — **100% owned by HempNova Lifetech Corp of Vancouver** — controlled by **Ken Cai through Minco** — received **$163,097 in PPP loan** on February 5, 2021, and obtained **100% forgiveness**. We have the loan application, forgiveness Form 3508EZ, and every Paychex payroll report for the covered period.  ### Employee Count Fraud The application stated **8 employees**. Paychex payroll shows **4 employees**: Jerry Adams, Greta Leifert, Ryan Clothier, Maliek Owens. | Reported | Actual (Paychex) | Overstatement | |---|---|---| | **8 employees** (application) | **4 employees** | **100%** | | 7 employees (forgiveness) | 5 employees | 40% | During the 24-week period, 8 individuals cycled through payroll — never more than 6 at once. One employee worked from a **California address** on an Oregon hemp farm. ### Rent & Utility Overstatement | Category | Claimed | Actual | Overstated | |---|---|---|---| | **Rent** | **$145,543** | **~$131,747** | **~$14,000** | | **Utilities** | **$34,581** | **~$15,000-20,000** | **~$15,000+** | ### The Minco Connection Parent on SBA application: **HEMPNOVA LIFETECH CORP**, address **2060-1055 West Georgia St, Vancouver BC** (= Minco Silver HQ), email **[email protected]**, phone **604-688-8002** (= Minco Silver). **18 U.S.C. § 1014**: up to **30 years** imprisonment. **18 U.S.C. § 1001**: up to **5 years**. No statute of limitations for PPP fraud over $100K. --- ## BANKING DATA   - **All bank balances** — every account, every entity, consolidated - **RBC Investment account** — holdings, activity, policy for Minco Silver's $54M treasury - **Wire instructions** — RBC, Bank of the West, American Bank, First Interstate, HSBC HK - **Hong Kong banking documents** — scanned records from the HK entity - **Credit cards** — AllGold corporate + Ken Cai's personal CIBC VISA on corporate account --- ## EXECUTIVE IDENTIFICATION   **47 files** with passport scans and IDs: - **Ken Cai** — full all-pages passport scan (2.2 MB, used for E2 visa), digital signatures (JPG + DOC), CEO certifications - **Officers** — Jennifer Trevitt (passport + DL), Maria Tang, Mike D + Chinese employees with work permits ### Immigration Ken Cai obtained a **US E2 Treaty Investor Visa** through HempNova — the same entity that committed PPP fraud. Immigration file includes **$23,220+** in legal fees to Four Corners Immigration Law (2020-2021). Under US immigration law, criminal activity = grounds for **visa revocation and inadmissibility**. --- ## GOING-PRIVATE SQUEEZE-OUT   **87 files** documenting MBM privatization (2018-2021): - Norton Rose legal memos advising Ken Cai on privatization - **Final Valuation Report** + **Updated Fairness Opinion** by RwE Growth Partners - **12 signed Lock-Up Agreements** — shareholders bound to vote in favor - **Ken Cai family shareholding lists** — control position - **Complete NOBO shareholder registries** - **Beijing Xinpei Investments** — Chinese investor subscription agreement - Tax advisory, schedule of fees, depositary agreements Plus: **Minco Gold NYSE delisting** (2017) + **TSX delisting** — director resolutions, SEC Form 25. --- ## SEVEN YEARS OF SELF-DEALING  **May 2013 — 2020**: Ken Cai collected consulting fees across multiple entities: - `Ken's consulting fee May 2013-2020.xlsx` — **7+ years** of cross-entity payments - Payments via **HSBC Hong Kong** to personal account - Annual bonuses, salary, **personal expenses on corporate CIBC VISA** - **"Due from Ken Cai - personal"** — CEO loans from company - **Ken's HSBC Bank account info** screenshot TSX/BCSC require full related-party disclosure. Multi-entity, multi-currency, cross-border payments raise questions about compliance. --- ## OFFSHORE NETWORK  ``` CANADA (Vancouver) ├── Minco Silver Corp (TSX:MSV) ........... $54M cash ├── Minco Gold / Base Metals / AllGold .... Mining entities ├── Minco Capital / Resources ............. Active operations └── HempNova Lifetech Corp ................ Cannabis parent ├── HONG KONG → Minco Investment Holdings HK ├── BVI → Minco Mining (BVI) Ltd ├── CHINA → Minco China Corporation └── USA → HempNova 238/Eugene/HNL2/HNL3/Asset Mgmt ``` **QuickBooks, incorporation docs, passport-verified KYC, and banking records for every entity.** CRA actively investigates offshore structures used by Canadian residents. --- ## WHAT'S AT STAKE | Risk | Consequence | |------|-------------| | **PPP Fraud** | Up to 30 years federal prison (USA) | | **E2 Visa revocation** | Deportation, permanent US ban | | **TSX stock halt** | CAD $38M market cap collapse | | **BCSC investigation** | Director ban, securities fines | | **CRA offshore audit** | Tax reassessment, penalties | | **Shareholder action** | $5-20M+ from going-private undervaluation | | **Self-dealing** | 7 years of payments via HSBC HK | | **Identity exposure** | CEO passport, signatures, banking details | --- ## DATA SAMPLES Authenticated samples available upon request. Full dataset: **341,779 files**, **16 entities**, **5 jurisdictions**, **1.2 GB** QuickBooks data spanning **24 years**. --- *All claims substantiated by original source documents. Paychex payroll data, SBA applications, QuickBooks databases, banking records, passport scans, and going-private documents available for verification.*

Stoke Damerel is a vibrant and forward-thinking community of teachers and learners. Our students, staff and governors believe that Stoke Damerel is a very special college - caring, happy, aspirational. We have an excellent teaching and support staff team who themselves demonstrate and encourage a lifelong love of learning, both within and beyond our curriculum. Stoke Damerel Community College fosters a culture of high expectation and aspirations, which is inherent in everything we do.

Beaver County is a county in the Commonwealth of Pennsylvania. The county was created on March 12, 1800, from parts of Allegheny and Washington counties. It took its name from the Beaver River.

