Ransomware Group intelligence

Akira

Active

Track Akira with 1703 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 1703 Known published victims in this dataset

First discovered 2023-04-26 Earliest victim discovery date

Last discovered 2026-09-18 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 929 victims

Known locations 2 Leak or negotiation infrastructure tracked

Akira is tracked by Breach House as a ransomware group with 1703 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

1617

Leaked 48 3.0%
Pending 1569 97.0%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Up checked 4h ago	`akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion`
Leak location 1	Onion service	Up checked 4h ago	`akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion`

Finance / Legal / Insurance 427
Communication / Marketing 320
Manufacturing / Engineering 172
Services 130
Construction / Real Estate 106
Not identified 75
IT 66
Healthcare / Pharma 66
Energy 40
Transportation / Travel / Logistics 33
Hospitality / Food & Beverage / Tourism 33
Agriculture / Food 32
Retail / E-commerce 29
Telecommunications 28
Education 25
Public Sector 16
NGOs / Associations 5
null 1

Typical Attacks (29)

▼

How Akira typically operates, as attributed by MITRE ATT&CK v19.2. Attributed via Akira, Akira, Akira _v2.

T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: Akira uses valid account information to remotely access victim networks, such as VPN credentials.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1133 External Remote Services Initial AccessPersistence

What they do: Akira uses compromised VPN accounts for initial access to victim networks.

What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1047 Windows Management Instrumentation Execution

What they do: Akira will leverage COM objects accessed through WMI during execution to evade detection.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.001 PowerShell Execution

What they do: Akira has used PowerShell scripts for credential harvesting and privilege escalation.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1059.003 Windows Command Shell Execution

What they do: Akira executes from the Windows command line and can take various arguments for execution.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1543 Create or Modify System Process PersistencePrivilege Escalation

What they do: Akira _v2 can create a child process for encryption.

What that means: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
T1027.001 Binary Padding Stealth

What they do: Akira has used binary padding to obfuscate payloads.

What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: Akira has used legitimate names and locations for files to evade defenses.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1480 Execution Guardrails Stealth

What they do: Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.

What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
T1685 Disable or Modify Tools Defense Impairment

What they do: Akira has disabled or modified security tools for defense evasion.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1558 Steal or Forge Kerberos Tickets Credential Access

What they do: Akira have used scripts to dump Kerberos authentication credentials.

What that means: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
T1018 Remote System Discovery Discovery

What they do: Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1057 Process Discovery Discovery

What they do: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

What that means: Adversaries may attempt to get information about running processes on a system.
T1082 System Information Discovery Discovery

What they do: Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1083 File and Directory Discovery Discovery

What they do: Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1135 Network Share Discovery Discovery

What they do: Akira can identify remote file shares for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1482 Domain Trust Discovery Discovery

What they do: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

What that means: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
T1654 Log Enumeration Discovery

What they do: Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

What that means: Adversaries may enumerate system and service logs to find useful data.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: Akira has used RDP for lateral movement.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1213.002 Sharepoint Collection

What they do: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.
T1560.001 Archive via Utility Collection

What they do: Akira uses utilities such as WinRAR to archive data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1219 Remote Access Tools Command and Control

What they do: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: Akira will exfiltrate victim data using applications such as Rclone.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: Akira encrypts files in victim environments as part of ransomware operations.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: Akira _v2 can stop running virtual machines.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: Akira will delete system volume shadow copies via PowerShell commands.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1531 Account Access Removal Impact

What they do: Akira deletes administrator accounts in victim networks prior to encryption.

What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
T1657 Financial Theft Impact

What they do: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (41)

▼

Software Akira has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

DonPAPI LaZagne Mimikatz

Defense evasion

PowerTool Zemana Anti-Rootkit driver Zemana Anti-Rootkit

Discovery

Advanced IP Scanner Masscan ReconFTW SharpHound SoftPerfect NetScan

Discovery & enumeration

Advanced IP Scanner Bloodhound ldapdomaindump Masscan ReconFTW SharpHound SharpShares SoftPerfect NetScan

Exfiltration

FileZilla MEGA RClone Temp[.]sh WinSCP

Networking & tunnelling

Cloudflared OpenSSH Ngrok

OffSec

Impacket

Offensive security tooling

CrackMapExec Impacket NetExec

RMM Tools

AnyDesk MobaXterm Radmin RustDesk

Remote monitoring & management

AnyDesk MeshAgent MobaXterm Radmin RustDesk TeamViewer

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (15)

▼

$3,991,216 Received (USD)

24 Payments

15 Known wallets

$997,459 Largest single payment

2023-07-13 → 2024-09-17 Payment window

bitcoin · 15

Address	Chain	Received (USD)	Payments
`bc1qr0pqfghr9cksfc5arr2rak3lt2y50v03pc76nh`	bitcoin	$997,461	2
`bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdaj`	bitcoin	$482,181	1
`bc1q0dx45y82r5rt36sm38jv0k4dexwc4nj9z4ryw7`	bitcoin	$446,073	2
`bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2`	bitcoin	$351,883	1
`bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6h`	bitcoin	$298,537	2
`bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24`	bitcoin	$252,389	1
`bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mc`	bitcoin	$229,395	4
`bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8`	bitcoin	$150,205	1
`bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtah`	bitcoin	$149,891	1
`bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkyd`	bitcoin	$139,534	1
`bc1qpwwtck0zhzrj56fxeayz6wz5546nlp607qzpvh`	bitcoin	$109,655	2
`bc1qghj85gz0dkr9jeucana3z4xu50ujtllj50rvj0`	bitcoin	$106,115	2

+3 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

akira_readme_3.txt txt · 3485 chars

Hi friends,

Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:

1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

6. Negotiations with Akira can only be conducted in a chat room, which you can access using the login details provided below or in the notes (a readme.txt file) in your systems. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf.

7. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme_2.txt txt · 2908 chars

Hi friends,

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme.txt txt · 2662 chars

Hi friends,

Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.

5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (1703)

Search, filter and paginate the victim timeline for Akira. Showing 1401–1500 of 1703.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	SKC West id13509 View details	2024-07-24	United States	Finance / Legal / Insurance	—	pending
SKC-West is the premier supplier for all Industrial Hygiene, Envi ronmental and Safety equipment on the West Coast. Employee data, lots of agreements, confidential files, financial data. Everythin g will be available for downloading soon. ID 13509
Ransomware	American Acryl id13503 View details	2024-07-24	United States	Finance / Legal / Insurance	—	pending
American Acryl L.P. is a joint venture owned by Nippon Shokubai A merica Industries, Inc. (“NAII”) and Arkema Inc. American Acryl manufactures acrylic acid at its Bayport, Texas facility for the benefit of its owners. They don't need their data so we are going to share the files with you. Customers information, financial fi les, personal employee information, detailed financial data and s o on. ID 13503
Ransomware	Electroalfa id13502 View details	2024-07-24	Romania	Communication / Marketing	—	pending
Electroalfa is a successful Romanian company, built by visionary people who managed to innovate complex industrial products to hel p move society forward. 10GB of data will be released. Projects i nformation, clients, detailed personal employee information can b e found in the archives we are going to upload. ID 13502
Ransomware	CALDAN Conveyor id13501 View details	2024-07-24	Denmark	Finance / Legal / Insurance	—	pending
CALDAN Conveyor is a worldwide leading, Danish supplier of overhe ad conveyor and floor conveyor systems. All the dat awill be rele ased soon. Banking information, transactions details, agreements, clients and everything else. ID 13501
Ransomware	siParadigm id13492 View details	2024-07-23	United States	Healthcare / Pharma	—	pending
siParadigm has built a legacy in laboratory testing solutions bas ed on scientific excellence, innovation, and world-class service. 141 GB of data will be uploaded. Full pack of personal data: pas sports, NDAs, confidential agreements, medical reports, driver li censes, birth certificates, social security numbers and other per sonal and docs, financial info, clients and so on. ID 13492
Ransomware	Notarkammer Pfalz id13490 View details	2024-07-23	Germany	Finance / Legal / Insurance	—	pending
The Notary Fund and the Bavarian Notary Association. 200GB of dat a will be available. Numerous SQLs, employee information, detaile d financial data. ID 13490
Ransomware	Win Systems id13489 View details	2024-07-23	Spain	Services	—	pending
Win systems is a provider of casino solutions for the global gami ng industry. Lots of passport, DNIs (identification cards), credi t cards and other personal documents of employees. Information of clients and casinos, financials, other internal business data. 1 0GB of extremely interesting data. ID 13489
Ransomware	Amino Transport id13360 View details	2024-07-15		Transportation / Travel / Logistics	—	pending
Amino has been in business since 1999 and is a growing Third-Part y Logistics (3PL) Company with 3 Texas locations and employees na tionwide. 20GB of data will be available soon. We will upload the ir files containing lots of financial files, customer invoices, b ank details, checks and so on. ID 13360
Ransomware	Financoop id13313 View details	2024-07-11	Chile	Finance / Legal / Insurance	—	pending
Financoop is a Savings and Credit Cooperative with more than 15 y ears in the financial market providing financial products and ser vices. 20GB of data will be released soon. Lots of financial data and other internal business files. ID 13313
Ransomware	Sigma id13312 View details	2024-07-11	United States	Communication / Marketing	—	pending
SIGMA is a California based, leading manufacturer of luxury & bes poke custom faucets, shower systems & accessories. Projects infor mation, some employee data, payments details. Everything will be uploaded soon. ID 13312
Ransomware	P448 id13305 View details	2024-07-10		Communication / Marketing	—	pending
P448 is an Italian footwear brand rooted in the belief that eclec ticism, design innovation and experimentation lie at the heart of self-expression. 11GB of data to be released. CDIs, passports an d other personal employees files. Project information, internatio nal contracts and agreements, financial data. ID 13305
Ransomware	Usina Alta Mogiana S/A id13301 View details	2024-07-10		Communication / Marketing	—	pending
Usina Alta Mogiana SA produces sugar, ethanol and electricity, wi th occupational safety practices, environmental respect and socia l responsibility. 123GB of clients\customers info, personal emplo yee files, financials, projects information, confidential agreeme nts. ID 13301
Ransomware	Inland Audio Visual id13298 View details	2024-07-09	Canada	Finance / Legal / Insurance	—	pending
Inland AV is a systems integrator of professional audiovisual sys tems, located in Western Canada. 10GB of data to be uploaded soon . Employee personal files, NDAs, contracts, agreements, confident ial files, financial information. ID 13298
Ransomware	Heidmar id13295 View details	2024-07-09		Services	—	pending
Heidmar, Inc. is a Global Leader in Crude Oil and Refined Petrole um Marine Transportation Services, Agrees to Business Combination with Nasdaq-Listed MGO Global Inc. 20GB of data for release. Per sonal files of employees, customers information, NDAs, confidenti al agreements, agreements with international customers and so on. ID 13295
Ransomware	Allied Industrial Group id13291 View details	2024-07-08	United States	Communication / Marketing	—	pending
