Ransomware Group intelligence
Deadlock
ActiveTrack Deadlock with 125 published victims and 3 known leak locations in a single intelligence view.
Overview
Deadlock is tracked by Breach House as a ransomware group with 125 published victims.
Italy is currently the most targeted country in this dataset.
3 known leak locations are currently associated with this group.
Leak Status Distribution
- Leaked 18 14.4%
- Pending 103 82.4%
- Deleted 4 3.2%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (3)
| Label | Type | Availability | Links |
|---|---|---|---|
| File host (third party) | Third-party file host | Up checked 2h ago | www.swisstransfer.com |
| Leak location 2 | Onion service | Up checked 2h ago | deadblogdbdu5wprek7wa2o4ce7rnt6u6ntqeud3hzjjcveosgpsqqqd.onion |
| Leak location 1 | Web location | Up checked 2h ago | deadlock.liveblog365.com |
Top Activity Sectors (15)
- IT 16
- Manufacturing / Engineering 12
- Not identified 7
- Retail / E-commerce 7
- Finance / Legal / Insurance 6
- Transportation / Travel / Logistics 4
- NGOs / Associations 4
- Services 3
- Healthcare / Pharma 3
- Energy 3
- Construction / Real Estate 3
- Public Sector 2
- Education 2
- Telecommunications 2
- Hospitality / Food & Beverage / Tourism 1
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue Deadlock, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.003 Windows Command Shell Execution
What they do: Deadlock executes commands via cmd.exe
What that means: Adversaries may abuse the Windows command shell for execution.
-
What that means: Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence.
-
T1070.004 File Deletion Stealth
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1083 File and Directory Discovery Discovery
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1135 Network Share Discovery Discovery
What they do: Deadlock discovers network shares with net view
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: Deadlock moves laterally using SMB shares
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: Deadlock encrypts files with custom ransomware
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: Deadlock stops services using net stop
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: Deadlock inhibits recovery with vssadmin
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (125)
Search, filter and paginate the victim timeline for Deadlock. Showing 1–100 of 125.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Trinity Custom Homes id35511 View details | United States | Manufacturing / Engineering | pending | ||
|
Published Trinity Custom Homes Trinity Custom Homes is a custom home builder that specializes in building 100% custom, solid wood homes directly on the customer’s land across several states in the Southeast, including Georgia, Alabama, North Carolina, South Carolina, and Tennessee. https://trinitycustom.com/ View Online |
||||||
| Ransomware | Hensel Elektrik id35509 View details | Germany | Manufacturing / Engineering | pending | ||
|
Publishes after: 6d 23h 35m Hensel Elektrik Hensel Elektrik is the Turkish subsidiary of the German company Gustav Hensel GmbH & Co. KG, which manufactures electrical installation equipment and power distribution systems. The company was founded in 1931. https://www.hensel-electric.de/tr-tr/ https://temp.sh/BcIQY/Data_list.txt |
||||||
| Ransomware | 🔍 What's Happening? id33945 | — | — | pending | ||
|
🔍 What's Happening? DNS Record Not Found: The Domain Name System (DNS) cannot locate the IP address for this domain. This means the website's DNS records either don't exist, haven't been configured properly, or haven't propagated across the internet yet. Or the requested domain is not yet added to an active hosting account. DNS (Domain Name System) is like the internet's phone book - it translates human-readable domain names (like example.com) into IP addresses that computers use to connect to websites. When you see this page, it means this translation process has failed. |
||||||
| Ransomware | 🛠️ Quick Solutions id33946 | — | — | pending | ||