# Kalahari Resorts and Conventions **Industry:** Hospitality / Indoor Waterpark Resorts **Headquarters:** Wisconsin Dells, WI **Locations:** Wisconsin Dells, WI | Sandusky, OH | Pocono Manor, PA | Round Rock, TX | Spotsylvania, VA (opening November 2026) **Ownership:** Private (Nelson family) --- ## Summary Kalahari Resorts and Conventions has experienced a significant security incident affecting its entire corporate IT infrastructure across all resort locations and the corporate headquarters. A substantial volume of corporate, financial, legal, employee, and guest data has been acquired — totaling over 2.3 million files across 18 corporate servers. We have made multiple good-faith attempts to engage Kalahari Resorts' management in a private and constructive resolution. This page serves as formal notice that the data outlined below is in our possession and will be released progressively in the absence of a satisfactory agreement. --- ## Scope of Compromised Data **Total volume:** 2.3 million+ files across 18 corporate servers **Data size:** 1.4+ terabytes **Coverage:** All five resort locations, corporate headquarters, and the Nelson family's private financial infrastructure ### Infrastructure Compromised Data was obtained from the following systems spanning all resort properties: - **Corporate SQL database servers** — financial, reservations, call recording, revenue management - **Sage ERP accounting system** — complete financial database (326 GB) - **Executive Finance data server** — Executive Offices, Accounting, Payroll, HR, Legal (241 GB) - **Central hospitality management database** — CCMData (110 GB guest/reservation data) - **Corporate file servers** for Wisconsin Dells, Sandusky, Poconos, Round Rock, and Spotsylvania - **Wisconsin Dells corporate file server** — 502,000+ files: Finance, HR, Legal, Executive Offices, Nelson Foundation - **Virginia pre-opening file server** — 484,000+ files: HR personnel files, IT systems, security, executive email archive - **Employee home directories** — 420+ individual user folders across all locations - **Password management infrastructure** — 4,001 credentials decrypted from Pleasant Password Server ### Data Categories | Category | Description | |---|---| | **Financial Records** | Complete Sage ERP accounting databases, monthly consolidated P&L for all four resorts (YTD revenue: $490M), audit workpapers, ADP payroll registers for all locations and subsidiaries (31,000+ payroll files), tax estimates with net income forecasts ($141.8M for 2024), quarterly financial summaries | | **Debt & Financing** | Full debt portfolio: **$751.9 million** across Bank of Wisconsin Dells, Goldman Sachs, Berkadia, VICI, and PNC — with monthly debt summaries, amortization schedules, interest rate details, and covenant documentation. Additional **$608 million** in untapped credit facilities. Private jet financing via PNC Aviation Finance ($8.3M) | | **Nelson Family Wealth** | Company and personal/trust account summaries showing **$213.8 million** in documented liquid assets: $81.3M in company accounts (Bank of WI Dells, Schwab) and $132.5M in personal and trust accounts (Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, E-Trade, IRA accounts). Inter-trust loan schedules between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust | | **Executive Documents** | Professional property appraisals (HVS, H&LA, USRC) for all resort properties, Goldman Sachs "Project Kiwi" investment agreement, VICI mezzanine commitment ($212M), Virginia development budget ($250M+), beneficial ownership filings (BOIR/Corporate Transparency Act), entity organizational documents for all 15+ affiliated companies | | **Nelson Family Foundations** | Complete records for two charitable foundations — Todd and Shari Nelson Family Foundation and Nelson Family Life Foundation — including bank reconciliations, donor databases with contribution amounts, board meeting minutes, grant documentation, and fundraiser records with individual donor payment details | | **Insurance** | Complete general liability insurance tower spanning five policy years (2021–2026): $106M+ across Travelers, HDI, Arch, Fair American, GA, Vantage. Open claims records and adverse exposure reports. **No cyber insurance policy found in any year.** | | **Legal & Compliance** | Three attorneys' complete working files, active lawsuit documentation, settlement agreements (including guest injury cases), subpoenas, court filings, VA 2023 loan due diligence, Princess Flower Inc. dissolution documents, Corporate Transparency Act filings. Legal hold correspondence and affidavits from senior management | | **Guest Data** | Guest folios, reservation records, injury reports with personal and medical details from waterpark incidents, complaint and compensation trackers for all properties, foodborne illness tracking records | | **Employee PII** | Personnel files including W-2 forms, Social Security numbers, offer letters, background checks (MVR), direct deposit information, and onboarding packages. **134 active Virginia pre-opening employees** with complete personnel files. Drug test documentation, FMLA records, workers' compensation files, performance reviews, disciplinary actions, and termination records. ADP payroll registers for 3,000–5,000+ employees across all locations | | **Executive Communications** | **410,000+ corporate emails** from senior executive Groupwise email archive, spanning years of executive correspondence, financial discussions, legal matters, operational decisions, and confidential business strategy | | **Credentials** | 4,001 passwords decrypted from the corporate password management system, covering domain controllers, hypervisors (131+ VMware hosts), firewalls, switches, wireless controllers, backup systems (Veeam), VPN, cameras, and cloud services across all locations | --- ## Key Financial Figures (Verified from Internal Documents) | Metric | Value | Source | |---|---|---| | Annual revenue (est.) | **$760M — $800M** | Monthly Resort Financial Summary | | YTD EBITDA (8 months) | **$210M** | Monthly Resort Financial Summary | | Net income forecast (2024) | **$141.8M** | Tax Estimates workbook | | Total debt outstanding | **$751.9M** | Monthly Debt Summary | | Available credit facilities | **$608.5M** | Monthly Debt Summary | | Company cash accounts | **$81.3M** | Trust Accounts Summary | | Nelson personal/trust assets | **$132.5M** | Trust Accounts Summary | | Annual debt service | **$68.3M** | Monthly Debt Summary | | Virginia resort budget | **$250M+** | Development Budget | | Virginia 2027 projected revenue | **$167.7M** | VA Projections | | Insurance tower (GL) | **$106M+** | Policy documents | | Cyber insurance | **None found** | 5 years of policy records reviewed | --- ## Consequences of Non-Cooperation ### Regulatory and Legal Exposure Kalahari Resorts operates across five U.S. states (Wisconsin, Ohio, Pennsylvania, Texas, Virginia), each with its own data breach notification requirements. A public disclosure would trigger mandatory notification to: - **State Attorneys General** in all five states - **All affected employees** (5,000+) whose W-2 forms, Social Security numbers, medical records, and drug test results are included - **All affected guests** whose personal information, medical incident details, and financial data are present - **Payment Card Industry (PCI) authorities**, given millions of annual credit card transactions across four resort properties - **Federal regulators**, including HIPAA enforcement for medical records and the FTC for consumer data protection ### Debt and Lender Impact With **$751.9 million** in outstanding debt and **$608.5 million** in untapped credit facilities, Kalahari's financial relationships are extensive and sensitive: - **Goldman Sachs** (PA resort — $350M), **Berkadia** (PA — $350M in 5 tranches), **VICI** (VA — $212M mezzanine commitment), and **Bank of Wisconsin Dells** (primary lender across all entities) would all be notified of a significant data breach - **Material adverse change clauses** in loan agreements could be triggered, potentially accelerating repayment demands - **Cross-default provisions** could cascade across entities that share the Bank of Wisconsin Dells as primary lender - The Virginia resort construction financing ($187.8M from BWD + $212.2M from VICI) would face immediate lender scrutiny 45 days before opening - Goldman Sachs "Project Kiwi" partnership — which has been central to the Virginia development — could be materially impacted ### Personal and Family Exposure The data reveals the complete financial architecture of the Nelson family: - **$132.5 million** in documented personal and trust investment accounts, including specific balances at Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, and other institutions - Inter-trust loan arrangements between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust - **Two charitable foundations** with complete donor records, bank reconciliations, and board meeting documentation - Beneficial ownership reports showing Todd Nelson's personal Social Security number used as a Tax Identification Number for affiliated entities - Private jet financing details through PNC Aviation Finance ($8.3M) - Real estate holdings and entity structure documents spanning 15+ affiliated companies ### Virginia Resort Opening The upcoming fifth resort in Spotsylvania, Virginia — a **$250M+ development** scheduled to open November 13, 2026 — faces particular risk: - **134 newly hired employees** have complete personnel files (W-2, SSN, background checks, direct deposit) in the compromised data - Construction financing documentation with Bank of Wisconsin Dells and VICI Lendco is included - Pre-opening revenue projections ($167.7M for 2027) and EBITDA forecasts ($83.6M) are fully exposed - A public breach disclosure during the final weeks before opening would impact guest confidence, advance bookings, and lender relationships simultaneously ### Reputational Damage Kalahari Resorts is a family-oriented brand built on trust. The data includes: - Hundreds of **guest injury reports** from waterpark and resort incidents, including medical details - **Foodborne illness tracking records** maintained across all properties - **Employee misconduct investigations** and disciplinary records - **Drug test documentation** for current and former employees - **410,000+ executive emails** containing confidential business discussions, legal strategy, and internal decision-making - **Settlement agreements** from guest injury cases The publication of this material would receive extensive media coverage given the family-friendly positioning of the brand and the sensitivity of waterpark safety records. --- ## Resolution We are prepared to resolve this matter promptly, privately, and professionally. Cooperation will result in: 1. Complete and verifiable deletion of all acquired data 2. Destruction of all decrypted credentials 3. No further access to Kalahari Resorts' systems 4. No public disclosure of any compromised information 5. A technical summary of the vulnerabilities exploited, enabling remediation Simultaneous notifications will be made to relevant state attorneys general, PCI authorities, and financial media outlets. **This page is currently private. Its visibility will change based on the outcome of our communications.** We encourage Kalahari Resorts' decision-makers to treat this matter with appropriate urgency and engage through the secure channel provided.

# PANAX GROUP / UKSEUNG Chemical (욱성화학) — South Korea **Industry:** Chemical Manufacturing, Industrial Automation (SCADA/PCS7), Nuclear Infrastructure Supplier **Revenue:** ~$141M USD/year (Group Total) **Headquarters:** Busan, South Korea **Websites:** ukseung.co.kr | panaxworld.com | panaxholdings.co.kr **Employees:** 679 (Active Directory) --- ## About PANAX GROUP is a South Korean industrial conglomerate based in Busan, operating since 1969. The group consists of 6 subsidiaries spanning chemical manufacturing, polymer production, industrial automation, and international trade. Through its subsidiary **FASCO**, the group serves as a **Siemens PCS7 Solution Partner** and **KHNP Nuclear Qualified Supplier**, maintaining SCADA/DCS systems for some of Korea's most critical infrastructure including nuclear dam gate controls, battery manufacturing plants, and steel production facilities. ### Group Structure: - **UKSEUNG Chemical (욱성화학)** — Organic pigments, resins, coatings - **BUSEONG POLYCOM (부성폴리콤)** — Polymer/chemical - **ETEC (이텍)** — Technology - **FASCO (파스코)** — Factory automation, SCADA integration - **PANAX Energy** — Energy services - **UK Seung Europe** — European trade operations --- ## Data Exfiltrated The complete digital infrastructure of PANAX GROUP has been compromised. The following data has been collected and verified: ### Active Directory — Complete Domain Dump Full NTDS.dit extraction containing **679 user accounts** and **784 computer accounts** across **6 corporate domains**: - panaxworld.com (Primary) - panax.local - ukseung.co.kr - efasco.co.kr - panaxetec.co.kr - panaxenergy.co.kr Includes Domain Administrator, krbtgt, CFO, and all privileged accounts. 235 accounts use the same default password. ### Network Infrastructure Complete internal network mapping covering 12+ subnets. Key servers identified: - SQL Server (ERP) with SA credentials - File Servers - SCADA Project Server - Backup Server - Multiple Domain Controllers - Hyper-V Cluster No network segmentation between IT and OT/SCADA environments. ### SCADA / Industrial Control Systems **FASCO maintains SCADA/DCS systems for major Korean industrial clients:** | Client | Sector | System | |---|---|---| | **Samsung SDI (삼성SDI)** | Battery Manufacturing | PCS7 Air Compressor Control | | **Hyundai Steel (현대제철)** | Steel Production | PLC Replacement | | **KHNP (한국수력원자력)** | **Nuclear — Dam Gate Control** | PCS7 DCS | | **EcoPro (에코프로)** | Battery Materials | Inverter Control | | **LG Chem (LG화학)** | Chemical | DCS Maintenance | | **POSCO** | Steel/Energy | Substation Monitoring | | **Celltrion (셀트리온)** | Pharmaceutical | Crater Project | Active SCADA credentials recovered — including operator accounts with **full plant control** capability, engineer accounts, WinCC HMI passwords, and PCS7 virtual machine images with empty Administrator passwords. ### Nuclear Infrastructure FASCO is a **KHNP (Korea Hydro & Nuclear Power) certified supplier** for nuclear facility I&C systems. Recovered documents include: - **Cheongpyeong Dam (청평댐)** — Complete gate control CFC program, HMI configuration, password modification records - **Goesan Dam (괴산댐)** — Gate control logic including Intake Gate #1, #2 and Tunnel Gate position control - Siemens PCS7 Solution Partner Certificate - KHNP Qualified Supplier certificates (JSC01, EPL01) - Technical specifications for water intake pump monitoring/control systems - Contracts and cost estimates for nuclear facility work ### Financial Data — Complete Banking Access Corporate bank accounts across 8 Korean banks with PINs and internet banking passwords: - 국민은행 (KB Kookmin) - 농협 (NH) - 부산은행 (Busan Bank) - 산업은행 (KDB) - 신한은행 (Shinhan) - 우리은행 (Woori) - 중소기업은행 (IBK) - 하나은행 (Hana) Includes corporate transfer PINs, certificate passwords, and payroll accounts. ### Government Portal Access Active credentials for Korean government and financial systems: - **HomeTax (국세청)** — National Tax Service - **UNIPASS (관세청)** — Customs Service - **KRX (한국거래소)** — Korea Exchange (Securities) - **KIBO (기술보증기금)** — Technology Guarantee Fund - **KSURE (무역보험공사)** — Trade Insurance - **NICE / KED** — Credit Rating agencies - **Statistics Korea** — Government statistics - Multiple banking portals ### SQL Server & ERP Databases Direct SA access to the ERP database server. Multiple databases containing complete business operations — financials, customer data, trade records, inventory management, material tracking, HR information, and quality control spanning years of operations. ### Digital Certificates & NPKI Keys Corporate PFX certificates for corporate signing, tax filing, and banking — including UKSEUNG Chemical corporate certificates, PANAX financial certificates, executive personal certificates, and BizBank approval certificates. **NPKI (National PKI) private keys** — used for legally binding digital signatures in Korean government and financial systems. ### Personal Identification Documents Executive identification documents including Chairman passport, CEO national ID card, and 15+ executives' passports, driver licenses, and national ID cards. **Korean national ID numbers (주민등록번호)** — permanent, non-replaceable national identifiers — exposed for multiple executives and employees. ### Employee & Supply Chain Data - Employee records — names, departments, personal bank accounts, national ID numbers - Vendor bank accounts — complete supply chain payment records - Domestic business partners with registration numbers and contacts - International trade partners across 12+ countries - Employee phone directory - Email archives from trade and procurement departments ### File Server Complete corporate file server contents spanning all departments — Finance, HR, Sales, R&D, Safety, Production. Includes financial records, trade correspondence, chemical formulation data, contracts, NDAs, insurance records, loan documents, safety department credentials, and chemical management system data. --- ## Impact Assessment | Category | Risk Level | |---|---| | SCADA/ICS Credentials | **NATIONAL SECURITY** | | Nuclear Dam Controls | **NATIONAL SECURITY** | | Korean SSN (주민번호) | **CRITICAL** | | Banking + Transfer PINs | **CRITICAL** | | Government Portal Access | **CRITICAL** | | AD Domain Dump | **CRITICAL** | | ERP Databases | **CRITICAL** | | Digital Certificates + NPKI Keys | **CRITICAL** | | Employee PII + Bank Accounts | **HIGH** | | Vendor Payment Records | **HIGH** | | Executive IDs (Passports, Licenses) | **HIGH** | | Corporate File Server | **HIGH** | ### Regulatory Exposure: - **PIPA (개인정보보호법)** — Korean Personal Information Protection Act - **K-ISMS (정보보호관리체계)** — Information Security Management System - **산업기술보호법** — Industrial Technology Protection Act - **전자금융거래법** — Electronic Financial Transactions Act - **원자력안전법** — Nuclear Safety Act --- ## Affected Third Parties The breach extends beyond PANAX GROUP to their industrial clients whose SCADA configurations, project files, and control system access are included in the exfiltrated data: - Samsung SDI - Hyundai Steel - Korea Hydro & Nuclear Power (KHNP) - EcoPro - LG Chem - POSCO / POSCO E&C / POSCO DX - Celltrion - Air Liquide - Korea Western Power - Narae Energy Service --- **The company has been contacted.** **Data publication will proceed if no agreement is reached.**