Allied Industrial Group is committed to providing world class pro ducts with service and support through the use of product knowled ge, product availability and application expertise to our ever ex panding customer base. 15GB of data will be provided. Confidentia l agreements, NDAs, employees personal files, customers informati on and other business data. ID 13291
Ransomware	Esedra id13290 View details	2024-07-08	Italy	Education	—	pending
European School was founded in Lucca in 1967 as a language school to meet the increasingly growing needs of local professionals an d companies to communicate without limits with the whole world. F iles of the school will be soon available here. Personal informat ion, reports, lists of students and so on. ID 13290
Ransomware	Federated Co-operatives id13289 View details	2024-07-08	Canada	Services	—	pending
Federated Co-operatives is a co-operative that supports other co- operatives that serve people in Western Canada. 80GB of data will be available for downloading here soon. Numerous HR files with e mployee data, confidential business files, financials, clients in formation. ID 13289
Ransomware	Explomin id13250 View details	2024-07-03	Peru	Finance / Legal / Insurance	—	pending
Explomin provides integrated solutions to Mining, Oil & Gas and C onstruction sectors with world-class standards in drilling and re lated services. Lots of employees personal information like DNIs, date of birth and so on. Numerous financial files: bank transact ions, invoices, agreements with clients, contracts. 30GB in total . ID 13250
Ransomware	Alimac id13249 View details	2024-07-03	Germany	Finance / Legal / Insurance	—	pending
Alimac is focused on packaging innovations and state-of-the art o f packaging machines. Alimac mainly deals with beverage packaging . 20GB of data will be released. Financial data, HR forms, projec t details and so on. ID 13249
Ransomware	P1 Technologies id13234 View details	2024-07-02	United States	IT	—	pending
P1 Technologies company provides public cloud services. Blizzard Entertainment, American Honda Motor, Canon, CBS, Disney, DreamWor ks, Intel, MACOM, Netflix, Rockstar, Sony, SpaceX, Warner Brother s and many others world famous companies have been clients of thi s cloud provider. We will upload the data soon and you will see d etails of their cooperation. Additionally you will find there may financial files with payment details and similar data. ID 13234
Ransomware	Conexus Medstaff id13233 View details	2024-07-02	United States	Communication / Marketing	—	pending
Conexus MedStaff is a leading global recruitment agency that empl oys international nurses in the U.S. 20GB of data will be leaked soon. Great amount of personal data like passports, SSNs, birth c ertificates and some other files can be found in the archive. Fin ancial, HR files, agreements are also represented. ID 13233
Ransomware	Salton id13232 View details	2024-07-02	Brazil	Finance / Legal / Insurance	—	pending
Salton Winery, motivated by the growing interest in the world of wine, maintains qualified customer service and offers customized visitor programs. Almost 30GB of data to be released soon. HR fil es with personal data of employees (brazilians), agreements, cont racts, financial data. ID 13232
Ransomware	SYNERGY PEANUT id13219 View details	2024-07-01	United States	Construction / Real Estate	—	pending
SYNERGY PEANUT, LLC primarily operates in the Nonresidential Buil ding Operators industry within the Real Estate sector. More than 40Gb to be uploaded soon. Employee personal information, financia ls, agreements, customer information and so on. ID 13219
Ransomware	Power Lube Industrial id13195 View details	2024-06-28	United States	Energy	—	pending
Power Lube Industrial is a leading Tier-1 supplier of industrial lubrication equipment solutions and a pioneer in the automatic lu brication business. All files we got from them will be available here soon. Numerous financial data, bank details, transactions, p rojects, customer information, agreements, NDAs and other interna l stuff. ID 13195
Ransomware	Wilmots (Legal services) id13194 View details	2024-06-28	United Kingdom	Finance / Legal / Insurance	—	pending
Wilmots provides clients with careful, bespoke legal advice. Each solicitor has their own area of expertise, and we work together to provide the be st advice, tailored to our clients' needs. Craz y amount of personal documents will be uploaded soon. Passport, b irth certificate, DL of even each client! Many court documents, h earing and so on. Highly interesting. ID 13194
Ransomware	Ocasa id13179 View details	2024-06-27	Argentina	Retail / E-commerce	—	pending
OCASA is an international provider of logistic solutions to compa nies in the e-commerce, general logistics, and health sectors. Yo u will be able to download their files soon. There is a lot of pe rsonal and financial data, operational data of international bran ches, clients data, detailed payment information and so on. ID 13179
Ransomware	Gallos Metal Solutions id13178 View details	2024-06-27	United States	Manufacturing / Engineering	—	pending
Gallos Metal Solutions Inc specializes in continuous mesh belt at mosphere heat treating. Employees personal files, NDAs, agreement s, financial data and other internal business files. ID 13178
Ransomware	Waterbury Newton id13170 View details	2024-06-26	Canada	Finance / Legal / Insurance	—	pending
A full service law firm located in Kentville, Nova Scotia. We wil l upload files of their client soon. ID 13170
Ransomware	PCI Developments id13166 View details	2024-06-25	Canada	Construction / Real Estate	—	pending
PCI Developments is an award-winning Vancouver-based real estate developer of complete urban communities. 570Gb of data will be av ailable here. Client agreements, marketing and financial files, b uildings projects, confidential agreements and reports. Some pers onal files. ID 13166
Ransomware	Beckett Thermal Solutions id13165 View details	2024-06-25	United States	Services	—	pending