|
🛠️ Quick Solutions 1. Flush Your DNS Cache Your computer stores DNS information temporarily. Clearing this cache can resolve outdated entries: Windows: ipconfig /flushdns macOS: sudo dscacheutil -flushcache Linux: sudo systemctl restart systemd-resolved 2. Try Different DNS Servers Switch to public DNS servers that might have more up-to-date records: Google Public DNS Primary: 8.8.8.8 Secondary: 8.8.4.4 Cloudflare DNS Primary: 1.1.1.1 Secondary: 1.0.0.1 Quad9 DNS Primary: 9.9.9.9 Secondary: 149.112.112.112 3. Wait for DNS Propagation ⏱️ Typical Propagation Times: Local ISP: 15 minutes - 2 hours Regional providers: 2 - 8 hours Global propagation: 24 - 48 hours Full propagation: Up to 72 hours |
||||||
| Ransomware | 📚 Understanding DNS Propagation id33947 | United States | — | pending | ||
|
📚 Understanding DNS Propagation DNS propagation is the time it takes for DNS changes to spread across the internet's network of DNS servers worldwide. When a domain's DNS records are created or updated, these changes don't happen instantly everywhere. Why Does Propagation Take Time? Caching: DNS servers cache records for a specified time (TTL - Time To Live) Global Network: Thousands of DNS servers worldwide need to update ISP Policies: Some internet providers refresh DNS records on their own schedule Geographic Location: Servers closer to the authoritative DNS update faster |
||||||
| Ransomware | 🔧 Advanced Troubleshooting id33948 | — | — | pending | ||
|
🔧 Advanced Troubleshooting Check DNS Resolution Use these commands to test DNS resolution: nslookup yourdomain.com dig yourdomain.com ping yourdomain.com Try Different Networks Test the domain on: Mobile data (different ISP) Different WiFi network VPN connection Public WiFi |
||||||
| Ransomware | 🌐 Helpful Resources id33949 | — | — | pending | ||
|
🌐 Helpful Resources Google Public DNS Setup instructions Cloudflare DNS Fast DNS resolver |
||||||
| Ransomware | 🕐 What to Do Now id33950 | — | — | pending | ||
|
🕐 What to Do Now Try the quick solutions above - flush DNS cache and try different DNS servers Wait 2-4 hours and try again if this is a new domain or recent DNS change Test from different devices/networks to isolate the issue |
||||||
| Ransomware | JP Molyneux Studio id33943 | France | — | pending | ||
|
Published JP Molyneux Studio JP Molyneux Studio Ltd showcases the exclusive work of internationally renowned interior designer Juan Pablo Molyneux. https://www.molyneuxstudio.com 700GB View Online |
||||||
| Ransomware | Global Terminal Services id33944 | Türkiye | — | pending | ||
|
Published Global Terminal Services GTS legally registered as Global Terminal Hizmetleri A.Ş. It is the largest independent storage terminal for liquid fuels and oil in the entire Mediterranean region. https://globalterminal-tr.com/ 470gb View Online |
||||||
| Ransomware | SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA id33930 View details | Pakistan | Finance / Legal / Insurance | leaked | ||
|
Published SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA Family law firm, established 1995 by Victor A. Shaheen. Now run by his three sons. 48 employees across four offices: Richmond, Midlothian, Virginia Beach, Newport News. What do they do? They close 150+ real estate transactions EVERY MONTH for some of the largest corporate relocation programs in America. When a Fortune-500 moves an employee to Virginia, this firm holds that employee's Social Security Number, bank wiring details, home address, family identities, and sometimes their medical clearance. They hold everyone's future in a shared folder. We now hold the folder. WHAT WE TOOK 36,788 files · 27GB · 21,789 fully read 67,000+ SSN patterns (their own dedup says 6,017 real people — we will let their customers decide which number to believe) https://www.shaheenlaw.com/ View Online |
||||||
| Ransomware | FBC id33929 | South Africa | Retail / E-commerce | pending | ||
|