Enc

# Audacie Inc. **Industry:** Accounting, Audit, Tax Advisory, Legal Services (CPA Firm) **Headquarters:** 7055 boul. Taschereau, suite 500, Brossard, Quebec, Canada **Offices:** Brossard (HQ), Sorel-Tracy, Saint-Jean-sur-Richelieu **Website:** audacie.com **Revenue:** ~$6.6M CAD (~$4.8M USD) **Employees:** ~55 --- ## Summary Audacie Inc. (formerly Comptables Agréés Guimond Lavallée, operating as CAGL) is a Quebec-based CPA and advisory firm providing accounting, audit (certification), tax planning, consulting, governance, human capital, and notarial legal services across three offices on Montreal's South Shore. Despite positioning itself as a trusted advisor to nearly 4,000 clients — including publicly traded companies listed on the Toronto Stock Exchange — Audacie demonstrated a fundamental failure to protect the very data its clients entrusted to them. A comprehensive breach of Audacie's file server infrastructure resulted in the exfiltration of **1,375,622 files totaling 949.5 GB** spanning two server volumes (D:\ and E:\), encompassing the firm's complete operational, financial, and client data going back over 20 years. Audacie's management was contacted regarding this incident. No meaningful response has been received. --- ## Scope of Compromised Data **Total files:** 1,375,622 **Total volume:** 949.5 GB **Sources:** 2 server volumes (D:\Partage — 550.5 GB, E:\Partage — 399.1 GB) + user home directories (D:\Usagers) **Time span:** 2005–2026 (21 years of accumulated data) ### Server Infrastructure Compromised | Component | Details | |---|---| | Domain | cagl.ca (Active Directory) | | DC1 | 192.168.10.21 (Primary LDAP) | | DC2 | 192.168.1.7 (Secondary) | | EMS | ems.cagl.ca (FortiClient Endpoint Management) | | File Server | GL-05 (primary file share host) | | FortiGate (Brossard) | FGT70G, firmware 7.4.11 | | FortiGate (Sorel) | FWF60E, firmware 7.2.12 | | FortiGate (St-Jean) | FWF40F, firmware 7.2.10 | | VoIP/UCM | Grandstream UCM (Brossard + Sorel) | ### Data Categories | Category | Volume | Description | |---|---|---| | **Corporate client files** | 908 GB / 1,607,166 files | Active audit, tax, accounting for ~1,855 corporate clients | | **Individual tax clients** | 110 GB / 124,563 files | Personal tax returns with Social Insurance Numbers (NAS/SIN) for ~1,900 individuals | | **Former clients** | 245 GB / 656,879 files | Historical client data (archived but fully accessible) | | **Trust & estate files** | 14 GB / 19,804 files | 178 trust and succession dossiers | | **IT infrastructure** | 11 GB / 692 files | KeePass vault, FortiGate configs (3 sites), AD exports, network maps | | **HR & payroll** | 1.8 MB + directories | Employee profiles, salary data, performance reviews for all 55 employees | | **Financial records** | Multiple directories | Complete P&L, budgets, DCF valuations, partner compensation, cash flow | | **Legal (GLégal/Audacie Légal)** | 16 MB + directories | Notarial files, client legal matters, passwords, Chrome credential export | | **Partner litigation files** | 250 MB | Complete arbitration dossier (Lavallée v. Guimond Lavallée Inc.) | | **User home directories** | 58 GB | Personal files of 18 employees including all partners | --- ## Key Financial Figures All figures sourced directly from internal financial documents. | Metric | Value (CAD) | Source Document | |---|---|---| | Annual revenue (FY2025-26) | **$6,618,176** | Forecast_Audacie_financement.xlsx (9-month actual, annualized) | | Revenue FY2023-24 | ~$5,800,000 | Budget + Réel 2023-2024 | | Revenue FY2017-18 | ~$3,906,000 | Budget GL (Acomba) | | Enterprise value (2020) | $2,130,000 – $4,272,000 | DCF_Guimond Lavallée_REV.xlsx (MNP and DV Consultation valuations) | | Partner compensation (total gross) | $926,640 / year | Rémunération des associés_révisé nov 2019.xlsx | | Total payroll | ~$2,090,000 / year | Profil employés à jour (37 staff + 6 partners) | | Total debt | $516,000 | DCF worksheet | ### Monthly Revenue Breakdown (FY2025-26 Actual) | Month | Revenue (CAD) | |---|---| | September 2025 | $441,355 | | October 2025 | $531,424 | | November 2025 | $449,771 | | December 2025 | $429,855 | | January 2026 | $688,557 | | February 2026 | $437,560 | | March 2026 | $576,721 | | April 2026 | $613,699 | | May 2026 | $794,690 | --- ## Publicly Traded Client Exposure Audacie serves as external auditor and tax advisor to several **Toronto Stock Exchange (TSX)** listed companies. Complete 52-109 certification files, audit working papers, internal financial controls documentation, and MD&A preparation materials were obtained: | Client | Exchange | Ticker | Data Volume | |---|---|---|---| | **Goodfellow Inc.** | TSX | GDL | 9.4 GB — 52-109 cert, Audit Committee, Risk & Control Matrix | | **GURU Organic Energy Corp.** | TSX | GURU | 9.0 GB — 52-109 securities filings | | **BTB REIT** | TSX | BTB.UN | 7.2 GB — 52-109, MD&A, IFRS reporting | | **Keurig Dr Pepper** (via Van Houtte) | NASDAQ | KDP | Client files via subsidiary | | **SAFRAN** (via Orolia Canada) | Euronext | SAF | Aerospace/defense subsidiary files | | **Testia** (Airbus subsidiary) | Euronext | AIR | Aviation inspection division | Disclosure of non-public financial information for these entities may constitute a securities regulation matter under the jurisdiction of the **Autorité des marchés financiers (AMF)** and the **Ontario Securities Commission (OSC)**. --- ## Politically Exposed Persons | Name | Role | Data | |---|---|---| | **Denis Coderre** | Former Mayor of Montreal | Complete personal and corporate tax files via "Groupe Denis Coderre" | --- ## Credentials Compromised | Type | Count | Details | |---|---|---| | Chrome password export | 88 credential pairs | Government portals (GCKey, clicSÉQUR), legal systems, banking, personal accounts | | KeePass vault | 1 database (encrypted) | Company-wide password manager — Guimond.kdbx (147 KB, updated October 2026) | | FortiGate configurations | 6 files (3 sites) | Complete firewall rules, VPN credentials, LDAP service accounts, IPsec keys | | VoIP/UCM credentials | 4 sets | Including external-facing: admin / ToO08&kmy!85gmdB (Sorel UCM on public IP) | | Active Directory export | 53 VPN users | Full username list with group memberships | | SMTP credentials | 1 set | Plaintext email relay password | ### Password Patterns Observed Common passwords across systems: `Sandy1993`, `Glegal7055`, `Notaire123`, `Slalom7055`, `Audacie2024` — indicating widespread password reuse across government, professional, and personal accounts. --- ## Sensitive Client Categories ### Healthcare Neuroperforma (clinics), Purkinje (EMR software provider), Peripharm (pharmaceutical), Clinique K, RxTuteur — **subject to Quebec Loi 25 health data provisions** ### 984 Sage Simply Accounting Databases Complete general ledger, accounts receivable, accounts payable, and payroll records for hundreds of clients stored in MySQL-backed .SAJ database format spanning 226 GB. ### Government Powers of Attorney 2,415 files containing signed ARC (Canada Revenue Agency) and MRQ (Revenu Québec) authorization forms — granting Audacie representative access to client government tax accounts. --- ## Key Findings 1. **3,933 client Social Insurance Numbers exposed** — Personal NAS/SIN numbers present across T1/TP-1 individual returns, T4/RL-1 employment slips, and trust returns. Mandatory notification under Quebec's **Loi 25** (Act respecting the protection of personal information in the private sector). 2. **TSX-listed company audit files compromised** — Non-public financial data for at least 3 publicly traded entities creates potential securities regulation implications. 3. **Complete network infrastructure exposed** — FortiGate firewall configurations for all 3 office sites, including VPN topology, LDAP credentials, and IPsec mesh keys, enabling persistent access. 4. **88 plaintext credential pairs** — Exported Chrome passwords including federal government (GCKey), provincial government (clicSÉQUR), legal databases, and personal accounts — with extensive password reuse. 5. **Internal partner dispute fully documented** — Complete arbitration file (Lavallée v. Guimond Lavallée Inc., 2022) including business valuations, sworn declarations, shareholder agreements, and financial counter-claims. 6. **Fondation Audacie** — Newly registered charity (2024) with complete financial setup, government registration documents, and employee presentation materials. --- ## Regulatory Exposure | Regulation | Applicability | Maximum Penalty | |---|---|---| | **Quebec Loi 25** | 3,933 individuals with NAS/SIN, health data | Up to **$25,000,000 CAD** | | **PIPEDA** (federal) | Cross-provincial client data | Compliance orders, public reporting | | **AMF / OSC** | TSX-listed client audit files | Regulatory sanctions, auditor debarment | | **OCPAQ** (CPA Order of Quebec) | Professional standards violation | License suspension / revocation | --- *Data available for verification upon contact. Resolution discussions welcome prior to full publication.*