Beckett Thermal Solutions is a global pioneer of combustion techn ologies. 11 Gb of data. Lots of projects files, employees names, addresses, emails and other HR information. ID 13165
Ransomware	Utility Datacenter id13164 View details	2024-06-25	United States	Energy	—	pending
Utility Datacenter is a technology integrator focused on helping organizations and administrators through innovation and virtualiz ation. We will upload data of this datacenter here soon. You will find lots of project files, client information, employee person al files etc. ID 13164
Ransomware	Agron (Five Ten) Adidas TERREX id13142 View details	2024-06-24	Germany	Finance / Legal / Insurance	—	pending
Five Ten or Agron is a German manufacturer of mountain biking, cl imbing, and trail hiking shoes. Originally an American brand foun ded in California in 1985 by Charles Cole, Five Ten became one of the top-selling climbing shoe manufacturers worldwide by October 2011. Adidas purchased the company in November 2011. We are goin g to share 20Gb of data of the company that is closely associated with the most famous brand in the world - Adidas. Finance, human resources, marketing and other business info in will be availabl e soon. ID 13142
Ransomware	Lindermayr id13069 View details	2024-06-19	Germany	Services	—	pending
Quality awareness, reliability and technical innovation have char acterized the Lindermayr company for more than 50 years. They ope rate in the independent business areas of building construction, civil engineering, transportation, prefabrication, gravel works a nd haulage services guarantees you comprehensive solutions from a n expert source. 4GB of their internal data will go public soon. ID 13069
Ransomware	Perfumes & Companhia id13068 View details	2024-06-19	Portugal	Public Sector	—	pending
Perfumes & Companhia is a company that operates in the Cosmetics industry. It employs 501-1,000 people and has about $500M of reve nue. The company is h eadquartered in Lisbon, Lisbon, Portugal. 2 5GB of their data will go public soon. ID 13068
Ransomware	TETRA Technologies, Inc. id13043 View details	2024-06-17	United States	IT	—	pending
TETRA Technologies, Inc., operates as a diversified oil and gas s ervices company. It operates through four divisions: Fluids, Prod uction Testing, Compression, and Offshore. We are going to share very interesting 40GB of data. Numerous personal documents like p assports, birth certs, DLs... Confidential agreements, NDAs and e verything like that are widely represented. We will upload the fi les this week. ID 13043
Ransomware	New Balance Commodities id13016 View details	2024-06-14	United States	Communication / Marketing	—	pending
New Balance Commodities provides grain processing and cattle feed ing services by mediating the void of communication, logistics, a nd information between the two industries. Lot's of agreements, r eports, financial information, bank transactions, vendors informa tion and so on. 24GB in total will be available soon. ID 13016
Ransomware	IPM Group (Multimedia Information & Production Company) id12969 View details	2024-06-12	Belgium	Communication / Marketing	—	pending
IPM Group is a major Belgian media and internet services company active in news, entertainment, advertising, gaming and Innovation . We will share 40Gb of data soon. A lost of internal business fi les containing financial information, contracts, employees files, confidential agreements and information about some Belgian media companies. ID 12969
Ransomware	Arge Baustahl id12945 View details	2024-06-10	Australia	Construction / Real Estate	—	pending
Since 1949, the company ARGE BAUSTAHL EISEN BLASY NEPTUN GmbH has stood for outstanding performance in the construction industry. The files of the organization will be available for downloading s oon. There is a lot of internal business information in the archi ve like projects, drawings etc. ID 12945
Ransomware	Reinhold Sign Service id12922 View details	2024-06-07	United States	Finance / Legal / Insurance	—	pending
Reinhold Sign Service is Green Bay’s go-to for vehicle graphics a nd commercial sign manufacturing, installation, and repair. The f iles will be uploaded soon. Financial and accounting data, drawin gs, some info of clients and so on. ID 12922
Ransomware	Panasonic Australia id12895 View details	2024-06-06	Australia	Communication / Marketing	—	pending
Panasonic Australia is a market leader in the field of consumer e lectronics, and B2B solutions. The reliability and reputation of Panasonic products has ensured that they are part of the everyday lives of many. Their cybersecurity was not very reliable so we a re going to share with you the files we took from them. Informati on about projects and confidential agreements, as well as many ot her data from this company with a sound name will soon be availab le for downloading. ID 12895
Ransomware	E-T-A id12880 View details	2024-06-05	Germany	Communication / Marketing	—	pending
E-T-A is the world market leader for circuit breakers for equipme nt protection and circuit protectors. 24GB of data containing per sonal information of employees, clients information, NDAs, financ ial and accounting data. We will upload the files soon. ID 12880
Ransomware	Mahindra Racing id12815 View details	2024-06-04	India	Finance / Legal / Insurance	—	pending
Mahindra Racing became one of the founding teams of the FIA Formu la E Championship, the worlds first all-electric, street racing s eries. 114GB of data will be released soon. We got information on pilots and other employees (passports and other), financial stat ements, accounting, NDAs and other information like car setups an d so on. ID 12815
Ransomware	Anderson Mikos Architects id12801 View details	2024-06-03	United States	Healthcare / Pharma	—	pending
Anderson Mikos Architects has created a name for themselves in th e architecture healthcare industry since being established in 198 5. We have 15GB of their data for uploading. HR files with person al and medical information of employees, financial data, accounti ng, projects and so on. ID 12801