Published FBC Furniture Bargaining Council in South Africa. This is the tariff council for the furniture, mattress and upholstery industry.The platform serves employers and employees in the industry in regions such as Gauteng, North West, Mpumalanga, Limpopo and the Free State to handle legal and administrative processes. 186,207 files (incl. 58,000+ scanned documents), structured as: 47,749 unique SA ID numbers 39,014 bank account records 10,498 salary/payment values 28,175 pension fund records 20,420 payroll files 13,209 medical aid records 20,661 dispute/arbitration files — including unpublished award drafts and settlement discussions Full staff list with personal email addresses, and personal folders of employees https://fbcweb.furnbed.co.za/ View Online |
||||||
| Ransomware | UNION FA id33942 | Greece | Other | pending | ||
|
Published UNION FA rogdianakis.gr leads to (or is directly related to) the company Union FA (Union Financial Associates) , which is owned by Giorgos Rogdianakis (CEO of the company). This is a company that provides accounting, tax and consulting services to businesses. rogdianakis.gr View Online |
||||||
| Ransomware | Far West Contractors id33941 | United States | — | pending | ||
|
Publishes after: 0d 16h 46m Far West Contractors Far West Contractors is a commercial construction company and general contractor headquartered in Placentia, California Founded in 2009, the company specializes in SCIF(Sensitive Compartmented Information Facilities) construction projects for high-security facilities, as well as tenant improvements in the aerospace and defense industry. Their well-known project partners and clients include Boeing, Jet Propulsion Laboratory (JPL), and Northrop Grumman https://farwestcontractors.com |
||||||
| Ransomware | Greggio Argento id33940 | Italy | Services | pending | ||
|
Coming soon Greggio Argento Greggio Argento is a long-established Italian family business founded in 1948 in Sarmeola di Rubano (Padua). https://greggio.com/ https://temp.sh/PoaaZ/Data_list.txt - 500GB |
||||||
| Ransomware | Saber1 id33939 | United States | — | pending | ||
|
Published Saber1 Saber1 Technologies LLC is a American supplier and distributor of machine vision components, industrial cameras and image processing systems. https://saber1.com/ View Online View Online View Online |
||||||
| Ransomware | idi pharma id33938 | India | — | leaked | ||
|
Published idi pharma idi pharma is an Italian pharmaceutical company specializing in the research and development of innovative nutraceuticals and medical devices. The company focuses on formulations covered by patents and unique dosage technologies to improve patient health and quality of life (but their data leak). https://www.idipharma.com/ View Online |
||||||
| Ransomware | Aeroklas Duys / Duys Engineering Group id33937 | South Africa | — | pending | ||
|
Publishes after: 5d 2h 9m Aeroklas Duys / Duys Engineering Group Aeroklas Duys (Pty) Ltd a specialized automotive manufacturing company It was formed as a strategic joint venture between the Duys Engineering Group and Aeroklas (a prominent global automotive accessory manufacturer owned by the Eastern Polymer Group of Thailand). Duys Engineering Group an industrial and mechanical engineering firm founded in South Africa in 1960. https://aeroklasduys.co.za https://duys.co.za https://duysgroup.com |
||||||
| Ransomware | Aeroklas Duys / Duys Engineering Group id33785 View details | South Africa | — | leaked | ||
|
Aeroklas Duys (Pty) Ltd a specialized automotive manufacturing company It was formed as a strategic joint venture between the Duys Engineering Group and Aeroklas (a prominent global automotive accessory manufacturer owned by the Eastern Polymer Group of Thailand). Duys Engineering Group an industrial and mechanical engineering firm founded in South Africa in 1960. |
||||||
| Ransomware | Saber1 id33662 View details | United States | — | leaked | ||
|
Saber1 Technologies LLC is a American supplier and distributor of machine vision components, industrial cameras and image processing systems. |
||||||
| Ransomware | idi pharma id33663 View details | Spain | — | leaked | ||
|