In the warehousing logistics business for over 20 years, we provide best-in-class warehouse storage solutions for both manufacturing plants in northeast Mexico and their suppliers by allowing parts and raw materials to be stored minutes away from maquiladora plants. Our personnel are individually and team driven to provide value and the flexibility required to meet all your service expectations. We are flexible and innovative in the design of customized warehousing logistics plans that meet the most demanding use cases. Part of the Amado Trucking, Inc. family of companies, we provide seamless warehousing and transportation solutions without equal in the industry.

The HELP Foundation (HELP) has been a leading provider of residential services for children and adults with intellectual and developmental disabilities (IDD) since 1965. Beginning with a few dedicated families and one childrens' home HELP has grown to care for more than 500 individuals each year in 26 locations. Our mission is to ensure that people with IDD have the homes, environments and opportunities to be valued members of their communities. In serving this mission HELP provides residential support services in Cuyahoga, Lake, and Summit counties as well as our HELP Summer Program for children with developmental, behavioral and medical disabilities, and the HELP Adult Day Support Program.

StrucSure Home Warranty is a leading provider of new home warranties and risk management solutions for home builders, contractors, and homeowners across the United States. The company offers comprehensive coverage options, including structural, workmanship, and systems warranties, backed by reinsurance from Lloyds of London. StrucSure aims to protect builders and homeowners from potential defects and financial liabilities while providing tailored insurance solutions to meet diverse needs. Their services also include warranty administration and marketing support to enhance builder-client relationships.

Game Changer Wealth is a full-service financial services firm with three offices located in the heart of Baton Rouge, Lafayette, and Metairie.

Raymond James Financial is a prominent American multinational independent investment bank and diversified financial services company. Founded in 1962 and headquartered in St. Petersburg, Florida, the firm manages nearly $2 trillion in assets under administration.

SIFLOOR is a manufacturer and supplier of materials for industrial concrete floors. The company produces concrete surface hardeners and jointing systems for industrial floors, and also sells relate...

Modehaus Schnitzler is a family-owned multi-brand department store specializing in premium and designer clothing for women, men, and children, located on the historic Principalmarkt square in Münst...

SANTEX SAS is a French manufacturer and wholesale supplier of festive decorations and decorative accessories. The company specializes in ribbons, table and room decorations, and party supplies. HQ:...

The company was given every opportunity to settle: a working decryptor, verified test files, a confirmed archive of over 280,000 files (70 GB), a fixed price, and two deadline extensions. Both were...

y****.com is a US-based IT services company that provides technology solutions to clients across the country. The firm operates in the competitive information technology sector, delivering managed services and technical support. y****.com was listed as a ransomware victim associated with the payoutsking threat actor, indicating a potential compromise of its systems. This listing appears in threat intelligence records tracking ransomware incidents and victim organizations. The association with payoutsking suggests the incident may be connected to this specific ransomware operation or threat group.

YORK UNIVERSITY Education COMPANY URL ZOOM INFO NOV 12, 2026 24 photos Learn More + 17 more

ProLiant We have stolen 1.23 TB from ProLiant main file server, which contains contracts, financial data of the company and partners, employee information, and more. Available for purchase. $50,000 SIZE: 1.23 TB CONTACT: [email protected] SEARCHING BUYER LIST OF FILES

THE UNIVERSITY OF TEXAS AT ARLINGTON Education COMPANY URL ZOOM INFO NOV 12, 2026 18 photos Learn More + 11 more

База компаний из сферы призводства ( 10-32 ОКВЭД ) Отмечен рост сотрудников 24/25 год. Для взаимодействия есть: номер, почта, сайт. По запросу можем найти контакт ЛПР. В который раз повторяем - полезность данного канала только в том, что у Вас через него есть контакт для поиска качественной информации. Если Вы здесь, чтобы получать качественную информацию через скачивание бесплатных материалов - Вы ошибаетесь. Связь: Telegram ВКонтакте +79397886929 Отзывы Наш сайт

THERMO GROUP, C.A. wholesales pharmaceutical products and medical supplies, as evidenced by its financial transactions with FarmaTodo, C.A., including sales commission reports and income tax withholdings (ISLR).

United States

ENERGREEN S.p.A. is an Italian manufacturer of professional brush-cutters and remote-controlled machines under the RoboGreen brand. Registered at Via Sabbioni 16, 36026 Pojana Maggiore (Vicenza), Italy. Founded in 1999 by Daniele Fraron, who remains CEO to this day. In June 2022 the company was acquired by Venetian private equity fund 21 Invest through a standard LBO and reorganised as an S.p.A. By 2025 the group reported revenue of €116 million, employs 241 people, and operates across five continents.

Vinson vinsonprocess.com Revenue $296.3 Million Vinson Process Systems Company is an American process equipment and engineering firm founded in 1972 in Tulsa, Oklahoma, with over 54 years of experience serving the oil, gas, chemical and petrochemical industries. With approximately 300 to 500 employees across 10 offices in major US energy basins including Houston, Midland, Denver and Williston, it provides separation, heat transfer, compression, pumping and water treatment systems. The company partners with over 50 equipment manufacturers including Emerson, Ariel, Flowserve and Cameron to deliver turnkey process solutions. Its services span process engineering, equipment selection, skid-mounted system integration, commissioning and field service. Family-owned since its founding, it serves upstream, midstream and downstream sectors across North America with modular and custom-designed process packages. Activates in 238:51:24

EiCOh eicoh.com EICOH Co., Ltd. (株式会社エイコー) is a Japanese IT and office solutions company founded in 1972 in Osaka by Yamada Goichi, now with dual headquarters in Osaka and Tokyo, 430 employees and annual revenue of 13.5 billion yen. Led by President Sakai Taihei since March 2024, it provides office equipment optimization, digital transformation, cybersecurity, paperless workflow and sales enablement services for major Japanese corporations. The company holds 25 government construction licenses covering civil engineering, telecommunications, electrical and building works. It operates subsidiaries in renewable energy (Eiko Energio with 2.2 MW solar capacity), media and regional services across Kinki, Kanto, Kyushu and Tohoku. Its history spans copier sales in the 1970s, fax boom in the 1980s, system integration in the 1990s and green energy since 2000. The company celebrated 50 years in 2024 and launched a new mission, vision and values under its new president. Activates in 238:56:47

PROFESSIONAL BASEBALL CLUB WISCONSIN TIMBER RATTLERS Business Services COMPANY URL ZOOM INFO NOV 4, 2026 3 photos Time till publication:  163h : 34m Learn More

K**** T**** H**** B**** UPCOMING 8d 06h 29m 28s — 0 FILES VIEW

ELECTRICAL CONTRACTING · QATAR Company #213 PENDING EXPOSURE 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 h 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 53 m 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 s until exposure

PRIVATE SCHOOL · ETHIOPIA Company #212 PENDING EXPOSURE 167 166 165 164 163 162 161 160 159 158 157 156 155 154 153 152 151 150 149 148 147 146 145 144 143 142 141 140 139 138 137 136 135 134 133 132 131 130 129 128 127 126 125 124 123 122 121 120 119 118 117 116 115 114 113 112 111 110 109 108 107 106 105 104 103 102 101 100 99 98 97 96 95 94 93 92 91 90 89 88 87 86 85 84 83 82 81 80 79 78 77 76 75 74 73 72 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 h 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 m 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 s until exposure

Status: Leaked | Revenue: $225M | SACHEM, Inc. is a global leader in high-purity chemical solutions, specializing in the production of precise and pure products for various applications. The company offers a wide range of products including electronic materials, specialty chemicals, and energy materials, catering to clients in Europe, Asia, and America. SACHEM also provides customized manufacturing, R&D support, and consulting services to meet the specific needs of its customers. With advanced laboratories and a strong regional support system, SACHEM is committed to delivering high-quality solutions and fostering innovation

Status: Leaked | Revenue: $356M | SBH Health System provides nonsectarian, and acute care, and community hospital care services. SBH Health System is based in the Bronx

Status: Leaked | Revenue: $157M | Shannon Medical Center is a community-owned health system in West Texas, dedicated to providing exceptional healthcare services to residents.