Ransomware	TriLiteral id12791 View details	2024-05-31	United States	Communication / Marketing	—	pending
TriLiteral LLC (TLT) is a private company and full-service third party logistics provider specializing in the distribution of book s for University Presses and Academic Publishers. 24GB of data wi ll be available soon. Detailed accounting data, client info and o ther business files. ID 12791
Ransomware	New Hampshire PublicRadio id12790 View details	2024-05-31	United States	Public Sector	—	pending
Since 1981, New Hampshire Public Radio has shaped the media lands cape in the Granite State and beyond. The files of the organizati on will be in public soon. You could see and download them here o n our blog. Financial and accounting data, grants and much other information. Everything is about 35GB. ID 12790
Ransomware	Faultless Brands id12782 View details	2024-05-30	United States	Communication / Marketing	—	pending
Faultless Brands is a manufacturing business, producing laundry, household cleaning products, air care, and lawn and garden produc ts. A lot of HR files with employees personal data, customers inf ormation, accounting files, confidential agreements, medical info rmation and so on. ID 12782
Ransomware	DreamWall id12781 View details	2024-05-30	Belgium	Healthcare / Pharma	—	pending
Born from a partnership between Dupuis and RTBF, DreamWall, an an imation and graphics studio located in Charleroi (Belgium), is ac tive in different markets: Media Solutions: Mastered, complete an d unique expertise in studios and virtual creations. Files with p ersonal data, medical files, contracts, agreements with other com panies, financial data. Everything is about 15GB. We will make th e files available soon. ID 12781
Ransomware	Excel Security Corp. id12780 View details	2024-05-30	United States	Finance / Legal / Insurance	—	pending
Excel Security Corp. is an internationally respected provider of security services. How did it happen that they themselves were le ft without security? Everything for customers? Anyways, 150GB of data will be accessible here soon. Personal files of employees, S SNs, drivers licenses, phone numbers, emails, financial data, cus tomers information, NDAs, confidential agreements and so much oth er stuff. ID 12780
Ransomware	MagicLand id12776 View details	2024-05-30	Italy	Finance / Legal / Insurance	—	pending
Since its creation, MagicLand has recorded about 3 million unique visitors. In 2014, with 800,000 visitors, Rainbow MagicLand was confirmed as the third theme park in Italy. Within the next few d ays Rainbow MagicLand will be confirmed to cause the leak persona l data: bank information (swift codes, BIC, IBAN), EU ID numbers, accounting and HR files. ID 12776
Ransomware	Western Dovetail id12769 View details	2024-05-29	United States	Healthcare / Pharma	—	pending
Western Dovetail is committed to maintaining tradition in the mod ern industry. Architects, designers and craftsmen recognize dovet ail drawers as the hallmark of excellence in casework. A few GB o f their data will be available here. Employee info (address, emai l, phone, relatives contacts...), tax and payment info, a bit of medical information. ID 12769
Ransomware	Avelina id12749 View details	2024-05-28	United States	Agriculture / Food	—	pending
Avelina supplies product packaged to retailers and the food servi ce industry, in addition to providing raw materials to the main c ompanies in the food industry. 30Gb of data will be released. You will find there much client and competitor information, financia l docs with pieces of personal data. ID 12749
Ransomware	Brett Slater Solicitors id12748 View details	2024-05-28	Australia	Other	—	pending
At Brett Slater Solicitors they specialize in taking on the more difficult and challenging cases. This one seem to be the most dif ficult for them as we are going to upload numerous personal docum ents of their clients from different countries. Besides that ther e are a lot of court and hearings documents and similar data. ID 12748
Ransomware	OTR id12747 View details	2024-05-28		Communication / Marketing	—	pending
When you select OTR, Inc. as your transfer agent, you've done mor e than acquire a service provider - you've gained a partner, one who works diligently to help you succeed in loosing your data. WE will upload their files soon. Lots of business files like financ ials, contracts and agreements can be found in the archives. ID 12747
Ransomware	Vannguard Utility Partners id12698 View details	2024-05-24	United States	Energy	—	pending
Vannguard provides locating and meter reading services to utiliti es in the Midwest. About 30Gb of data will be available soon. Lot s of employment documents with personal information, confidential agreements, customers and projects information and much other st uff. ID 12698
Ransomware	Newman Ferrara id12680 View details	2024-05-22	United States	Finance / Legal / Insurance	—	pending
Newman Ferrara maintains a multifaceted practice based in New Yor k City with attorneys specializing in complex commercial and mult i-party litigation, securities fraud and shareholder litigation, consumer protection, civil rights, and real estate. More than 45G B of data will be publicly available soon. Court processes, heari ngs and personal data of clients of course. Lots of interesting f iles. ID 12680
Ransomware	IZOMAT Praha id12679 View details	2024-05-22	Czechia	Communication / Marketing	—	pending
The business corporation IZOMAT stavebniny s. r. o. was founded i n 1991 and has long been one of the most important suppliers of b uilding materials in the Czech Republic. 200GB of data will be av ailable on this blog. Contracts, clients information with details , agreements and so on. ID 12679
Ransomware	GRANVILLE FOOD CARE LIMITED id12678 View details	2024-05-22	Ireland	Agriculture / Food	—	pending
Granville Food Care Limited is one of the leading cold storage pr oviders to the food industry in Northern Ireland working with pro cessors including ABP, Moy Park, Karro, Foyle and Dunbia. About 2 0Gb of data will be released. HR files, accounting, health and sa fety confidential files, customers information. ID 12678