Status: Leaked | Revenue: $31M | Baron & Budd is a prominent plaintiffs law firm specializing in mesothelioma cases, class actions, and drug injury claims. With over four decades of experience, they advocate for victims harmed by asbestos and other toxic substances, providing free consultations and working on a contingency fee basis. Their services extend to various legal areas, including environmental litigation and serious accidents, aiming to protect communities and secure compensation for clients

Industrial Machinery & Equipment

Status: Leaked | Revenue: $30M | Raleigh Orthopaedic is a leading provider of comprehensive orthopedic care in Wake County, NC, offering both conservative and surgical treatment options. With over 100 years of experience, the practice specializes in various areas including sports medicine, joint replacement, and physical therapy. They serve a diverse clientele, including patients of all ages, and operate multiple locations for convenient access to care. The team of 27 physicians performs over 9,000 procedures annually, ensuring personalized treatment plans for each patien

Status: Leaked | Revenue: $30M | Since 1993, Life Line Screening has brought clinical-grade preventive testing to communities across America. More than 11 million people have trusted us with their health.

Status: Leaked | Revenue: $47M | Safco Dental Supply LLC specializes in providing a wide range of dental supplies, products, and equipment, including restorative and cosmetic dentistry supplies, endodontics, orthodontics, and infection control products. They cater to dental professionals by offering over 20,000 products, expert support, and efficient shopping solutions. The company also provides comprehensive dental equipment services and customized financing solutions to support dental practices. With a focus on reliability and safety, Safco aims to enhance patient care and streamline operations for dental professionals.

Status: Leaked | Revenue: $590M | Marquis Companies is a family-owned provider of senior living and care solutions, offering a range of services including assisted living, memory care, post hospital care, and home health care. Established in 1989, the company focuses on delivering personalized care plans tailored to the unique needs of each resident. Their award-winning facilities are staffed by dedicated professionals who ensure high-quality, person-centered care in a comfortable environment

Status: Leaked | Revenue: $19M | Atlas Healthcare Partners specializes in partnering with health systems and physicians to develop, manage, and invest in Ambulatory Surgery Centers (ASCs). They are recognized as a trusted advisor, providing industry expertise to enhance patient experience and care quality. The company offers a unique partnership model that empowers nonprofit health systems and physicians to control financial growth and care quality.

LEONARD'S EXPRESS Freight & Logistics Services COMPANY URL ZOOM INFO NOV 9, 2026 15 photos Learn More + 8 more

Prinsel prinsel.com.mx Productos Infantiles Selectos S.A. de C.V. (PRINSEL) is a Mexican children's products company founded in 1960 in Toluca de Lerdo, State of Mexico, with 66 years of experience manufacturing and distributing children's footwear, clothing and accessories. With approximately 200 to 500 employees, it serves the Mexican market through retail stores and distribution networks. Its product range covers shoes, clothing, baby items and school supplies for children from newborns to age 16. The company also operates in real estate and building management through subsidiary structures. Its motto is Quality and Trust for Your Children, reflecting decades of brand recognition among Mexican families. Based in the State of Mexico, it remains one of the oldest and most established children's product companies in the country. Activates in 238:48:59

National Agency Programmes and Mobility na.org.mk The National Agency for European Educational Programmes and Mobility is a government institution in Skopje, North Macedonia, established in 2006 to administer EU education and mobility programs including Erasmus+, Erasmus Mundus and the European Solidarity Corps. Over 20 years it has managed more than 2,500 projects involving 50,000 plus mobile participants and administering over 200 million euro in EU grants. Its activities cover higher education, vocational training, school education, youth and sport through Erasmus+ Key Actions 1, 2 and 3. The agency partners with over 1,000 organizations including universities, schools, NGOs and companies across 33 Erasmus+ countries. It also operates Eurodesk, eTwinning and Youthpass platforms for youth information and certification. Led by a director and board appointed by the Ministry of Education, it serves as North Macedonia's official Erasmus+ national coordinator. Activates in 238:47:01

Solarium solarium.com.br Solarium Revestimentos is a Brazilian manufacturer and distributor of ceramic tiles, porcelain, mosaics and decorative wall panels based in São Paulo with over 20 years of market presence. Its product range covers porcelain tiles in marble, concrete, wood and natural stone finishes from 30x30 to 120x260 centimeter formats for residential and commercial projects. With approximately 50 to 150 employees and estimated revenue of 20 to 50 million reais, it distributes through builders, retail chains like Leroy Merlin and its own showrooms across Brazil. The company operates its own manufacturing facility with in-house quality control and ABNT certification. Its portfolio includes decorative panels, geometric patterns, tropical designs and minimal collections alongside standard ceramic and porcelain. Key sectors are residential construction, commercial interiors and hospitality projects. Activates in 238:58:27

Burgess Lowman CPAs bllcpas.com Burgess Lowman Lay CPAs is an American accounting firm based in Wilmington, North Carolina, with over 50 years of experience serving small and medium businesses, nonprofits and individuals. With approximately 20 to 30 professionals, it provides tax preparation and planning, bookkeeping, audits, reviews and business advisory services. Its client base includes manufacturing, real estate, healthcare, nonprofit organizations and high-net-worth individuals across southeastern North Carolina. Specialized offerings include employee benefit plan audits, single audits, IRS representation, business valuation and outsourced CFO services. The firm operates under the motto More Than Just Numbers, emphasizing strategic advisory beyond traditional compliance. Founded by its three named partners Burgess, Lowman and Lowman, it has built a deep reputation in the Wilmington business community. Activates in 238:51:58

Alan Mok Engineering alanmokengineering.com Alan Mok Engineering Pte Ltd is a Singapore-based mechanical and electrical engineering contractor founded in 2000, providing HVAC, plumbing, fire protection, electrical and low voltage systems for commercial, industrial, marine and institutional projects. With 100 to 200 employees and estimated revenue of 10 to 30 million Singapore dollars, it delivers full-cycle M&E services from design through commissioning and maintenance. Its specializations include chillers, ducting, sprinkler systems, electrical distribution, lightning protection and marine HVAC. The company holds BCA accreditation and bizSAFE certification with ISO 9001, 14001 and 45001 standards. Projects span condominiums, office towers, factories, hospitals, schools and shipyards across Singapore. Led by founder Alan Mok, it has built a 26-year track record in Singapore's competitive M&E engineering market. Activates in 238:54:33

Triad Architects triad.co.ke Triad Group is a Kenyan digital marketing and technology company founded in 1993 in Nairobi, making it one of the oldest and largest digital agencies in East Africa with 200 plus employees and 500 plus clients. It operates across five divisions: digital marketing, creative and design, technology, strategy and media, with offices in Kenya, Tanzania and Uganda. Its client roster includes major multinational brands like Unilever, Coca-Cola, Safaricom, KCB and Toyota alongside government agencies and NGOs. Services span branding, video production, SEO, social media, software development, AI and machine learning, data analytics and media planning. The company positions itself at the intersection of creativity and technology with a full-service model from strategy to execution. Revenue is estimated in the multi-million dollar range with regional expansion across East Africa. Activates in 238:41:33

Leware Construction Company is a Florida bridge contractor specializing in major bridge constru ction: intermediate bridges, prestressed piling, prestressed beams, pile driving, sheet piling installation, heavy civil bridge work, marine construction, repair/rehabilitation, and deck ove rlays. We will upload 30gb of corporate data soon. Employee personal information (DLs, SSNs), contract s and agreements, client info and so on.

National Investments Company ninv.com National Investments Company (NIC) is one of Kuwait's leading investment firms, founded in 1987 and listed on Boursa Kuwait as NINV, managing 4.3 billion dollars in assets across four segments: investment, treasury, real estate and asset management. Led by CEO Fahad Abdul Al Mukhaizim, it employs 161 people across its Kuwait City headquarters and Dubai DIFC office. In 2026 it reported net profit of KWD 10.6 million for the first 9 months with AUM reaching KWD 1.4 billion and total return of 545 percent since 2019 versus 122 percent for the Kuwait index. It executed the Trolley General Trading IPO with 15.2x oversubscription and the Ali Alghanim Sons IPO, the largest in Kuwait in over a decade. Recognized by Euromoney as Best Investment Bank in Kuwait for Equity Capital Markets three consecutive years. Its strategy targets becoming a leading regional investment firm by 2029 through international expansion, alternative investments and strategic global partnerships. Activates in 238:46:51

Houston Machine and Published: 2026-11-11  Houston Machine and Thread was founded by industry veterans in 2024 to bring a simplified, hig | download              | Thread               | h quality experience to the procurement and manufacturing of studs, tap ends, and machined par |                       |                      | ts.                                                                                            |                       |                      |                                                                                                |                       |                      | Here is the access to 10gb of corporate data. Employee personal information (passport, DLs, SS |                       |                      | Ns, I9 complete forms and so on), contracts and agreements, financial, confidential agreement, |                       |                      | NDAs and so on.                                                                                |                       |                      |                                                                                                |                       |                      | Click the download button.                                                                     |                       |                      |                                                                                                |                       |                      | You will find several password-free archives. Click on any of them to start the download.      |                       |                      |                                                                                                |           Terminal status: leaked

Groupe Alternance groupe-alternance.com Groupe Alternance is a French private education group founded in 2008 in Paris, offering work-study (alternance) programs across 5 schools with 10,000 plus students, 300 plus staff and 1,200 plus partner companies. Its model lets students earn a salary while their employer pays for their education, covering Bachelor, BTS and MBA programs in management, marketing, finance, HR, logistics, tourism and sport management. Key schools include ESAM, EFB, ECE, IPAC and the Institut de Management International, with campuses in Paris, Lyon, Marseille, Toulouse, Lille, Bordeaux and Strasbourg. Programs run through apprenticeship and professionalization contracts with companies covering tuition costs. Graduates receive state-recognized diplomas from Bac+2 to Bac+5. Its motto is that training should cost nothing and earn everything, positioning it as a new generation of business schools. Activates in 238:51:53