Ransomware	Marigin id12634 View details	2024-05-20	Switzerland	Healthcare / Pharma	—	pending
Marigin is a veterinary center in Zurich. Here you will find the most modern personal data of employees and pets owners. Also, var ious operational information will be available as well. Everythin g is about 60GB. ID 12634
Ransomware	Fiskars Group id12542 View details	2024-05-14	Finland	Communication / Marketing	—	pending
Fiskars Group is a Finnish group company. The company is a global supplier of branded consumer products for the home, garden, and outdoors. We've taken 2TB of data. Should I list everything inter esting what we copied from their servers? I suppose it is obvious that there are lots of different sensitive documents you are int erested in. We'll provide you with the access to the files as soo n as possible. ID 12542
Ransomware	Bruno generators (Italian manufacturing) id12541 View details	2024-05-14	Italy	Manufacturing / Engineering	—	pending
Bruno's line of products includes compact, reliable and ultra-sil ent generating sets. We have made in Italy production. 40GB of da ta will be released. Clients information, financial documents, pr ojects information etc. ID 12541
Ransomware	Reading Electric id12487 View details	2024-05-10	United States	Finance / Legal / Insurance	—	pending
Reading Electric is a leading supplier of electro-mechanical equipment, services, and problem solver for Industrial and Commercialcustomers. 82Gb of data will be available for downloading. You will find employees personal documents, confidential agreements, contracts inside and financial data inside. ID 12487
Ransomware	M2E Consulting Engineers id12308 View details	2024-05-06	United States	Services	—	pending
M2E Consulting Engineers is a multi-disciplinary firm providing engineering services toits partners across major markets and locations. Lots of confidential data, personal documents, client information, projects. We'll make the files available for you soon. ID 12308
Ransomware	Imedi L id12234 View details	2024-05-02	Georgia	Healthcare / Pharma	—	pending
Imedi L is a health insurer and is part of the largest healthcaregroup in Georgia. 18GB of signed agreements, ID's with personal data, accounting information, payments\bank transactions details.We will upload the files soon. ID 12234
Ransomware	Studio Libeskind id12216 View details	2024-05-01	United States	Construction / Real Estate	—	pending
Studio Libeskind is a world-renowned architecture studio composedof architects and designers that believe architecture is a practice of optimism. 18Gb of files of this organization will be available for everyone in the world. A lot of joint projects information, accounting files, passports, contracts, agreements and so on. ID 12216
Ransomware	GCH Hotel Group id12197 View details	2024-04-30	Germany	Hospitality / Food & Beverage / Tourism	—	pending
The GCH Hotel Group is one of the leading hotel management companies in Germany. 45GB of data to be uploaded. Personal docs of clients, NDAs, numerous financial documents. ID 12197
Ransomware	tudio Libeskind id12196 View details	2024-04-30	United States	Construction / Real Estate	—	pending
Studio Libeskind is a world-renowned architecture studio composedof architects and designers that believe architecture is a practice of optimism. 18Gb of files of this organization will be available for everyone in the world. A lot of joint projects information, accounting files, passports, contracts, agreements and so on. ID 12196
Ransomware	Myers Automotive Group id11721 View details	2024-04-18	Canada	Manufacturing / Engineering	—	pending
Myers Automotive Group sales and services automobiles. The company is headquartered in Ottawa, Ontario. Files of this company willbe available for downloading soon. Agreements, clients and employees information, detailed accounting and other data. ID 11721
Ransomware	Serfilco, RP Adams, Baron Blakeslee, Pacer, Service Filtration of Canada, Polymar. id11709 View details	2024-04-17	Canada	Hospitality / Food & Beverage / Tourism	—	pending
Recently we've obtained data of a group of industrial manufacturers and here they are: Serfilco, RP Adams, Baron Blakeslee, Pacer,Service Filtration of Canada, Polymar. Accounting and financial data, agreements, contracts, employees and partners personal dataand other business internal data. ID 11709
Ransomware	Wright Brothers Construction id11695 View details	2024-04-16	United States	Construction / Real Estate	—	pending
Wright Brothers Construction services include grading, site development, highway and bridge construction, landfill construction, asphalt production and paving, aggregate processing, commercial concrete services, and industrial maintenance services. As this company doesn't care about the data we've taken from them, we will share it with those who do. 12GB of data will be uploaded here. A lot of financial data, accounting, insurance, employees files. ID 11695
Ransomware	Medequip Assistive Technology id11694 View details	2024-04-16	United Kingdom	IT	—	pending
Medequip Assistive Technology is the leading provider of servicesand equipment to local authorities and the NHS across the UK in delivering a wide range of equipment and support to people in their own homes. 50GB of data will be available soon. You find personal information (NINOs, birth certificates, driver licenses etc.), confidential reports and agreement and other internal business information. ID 11694
Ransomware	Lotz Trucking id11692 View details	2024-04-16	United States	Transportation / Travel / Logistics	—	pending
Lotz Trucking specializes in the bulk business and offer a wide range of services with flatbeds, vans, hopper bottom and dump trailers. We are going to make available their files of ~15GB size. Lotz of confidential agreements, NDAs, employees personal information. ID 11692