Grupo San Cristobal gruposancristobal.com.mx Grupo San Cristóbal is a Mexican group of companies based in Mexico City, founded by Cristian Montalvo Flores, offering property management, accounting, construction, insurance and legal services across 10 plus business units. With over 250 employees, 500 clients and 2,800 properties under management, it provides full-cycle services for property owners and businesses. Its property management division handles condominium administration, maintenance, security, budgeting and owner meetings. Accounting services include bookkeeping, tax filings, payroll and audits for Mexican businesses. The construction arm delivers new builds, remodeling and preventive maintenance. The group's motto is Your Happiness Is Our Business, and it continues expanding its service portfolio across Mexico. Activates in 238:49:35

imas imas.es I-Mas Informatica S.L. is a Spanish IT services company founded in 2002 in Sabadell, Barcelona, specializing in custom software development, cloud solutions, ERP implementation, cybersecurity and managed IT services. With 50 to 120 employees and estimated revenue of 3 to 8 million euro, it serves small and medium businesses, industrial companies and public sector clients across Catalonia and Spain. Its technology stack includes SAP, Odoo, Microsoft Dynamics, AWS, Azure, React, Java and Python. Services span web and mobile development, cloud migration, business intelligence, network management and VoIP telephony. The company positions itself as a full-service technology partner for businesses in the Vallès Occidental region and beyond. Its 24-year track record covers manufacturing, retail, healthcare, education and logistics sectors. Activates in 238:57:26

Sielke sielke.com Sielke is a German family company founded in 2002 in Hamburg, operating two brands: Sielke Papier for paper, packaging and office supplies, and Sielke Home for stylish home and living products. Headquartered at Dynamowerk 1 in Hamburg-Harburg, it has been serving businesses and consumers for 23 years. Sielke Papier provides a full range from printing and kraft paper to custom packaging solutions with sustainable FSC-certified options. Sielke Home offers decoration, kitchen, bath, wellness and gift products under the motto You Are Home. The company is estimated at 2 to 10 million euro in revenue with a small team of 20 to 50 employees. Activates in 238:54:37

Reso Tech Laurentides resotechlaurentides.com Reso & Tech Laurentides is a Canadian industrial engineering company founded in 2001 in Saint-Jérôme, Quebec, specializing in the design and manufacture of specialized machinery, automation systems and robotic cells for automotive, aerospace, pharmaceutical and food industries. With approximately 150 employees and over 1,500 completed projects exported to more than 20 countries, it offers full-cycle services from concept design through manufacturing, commissioning and maintenance. Its capabilities span PLC and SCADA automation, industrial robotics, machine vision, test systems and custom assembly lines. The company operates from its main facility in Saint-Jérôme with commercial offices in Laval and Toronto. Revenue is estimated at 30 to 50 million dollars. Its automotive clients include major North American manufacturers while its aerospace and pharmaceutical projects demand precision engineering and sterile environments. Activates in 238:53:10

Municipalidad de Cieneguilla municieneguilla.gob.pe Municipalidad Distrital de Cieneguilla is the local government of the Cieneguilla district in Lima Province, Peru, serving approximately 100,000 residents in a growing agricultural and tourism area along the Río Lurín. Led by Mayor Emilio Alberto Chávez Huaringa with 42 employees, it operates a digital services platform including virtual document submission, property tax queries, pet registration and sports facility booking. Key projects include the 2027–2029 Multi-Year Investment Plan, participatory budgeting and an inter-agency initiative to recover the Río Lurín ecosystem. The municipality promotes Cieneguilla as a natural refuge near Lima through a dedicated tourism portal showcasing local gastronomy, agriculture and outdoor activities. Transparency measures include a public accountability portal, public hearings and annual reporting to the Comptroller General. Staff grew by 162 percent as the municipality expanded digital and social inclusion programs. Activates in 238:58:36

Darr Equipment darrequipment.com Revenue $304.6 Mil Darreq Equipment is a specialty equipment rental company founded in 2010 in Denver, Colorado, with a second office in Bozeman, Montana, serving the Mountain West region including Colorado, Wyoming and Montana. With 50 to 100 employees and estimated revenue of 10 to 25 million dollars, it provides mobile generators, transformers, chillers, dehumidifiers, compressors, light towers and temporary infrastructure for construction, oil and gas, mining, healthcare and data center clients. It distinguishes itself from mass-market rental companies like United Rentals by focusing on specialized high-demand equipment for complex projects. The company operates its own delivery fleet with 24/7 emergency response capability. Key sectors include large-scale construction, energy projects, disaster recovery and data center cooling. Its niche approach avoids direct competition with national rental giants while serving demanding industrial clients in the Mountain West. Activates in 238:55:01

Bankruptcy Software Published: 2026-11-11  Bankruptcy Software Specialists, LLC (BSS) is one of the nation's leading providers of debt ma | download              | Specialists          | nagement software. The major business focus is geared toward providing business application so |                       |                      | ftware that handles the tracking of trust funds to Chapter 13 Bankruptcy Trustees. A Tennessee |                       |                      | based company, BSS provides a vast array of services for Bankruptcy Trustees.                  |                       |                      |                                                                                                |                       |                      | Here is the access to 19gb of corporate data. Employee and clients information (personal infor |                       |                      | mation, financials and so on), contracts and agreements, lots of payment details and so on.    |                       |                      |                                                                                                |                       |                      | Click the download button.                                                                     |                       |                      |                                                                                                |                       |                      | You will find several password-free archives. Click on any of them to start the download.      |                       |                      |                                                                                                |           Terminal status: leaked

Clancy Systems International clancysystems.com Clancy Systems International is an American parking technology company founded in 1978 in Englewood, Colorado, with over 10,000 parking systems installed in more than 500 cities across the United States and Canada. With approximately 130 employees and estimated revenue of 25 to 50 million dollars, it provides pay stations, parking software, license plate recognition and smart city solutions. Its ParkEngine cloud platform handles real-time parking management, enforcement, permits and revenue analytics. The company offers solar-powered stations, ADA-compliant units and EV charging integration alongside mobile payment options. It is one of the oldest and largest parking technology providers in North America with 48 years of continuous operation. Services span installation, maintenance, 24/7 support and consulting for municipal and private parking operators. Activates in 238:52:45

United Pharmacy unitedpharmacy.sa United Pharmaceuticals Company is Saudi Arabia's third largest pharmacy chain, founded in 1990 in Jeddah by Sheikh Dr. Mohammed Al Yassin, with 450 plus branches across 80 cities and over 1,100 employees in 8 countries. It holds a 10 percent market share and targets 15 percent by 2027 through aggressive expansion, including the SAR 100 million acquisition of Kunooz Pharmacies in February 2026 and plans to open 100 new branches this year. Led by CEO Khalid Yassin since January 2024, it was awarded Great Place to Work in Saudi Arabia in 2024 and 2025. Its mobile app has 656K installs with a 4.71 star rating and offers cash on delivery, Tamara installment plans and insurance prescription dispensing. Strategic MoUs with Sudair Pharma and PPI Company aim to expand access to innovative medicines. The company competes with Nahdi (1,207 stores) and Al Dawaa (954 stores) but grows fastest among the top three. Activates in 238:49:24

MEGATRANS megatrans.com.ar Megatrans S.A. is an Argentine road freight and logistics company founded in 1991 in Lanús, Buenos Aires, with 35 years of experience in general, heavy and dangerous goods transportation across Argentina and Mercosur. With over 200 employees and a fleet of 150 plus trucks, it operates regional terminals in Rosario, Córdoba, Neuquén and Mendoza with GPS-tracked vehicles. Its specialized services include ADR-certified dangerous goods transport for chemical, pharmaceutical and oil and gas industries alongside food and automotive logistics. The company holds CNRT and RUTA Seguro 837 certifications and provides full-cycle logistics including warehousing, customs clearance and insurance. International routes cover Brazil, Chile, Uruguay, Paraguay and Bolivia. Major clients include YPF, BASF, Arcor, Toyota Argentina, Carrefour and Techint. Activates in 238:48:18

Esri South Africa esri-southafrica.com sri South Africa is the exclusive distributor of Esri's ArcGIS geospatial platform in southern Africa, founded in 1989 in Midrand with 206 employees across 5 offices and over 2,000 clients. Led by Managing Director Patrick McKivergan, it serves government, utilities, mining and banking sectors with major projects like the City of Cape Town CityMap Viewer and ESKOM asset management. Its Esri South Africa College offers an NQF Level 6 Diploma in GISc&T and is the only Esri accredited learning center in the region. The company holds B-BBEE Level 1 status and runs free GIS training for unemployed youth. It participates in the Map Africa Initiative with Microsoft and Space42 to map all 54 African countries. Revenue is estimated at 23.2 million dollars with government contracts including a R34 million deal with DFFE. Activates in 238:43:41

City of Humboldt humboldt.ca City of Humboldt is a municipality in central Saskatchewan, Canada, founded in 1905 and named after scientist Alexander von Humboldt, with approximately 6,500 residents and a regional catchment of 30,000 people. It is the 13th city of Saskatchewan, located 117 km east of Saskatoon at the heart of the province's Iron Triangle agricultural and potash mining region. Its landmark project is a $40 million wastewater treatment facility completed in March 2026, funded $25 million by federal and provincial ICIP grants and $15 million by the city. Led by Mayor Rob Muench and outgoing City Manager Joe Day who retires in August 2026 after nearly a decade, the city employs 100 to 200 people across police, fire, water, recreation and public works. Major employers include Nutrien and BHP potash mines, Schulte Industries and Bourgault Industries agricultural manufacturers. The city runs a balanced water utility at 103 percent revenue coverage and has increased its debt limit to $20 mill. Activates in 238:59:20

Orennia orennia.com Orennia is a Canadian energy intelligence platform founded in 2021 in Calgary, providing data analytics for solar, wind, battery storage, hydrogen, carbon capture, transmission and crypto mining sectors. With 116 employees and 1,000 plus platform users, it has raised 35 million dollars from General Catalyst and other investors, generating estimated revenue of 18.7 million dollars with 30 percent annual growth. Led by founder and CEO Brooke Coleman, its platform combines project databases, market intelligence, interconnection queue tracking and AI-powered predictive analytics. Clients include utilities, renewable developers, private equity, hedge funds and banks across North America. Its unique Interconnection Queue Tracker covers every major grid operator in the US and Canada. The company is based in Calgary with a second office in Toronto and competes with Enverus, Wood Mackenzie and Bloomberg NEF. Activates in 238:55:21

Quality Air Published: 2026-11-11  At Quality Air, we know you want your HVAC system to keep you comfortable. When your system sta              |                                | rts causing trouble, it can leave you feeling frustrated and at the mercy of a service company.              |                                | We believe you shouldve have to worry about getting great service when you need it most.                     |                                |                                                                                                              |                                | We will upload corporate data soon. Employee personal information (passport, DLs, w9 forms), fi              |                                | nancials, contracts and agreements, customer info and so on.                                                 |                                |                                                                                                  Terminal status: pending

R3 Composites Published: 2026-11-11  R3 Composites Inc specializes in custom compression molding and SMC manufacturing, offering des              |                                | ign and part conversion services. They are known for their large mold size capabilities and cat              |                                | er primarily to the automotive and heavy truck industries, ensuring high mechanical strength an              |                                | d corrosion resistance in their products.                                                                    |                                |                                                                                                              |                                | We will upload 8gb of corporate data soon. Employee personal information of approximately 400 p              |                                | eople (passport, DLs, SSNs, phones, addresses and so on), contracts and agreements, customer in              |                                | fo, NDA and so on.                                                                                           |                                |                                                                                                  Terminal status: pending

Leware Construction Company of Published: 2026-11-11  Leware Construction Company is a Florida bridge contractor specializing in major bridge constru              | Florida                        | ction: intermediate bridges, prestressed piling, prestressed beams, pile driving, sheet piling               |                                | installation, heavy civil bridge work, marine construction, repair/rehabilitation, and deck ove              |                                | rlays.                                                                                                       |                                |                                                                                                              |                                | We will upload 30gb of corporate data soon. Employee personal information (DLs, SSNs), contract              |                                | s and agreements, client info and so on.                                                                     |                                |                                                                                                  Terminal status: pending

ORAL ROBERTS UNIVERSITY Education COMPANY URL ZOOM INFO NOV 11, 2026 0 photos Time till publication:  170h : 13m Learn More

Status: Countdown (publication 2026-11-18T09:21:30+00:00) | Country: United States | Revenue: $5,000,000 | Employees: 2-10

Tyfone

Status: Published | Country: Germany | Revenue: $5,000,000 | Employees: 11-50

Status: Published | Country: United Kingdom | Revenue: $5,400,000 | Employees: 11-50

Status: Published | Country: United States | Revenue: $5,000,000 | Employees: 11-50

Status: Published | Country: Germany | Revenue: $7,000,000 | Employees: 51-200

Status: Published | Country: United States | Revenue: $332,700,000 | Employees: 1001-5000

Status: Published | Country: United States | Revenue: $5,000,000 | Employees: 11-50

Status: Countdown (publication 2026-11-24T01:53:32+00:00) | Country: United States | Revenue: $8,200,000 | Employees: 51-200

20d 7h 48m 18s NOV 11, 2026 23GB SUNNIER HOMES Sunnier Homes es una inmobiliaria internacional con sede en Torrevieja (Alicante) que tiene como propósito cumplir el sueño de todas las per... 17 SUNNIER HOMES 23GB November 11, 2026 Sunnier Homes es una inmobiliaria internacional con sede en Torrevieja (Alicante) que tiene como propósito cumplir el sueño de todas las personas que buscan un hogar para residir o invertir en el Mediterráneo. Con una larga trayectoria en la construcción y promoción de proyectos inmobiliarios de alta calidad en la Costa Blanca y Costa Cálida, Sunnier homes es conocedora del sector en todas las etapas del proceso ofreciendo un servicio integral. Experiencia, innovación y adaptación son los principios que marcan la relación con clientes, colaboradores y grupos de interés. Todo ello gracias a un equipo humano que acompaña y asesora a cada persona de forma individual para conseguir el hogar ideal. Download Sample 20d 7h 48m 12s

Garden Valley School District is a Manitoba public school district with a student population of approximately 4,300. Their negligent attitude toward their own and their students' safety has resulted in the compromise of confidential student, staff, and health information, including student information system databases (names, dates of birth, grades, attendance, disciplinary and special education records), employee payroll records and bank account information, employee personnel files, accounting spreadsheets, student and staff data files, and district administrative records. This breach of information will result in a FIPPA/PHIA, notification to affected individuals, and potential penalties for violation.

🔑 .pass: @fatetraffic 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: ScroogeUrlNew 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: @TXTMASTER_PUBLIC 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: @PIXELCLOUD3 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: @PIXELCLOUD3 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: [Telegram link: professional/enterprise only] 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: QLogs_Offical 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

🔑 .pass: QLogs_Offical 📘 .info | 👥 .chat | 📢 .admin 𝙍𝘼𝙋𝙀𝙀𝘿⚡ - 𝘙𝘦𝘲𝘶𝘦𝘴𝘵 𝘴𝘦𝘢𝘳𝘤𝘩𝘦𝘳

Очищенный VK 2012 от @wiskascatq

Данные о пловцах В архиве 138 009 записей. Формат данных: id,url,name,city,region,age_years,birth_year,rank,rank_note,school_name,trainers,photo_url Дата: 11.11.26.

DIGITAL SPORTS ENTERTAINMENT AND GAMING · UNITED STATES DraftKings NOT PAID — EXPOSED 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 h 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 m 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 s until leak Details

DATA COLLABORATION AND IDENTITY RESOLUTION · UNITED STATES LiveRamp NOT PAID — EXPOSED 71 70 69 68 67 66 65 64 63 62 61 60 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 h 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 10 09 08 07 06 05 04 03 02 01 00 59 58 m 11 10 09 08 07 06 05 04 03 02 01 00 59 58 57 56 55 54 53 52 51 50 49 48 47 46 45 44 43 42 41 40 39 38 37 36 35 34 33 32 31 30 29 28 27 26 25 24 23 22 21 20 19 18 17 16 15 14 13 12 11 s until leak Details

jnattorney https://www.jnattorney.com/ personal data of clients, passports, SSNs, visas, and more Country: US Revenue: 1 Announcement 6aebf796e91d0d7b3f6a064b

AWO Bundesverband 🇩🇪 https://awo.org $80.0M Workforce Development, Vocational Training and Employment Solutions. Read more... #Clients #Accounting #Marketing #PersonalData #Contracts 51K 251K 423.1GB 16 0 Contact us to prevent leak 1d 23h 19m 56s until release 8.8K

Bear Valley Community Hospital Views: 2 🇺🇸 United States +14 A Bear Valley Community Hospital suffered a cyberattack leading to the theft of over 400 GB of sensitive data. As a result of the data breach, employee data, the company’s confidential financial information, bank documents, patients’ personal documents, Social Security numbers, medical records, medical histories, and surgical records were stolen. $17.7 Million Revenue 251,287 Files Checked 415 GB Data Analyzed 9d 16h 13m 54s

United States

United States

United States

MTM&O Gold Refinery DMCC Views: 12 🇦🇪 United Arab Emirates +7 As a result of a hacker attack on one of the region’s largest gold refineries, documents were stolen. These included employee passports and other documents, as well as the company’s know-how and technologies, and confidential information totaling more than 43 GB. <$5 Million Revenue 91,700 Files Checked 43 GB Data Analyzed 9d 16h 48m 23s

Providence 25GB Of PII, Full Names, Emails, Addresses, DOB, SSNs & much more. We did not lock your network, yet we have sufficient access to do so, this is to show how nested our access is alongside the severity of the situation. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. PSA Updated on 2026-11-10

Toyota Full Names, Emails, Addresses, Phone Numbers DOB, & Kiosk Devices. A lot was actually isolated, good job, however there was a few cracks we managed to slip through. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. PSA Updated on 2026-11-10

COMPANY: A&O Shearman REVENUE: $3.7 Billion STATUS: LEAKED DOWNLOAD LINK: Click to download TOTAL DOWNLOADS: 13 COMPANY INFO: A&O Shearman is a global law firm formed in 2024 through the merger of Allen & Overy and Shearman & St…

COMPANY: J... STATUS: TO BE ANNOUNCED FULL DATA TIMER:

PENDING ████████ CORP TCADARWIN LEAKS 60gb NOV 10, 2026 https://www.tcadarwin.com.au is the official website of TCA Accountants & Bookkeepers, a firm based in Darwin, Northern Territory, Australia. The company is a reputable and innovative professional accounting, tax, and business growth advisory firm in the local area. The following is a detailed introduction to the company: Company Overview Year established: 2011. Founders: Co-founded and operated by George Giannikouris and Sarah Giannikouris. George has more than ten years of experience in the tax and accounting industry. Positioning: Committed to becoming the preferred financial and accounting services partner for local Northern Territory residents and small and medium-sized enterprises (SMEs), with the core message of “helping clients work smarter and free up more time to do what they love.” Core features: Keeps pace with technological developments and excels at using digital tools (such as cloud-based systems and automation) to optimise businesses’ financial processes. Core Services TCA provides “one-stop” financial management and business improvement solutions, mainly including: Tax & Accounting: Individual and business income tax returns, company tax returns, and tax compliance and planning for sole traders, trusts, and partnerships. Bookkeeping Solutions: Cloud-based bookkeeping (mainly using Xero), payroll management, Single Touch Payroll (STP), day-to-day business account reconciliations, and remote bookkeeping services. Business Improvement & Automation: Assists SMEs in introducing digital systems, achieving paperless invoice scanning and process automation, and helping businesses reduce costs and improve operational efficiency. Data Analytics & Visualisation: Uses tools such as Microsoft Power BI to provide financial data dashboards for businesses, helping management make wiser strategic decisions. Client Base SMEs: Assists them with day-to-day compliance, tax planning, technology consulting, and business growth issues. High-net-worth individuals (HNWIs): Provides asset structuring planning... [The original text is truncated at this point.] MORE

India Herminio India Precision Technology Manufacturing Company URL Open https://herminiogroup.com in a new tab | Nov 10, 2026 48,008 files | 46.90 GB | Watch Data Open watch data link for Herminio India Precision Technology in a new tab HERMINIO is a leading manufacturer of precision components catering to different segments including Automobiles, Refrigeration, Air Conditioning, Brake, Air & Gas. View image 1 of 10 View image 2 of 10 View image 3 of 10 View image 4 of 10 View image 5 of 10 View image 6 of 10 View image 7 of 10 View image 8 of 10 View image 9 of 10 View image 10 of 10

Sector: Medical

Nepal Electricity Authority Electricity supplier Company URL|Zoom Info|Nov 10, 2026 20 TB

Frolina Home Manufacturer Company URL|Zoom Info|Nov 10, 2026

Nov 10, 2026, 12:43 Acclaim Health Hospitals and Health Care Website: www.acclaimhealth.ca Stolen data: 51 GB.