Ransomware	Studio LAMBDA id11691 View details	2024-04-16	Italy	Education	—	pending
Studio Lambda Engineering for safety and the environment, Matera,Milan, company and construction site safety, environment and sustainability, energy, instrumental surveys, training. Scan of personal documents of employees, NDAs, financial files, agreements and so on. We'll upload the files soon. ID 11691
Ransomware	Best Reward Federal Credit Union id11669 View details	2024-04-15	United States	Finance / Legal / Insurance	—	pending
Best Reward Federal Credit Union offers low-rate loans, deposit accounts, VISA cards and mobile services. Lots of financial documents, personal information including thousands of members names, SSNs, addresses, emails, phones. We are going to share everything soon. ID 11669
Ransomware	Snchez-Betances Sifre & Muñoz-Noya id11635 View details	2024-04-12	United States	Finance / Legal / Insurance	—	pending
Snchez-Betances, Sifre & Muñoz-Noya is a boutique law firm that resulted from the merger between Snchez-Betances & Sifre and Lespier Muñoz-Noya & Rivera in 2004. All the files we've taken from their network will be published soon. Personal information of employees, information of partners, business info. ID 11635
Ransomware	Missouri Electric Cooperatives id11599 View details	2024-04-11	United States	Services	—	pending
Missouri Electric Cooperatives is a statewide association established to protect, support and serve the interests and business practices of our 47 member electric co-ops and to help ensure the 2 million co-op members in rural Missouri receive reliable and affordable electricity. Files of the organization will soon be available for downloading. Information of employees (phone, addresses, photos, etc), business partners, accounting data and so on. ID 11599
Ransomware	Samart id11595 View details	2024-04-10	Thailand	Telecommunications	—	pending
Samart Group or simply Samart is a Thai group of companies which focuses on telecommunication, Consumer electronics industry. We will publish about 300GB of data soon as these guys do not care much their files. There lots of personal documents especially passports scans, NDAs, confidential agreements, lists of customers andmuch more interesting. ID 11595
Ransomware	Consilux (Brazil) id11592 View details	2024-04-09	Brazil	IT	—	pending
Consilux Tecnologia is a modern company attentive to constant technological innovations, maintaining the development of innovativetechnologies capable of providing facilities, quality of life, safety and convenience to the population. 40Gb of data will be available soon. Employee personal documents, projects, agreements, abit of client info, NDA and so on. ID 11592
Ransomware	PGF Technology Group id11554 View details	2024-04-08	United States	IT	—	pending
PGF Technology Group is a contract manufacturer for printed circuit boards, cables and wire harness assemblies. We share their files soon as the company doesn't care about the data. Employees SSNs, financial data, lots of NDAs, projects information much more. ID 11554
Ransomware	REV Drill Sales & Rentals id11553 View details	2024-04-08	United States	Retail / E-commerce	—	pending
REV Drill Sales & Rentals provides economical drilling solutions and supports clients from start to finish in Frederick, MD. HR, financial docs, agreements, employee information and so on. We'll upload everything soon. ID 11553
Ransomware	Inspection Services id11513 View details	2024-04-04	United States	Services	—	pending
Inspection Services, Inc. (ISI) is a minority woman-owned business delivering industry-leading special inspection and materials testing services throughout California. Detailed employee personal information (docs scans and forms), agreements, trainings results, dispatch letters and tons of business papers. ID 11513
Ransomware	Radiant Canada id11512 View details	2024-04-04	Canada	Services	—	pending
Radiant Canada is the result of integrating 30 years of transportation management expertise with warehousing services experience. 25GB for uploading here. A lot of financial data, personal information of employees, clients info and so on. ID 11512
Ransomware	Control Technology id11456 View details	2024-03-29	United States	IT	—	pending
Control Technology Inc designs and manufactures advanced control,communications, and input & output products for industrial process automation. Numerous agreements, licenses and other internal business info. We'll share the files approximately next week. ID 11456
Ransomware	Lakes Precision id11436 View details	2024-03-28	United States	Communication / Marketing	—	pending
Lakes Precision provides a wide variety of value added services and programs to assist our customers. Lot's of financial data, NDAs, employee information. We'll provide access to their data soon. ID 11436
Ransomware	Santa Cruz Seaside id11434 View details	2024-03-28	United States	Finance / Legal / Insurance	—	pending
The company operates the Santa Cruz Boardwalk amusement park in California, which has been touted the "Coney Island of the West". We will share their files soon. Many financial documents, HR, various reports and other business data. ID 11434
Ransomware	Mermet id11406 View details	2024-03-27	United States	Communication / Marketing	—	pending
Mermet has been dedicated to producing quality fabrics that meet and exceed customer's expectations. About 30GB of data will be available soon. You will find there confidential HR files with personal information and other interesting on the company. ID 11406
Ransomware	Koi Design id11372 View details	2024-03-26	United States	Services	—	pending
Koi Design LLC is a clothing company. The company's line of business includes the wholesale distribution of women's, children's, and infants' clothing and accessories. We are going to share with you 30Gb of their databases of business files, payments information, agreements, projects and so on. ID 11372
Ransomware	Tanis Brush id11371 View details	2024-03-26	United States	Manufacturing / Engineering	—	pending