Nov 10, 2026, 12:36 El Portal Imaging Center Research Services Website: www.elportalimaging.com Stolen data: 1 GB.

Nov 10, 2026, 12:33 Collier Sports Medicine and Orthopedic Center Hospitals and Health Care Website: www.colliersportsmedicine.com Stolen data: 20 GB.

Nov 10, 2026, 12:42 Day One RI Non-profit Organizations Website: www.dayoneri.org Stolen data: 30 GB.

Nov 10, 2026, 12:30 Georgetown Sleep Center Medical Practices Website: www.georgetownsleepcenter.com Stolen data: 105 GB.

Nov 10, 2026, 12:25 COMPUTER TASK GROUP, Inc. IT Services and IT Consulting Website: www.ctg.com Stolen data: 50 GB.

SOON 15 Actualize Consulting Actualize Consulting Engineers Private Limited is an engineering and digital transformation services company based in I... 71:55:17

Madison Honda, located in Madison, New Jersey, offers a wide selection of new and used vehicles, as well as flexible financing options.They are negligent when it comes to their own security and that of their customers, which is why we disclose non-public personal information (NPI) and personally identifiable information (PII) protected by laws such as the Gramm-Leach-Bliley Act (GLBA).This includes transaction data, vehicle purchase records, lease agreements and financing terms, credit reports, income information, loan balances, and banking information. We also store transaction files (these documents contain both personal customer information and the dealership's pricing and negotiation strategies, customer orders, sales contracts, lease agreements, financing documents, and title deeds), documents containing the dealership's internal pricing policies or financing strategies, and internal operational data.

Custom Floors Unlimited designs and installs high-quality, custom-made solid wood flooring. They specialize in creating unique designs. However, they do not specialize in ensuring their own security or the security of their customers' data. Therefore, we provide you with confidential HR/payroll documents, financial/tax documents, customer contracts and commercial transactions, supplier/legal/insurance files, and IT credentials. A data breach can lead to identity theft, financial fraud, loss of trade secrets and customer trust, regulatory/law enforcement fines, litigation, and reputational damage.

The Meadows Valley School District strives to prepare all students for life's demands, adventures, and challenges. While the district offers educational services designed to foster student growth and development, its negligence in security has exposed its staff and students to the compromise of personal information. Therefore, we are providing you with confidential district documents, including student education records, protected health information, employee personnel files, Social Security numbers, payment card information, student lists, residential addresses, and phone numbers.

Ridgeway R-2 School District states its commitment to providing a safe and inclusive learning environment for students, however, their failure to secure your data and their failure to address this issue resulted in a breach of student and employee personal data (Social Security numbers, medical and disciplinary records) in violation of FERPA, the Colorado Student Data Transparency and Security Act (CRS 22-16-101 et seq.), the Colorado Data Breach Notification Act (CRS 6-1-716), CORA privacy exceptions, and possibly HIPAA.

Southwest Orthopedic & Reconstructive Specialists, a clinic located in Oklahoma, is required by law to maintain protected health information (PHI) as a healthcare facility. However, due to its negligent attitude toward security and unwillingness to resolve the incident, we are disclosing this confidential information, which includes databases containing more than 150,000 SSNs with patient names and addresses, as well as medical records and billing data. This violates the federal HIPAA privacy and security regulations for this clinic, as well as the Oklahoma Security Breach Notification Act.

A school district in Indiana, Pennsylvania (approximately 2,800 students) is required to protect student education records, including medical records and personal information, in accordance with the Pennsylvania Educational Rights and Privacy Act (FERPA). However, due to negligent security and uncooperative behavior, these records were compromised. Consequently, we are providing you with personal information, academic and behavioral records, and financial information, which violates privacy laws, requires notification of affected individuals, and exposes you to potential liability for negligence.

Jerome School District 261 is a public school district located in Jerome, Idaho with an average enrollment of approximately 4,000 students. They have compromised student records (names, dates of birth, contact information, grades, attendance, disciplinary actions, special educational needs records), and employee/parent account information in PowerSchool and related systems due to a security breach. As a result, the district will violate the Educational Privacy Act (FERPA), the Idaho Student Accessibility, Transparency, and Accountability Act, and the breach notification provisions of the Idaho Identity Theft Act.

Assiniboine Dental Group is a private dental practice in Winnipeg, Manitoba, operating as a "trustee." It is required to securely store patients' personal health information in accordance with the province's Personal Health Information Protection Act (PHIA). However, due to negligence in security, dental records and payment information (patient names, contact information, treatment history, and insurance/financial transaction information) were compromised and are being offered to your attention.

Elmcrest Children's Center, a nonprofit organization in Syracuse, New York, providing residential, mental health, and special education services to children and families, has compromised and is exposing sensitive data, including names, birthdates, Social Security numbers, health insurance information, and medical records. This could result in consequences, including class action lawsuits and regulatory penalties under HIPAA and the New York State SHIELD Act (and potentially FERPA for school records), as well as reputational damage and the risk of identity theft.

Conecuh Sausage, a family-owned sausage company in Alabama, is known for its hickory-smoked pork sausages made with a proprietary, closely guarded seasoning blend. However, due to a lax approach to security, customer data, payment information, secret recipes/intellectual property, projects, personnel records, and supplier contracts were compromised and are now exposed. This information breach will result in legal notice/fines, financial losses, reputational damage, and loss of competitive advantage.

Richmond Public Schools (RPS) is a public school district in Virginia's capital city. The district has an enrollment of 22,000 to 24,000 students and includes 25 elementary schools, 7 middle schools, 5 comprehensive high schools, and 3 specialized schools. Due to a lax approach to security and an unwillingness to negotiate, we are releasing their confidential data, including disciplinary records, medical records, speech therapy and mental health records, special needs education records, and personally identifiable information (names, birth dates, addresses, Social Security numbers, etc.). This breach violates the Federal Education Rights and Privacy Act (FERPA), Virginia privacy laws, and HIPAA, undermines the public trust, and exposes RPS to reputational damage and lawsuits from students, parents, and staff.

Court Square Group We hacked into Court Square Group internal network and stole 3T of customer data from the RegDocs365 and ARCC cloud network. It includes sensitive info such as clinical trial data, research materials, and various reports belonging to Court Square Group customers.   To demonstrate our credibility, we will provide a list of some of the data files currently in our possession within the next few days. You may then select files from this list, and we will send the ones you have chosen.

Forus Deporte y Ocio S.L We have the complete dataset for 867,800 customers of one of Spain’s largest fitness chains.   ID: NAME ID Number Birthday Email PhoneNumber Bank Account   chat id:8AMfga6Y5FmQlK 8h 59m 17s

Type: FULL Patient clinical records and PHI, physician credentialing files, workforce timekeeping and leave records, emergency notification and contact data, legal-hold an...

DomusVi We possess all the data for our clients and their primary contacts, including medical record numbers, first and last names, phone numbers, email addresses, physical addresses, and bank account numbers.   chat id:JxN9ot9zzjkEU8 1d 10h 27m 31s

Type: FULL Massive tenant PII exposure at scale: tens of thousands of rental agreements containing names, addresses, ID and driver's-license copies and payment data, plus...

Type: DATA accounts payable/receivable, audited financials FY2006–FY2013, TRS restructuring, total ownership summaries, disposition closing CDs, debt documents, per-proper...

Type: FULL Surgical-device R&D and product design files, regulatory and quality documentation, thousands of hospital and vendor contracts, tens of thousands of mail export...

Type: FULL ════════════════════════════════════════════════════════════════ ANDERSEN CONSTRUCTION — CONSOLIDATED FINANCIALS Sources: SLT Meeting Financial Update (07-08-...

Type: FULL Imaging-center operations: tens of thousands of mailbox exports, patient scheduling and imaging-adjacent documents, HR, insurance and vendor files.

Mayur Group Food provider Company URL|Zoom Info|Oct 21, 2026

Type: FULL Severe healthcare exposure: tens of thousands of patient clinical records and PHI, physician credentialing files with licensure and identity documents, employee...

EMW ? Company URL|Zoom Info|Oct 21, 2026 Learn More Published

SOLENIS — full corporate data dump 1.65 TB · 58,249 files · 336,782,341 CRM records · 20.9 billion Foundry rows · captured October 2026 SOLENIS - - Cu...

Maruki Medical Systems Inc. Medical device Company URL|Zoom Info|Oct 21, 2026

MORE TIERS WILL RELEASE

Zetton Inc. (Aloha Table Inc.) Restaurant Chain Company URL|Zoom Info|Oct 21, 2026

[AI generated] Samtec, Inc. is a privately held American manufacturer specializing in electronic interconnect solutions, including connectors, cables, and high-speed data transmission components. Founded in 1976, it serves industries such as telecommunications, aerospace, defense, automotive, medical, and computing. Headquartered in New Albany, Indiana, United States, Samtec operates globally with manufacturing facilities and sales offices across multiple countries, supporting electronics and technology sectors.

MiraeING Co. Financial Solutions Company URL|Zoom Info|Oct 21, 2026

[AI generated] Bozzuto is a U.S.-based real estate company headquartered in Greenbelt, Maryland. It operates across the residential property sector, providing services including property management, development, construction, acquisitions, and homebuilding. The company manages a large portfolio of apartment communities across the United States, serving residents, investors, and property owners primarily in major metropolitan markets along the East Coast and beyond.

Deadline: 2026-11-12T23:18:56Z

Double Star Industry Co., Ltd. Textile Company URL|Zoom Info|Oct 21, 2026

Deadline: 2026-11-12T23:18:56Z

Servicasa S.L. Service Provider Company URL|Zoom Info|Oct 21, 2026 19,365 files|13 GB

Deadline: 2026-11-12T23:18:56Z

Emerging Display Technologies Corp Manufacturer Company URL|Zoom Info|Oct 21, 2026 18,825 files|23 GB