Regal Manufacturing was established in 1934. Quality brushes and brooms with personalized service for our customers is the foundation upon which Regal Manufacturing Company was built, and that quality and service continues today. You will be able to see how itworks from the inside when we upload their files here. Business docs, NDAs, agreemnts, some forms with personal information can be found there. ID 11371
Ransomware	Calida id11361 View details	2024-03-25	Australia	Finance / Legal / Insurance	—	pending
Calida was established in 2008 as a high end retail, hospitality and commercial building and project management company. 26GB of data will uploaded soon. HR files, financial and accounting data, some project information can be found inside. ID 11361
Ransomware	Vita IT id11360 View details	2024-03-25	Belize	Communication / Marketing	—	pending
Vita IT is an Integrator and IT Service Provider made up of highly competent professionals with extensive experience in the IT market. We will provide access to their data soon. Operational data and personal information can be found in the archive. ID 11360
Ransomware	European Centre for Compensation id11359 View details	2024-03-25	Poland	Finance / Legal / Insurance	—	pending
Europejskie Centrum Odszkodowan is involved in claim payments from parties who may have caused to the accident or insured the loss. These guys decided to make their data available for everyone and we will help them. In the 72GB archive you will find enormous number of files: scans of business, judicial, insurance documents,court hearings, personal documents of employees and clients. ID 11359
Ransomware	Summit Almonds id11214 View details	2024-03-13	United States	Communication / Marketing	—	pending
Summit Almonds assists California almond, walnut and othertree nut growers and handlers in marketing high quality almonds at prices to our partners and end users around the world. 33Gb of data will be released here. Personal docs, NDAs, forms with personal information and a DB with more than 10000 lines of phones and emails. ID 11214
Ransomware	Infosoft id11116 View details	2024-03-06	New Zealand	IT	—	pending
Infosoft is a New Zealand owned and operated software developmentcompany that provides an integrated range of products and services spanning software design, development, implementation and support. Their data will be available for downloading soon. Numerous operational files, projects, documents with personal information. ID 11116
Ransomware	Medical Billing Specialists id11114 View details	2024-03-06	United States	Healthcare / Pharma	—	pending
Medical Billing Specialists helps U.S. practices from California to Massachusetts with medical billing solutions and online medical billing software to earn significantly more revenue and reduce expenses. Over 120GB of data will be uploaded here on our blog soon. You will find detailed employees and patients information - addresses, DOB, emails, background checks, phones, correspondence with clients, NDAs and so on. ID 11114
Ransomware	Telecentro id11113 View details	2024-03-06	Argentina	Finance / Legal / Insurance	—	pending
TeleCentro introduced Triple Play in Argentina, and has grown to become the leader in this segment in the country. 40GB of data will be released soon. Many operational files, HR documents with employees personal information, financials and everything. ID 11113
Ransomware	Steiner (Austrian furniture makers) id11112 View details	2024-03-06	Austria	Communication / Marketing	—	pending
Individual pieces of furniture combining creativity, aesthetics and function are the company's hallmark. About 20Gb of their data will be available for downloading soon. HR documents, contracts, clients info and projects can be found inside. ID 11112
Ransomware	America Chung Nam orACN id11092 View details	2024-03-04	United States	Public Sector	—	pending
ACN is one of the world's largest exporters of recovered paper inthe United States, and a leading exporter across the globe in Europe and Asia. We are going to upload their 450Gb of data here soon. You will see operation documents, information about their clients around the globe, contracts, HR files with employees documents and tons of other papers. ID 11092
Ransomware	CoreData id11045 View details	2024-03-01	Canada	Finance / Legal / Insurance	—	pending
CoreData is developing software systems for engineers and engineering companies. Their files will be uploaded soon. Non-dicslosures, financial data, documents with personal info and so on. ID 11045
Ransomware	Gansevoort Hotel Group id11044 View details	2024-03-01	Tuvalu	Hospitality / Food & Beverage / Tourism	—	pending
Gansevoort Hotel Group delivers hotels that marry the best of thelocal neighborhood with prominent art, design, tech and local heritage as well as our brand legacy. Passports, driver licenses, insurance cards, SSNs and other data will be available here. ID 11044
Ransomware	DTN Management Company id11012 View details	2024-02-28	United States	Services	—	pending
DTN Management Company is a recognized leader in apartment operations with a portfolio of over 106 communities across Michigan's best markets. These guys are not interested in saving their 68GB of data with all the passport scans, SSNs, driver licenses of their employees and partners. ID 11012
Ransomware	Bjuvs kommun id10976 View details	2024-02-26	Sweden	NGOs / Associations	—	pending
We will upload almost 200GB of Bjuvs kommun organization. Confidential documents, contracts, agreements, personal HR files and so on. ID 10976

Akira

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (2)

Top Activity Sectors (18)

Typical Attacks (29)

Tools Observed (41)

Credential theft

Defense evasion

Discovery

Discovery & enumeration

Exfiltration

Networking & tunnelling

OffSec

Offensive security tooling

RMM Tools

Remote monitoring & management

Crypto Wallets (15)

Ransom Notes (3)

Victims (1703)

Restricted Access

Now you can see the leak, not just the listing