idi pharma is an Italian pharmaceutical company specializing in the research and development of innovative nutraceuticals and medical devices. The company focuses on formulations covered by patents and unique dosage technologies to improve patient health and quality of life (but their data leak). |
||||||
| Ransomware | Greggio Argento id33513 View details | Italy | Services | leaked | ||
|
Greggio Argento is a long-established Italian family business founded in 1948 in Sarmeola di Rubano (Padua). https://temp.sh/PoaaZ/Data_list.txt - 500GB |
||||||
| Ransomware | UNION FA id33391 View details | Greece | Other | pending | ||
|
rogdianakis.gr leads to (or is directly related to) the company Union FA (Union Financial Associates) , which is owned by Giorgos Rogdianakis (CEO of the company). This is a company that provides accounting, tax and consulting services to businesses. |
||||||
| Ransomware | Far West Contractors id33392 View details | United States | — | leaked | ||
|
Far West Contractors is a commercial construction company and general contractor headquartered in Placentia, California Founded in 2009, the company specializes in SCIF(Sensitive Compartmented Information Facilities) construction projects for high-security facilities, as well as tenant improvements in the aerospace and defense industry. Their well-known project partners and clients include Boeing, Jet Propulsion Laboratory (JPL), and Northrop Grumman [url=farwestcontractors.com]farwestcontractors.com[/url] |
||||||
| Ransomware | SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA id32088 View details | United States | Finance / Legal / Insurance | — | leaked | |
|
Family law firm, established 1995 by Victor A. Shaheen (†2025 - the General Assembly of Virginia honored him with a resolution; google it, it is touching). Now run by his three sons. 48 employees across four offices: Richmond, Midlothian, Virginia Beach, Newport News. What do they do? They close 150+ real estate transactions EVERY MONTH for some of the largest corporate relocation programs in America. When a Fortune-500 moves an employee to Virginia, this firm holds that employee's Social Security Number, bank wiring details, home address, family identities, and sometimes their medical clearance. They hold everyone's future in a shared folder. We now hold the folder. WHAT WE TOOK 36,788 files · 27GB · 21,789 fully read 67,000+ SSN patterns (their own dedup says 6,017 real people — we will let their customers decide which number to believe) EVIDENCE — SERIES PREVIEW (from their actual files) - S1 DEEDS WITH SOCIAL SECURITY NUMBERS File: "5053815 - Unsigned Deed.docx" (verbatim from their server): "***-**-XXXX B•••• H••• Social Security Number ***-**-XXXX J••••• H••• Social Security Number 10356 Ashburn Road, North Chesterfield, VA 23235" File: "Kelley 5042085 - DEED.docx": "PURCHASER(S): N••••• S••• SELLER'S NAME: S••• E. K•••• SS#: ***-**-XXXX ...including the withholding of twenty percent (20%) of the sales proceeds." ← FIRPTA: foreign sellers. IRS will want this list. We have it. Thousands of these. Every deed folder = a name, a number, an address, a transaction. Their client roster IS the leak. - S3 INSIDE THEIR BANKING & THEIR NETWORK File: "shared_Accounting/Banking/Other Banking/Shaheen DDA Statements SunTrust DDA" (email from SunTrustOnlineCourier to their own staff — headers verbatim): Received: from barracuda.shaheenlaw.com ([10.0.0.6]) by ricdcex1.shaheenlaw.com ... X-ASG-Debug-ID: 1291233029-... for ; Wed, 1 Dec 2010 Why we publish an email HEADER: their internal map is in it. Barracuda at 10.0.0.6. Exchange "ricdcex1". Domain SHAHEENWORLD. We did not forget how to enter. Neither will the next group, when we sell the map. 150 banking statement attachments ride along in this folder. - S5 THE CLIENT LIST, WRITTEN IN FOLDERNAMES They named folders after their customers. Verbatim paths: shared_PENDING_SALE/HENNY/Closed Files/ Wisniewski-Markel, Suzanne_5027384_12263 Eagle ... Merza, Jamal & Adrienne_5027826_811 Woodberry ... Name, file number, STREET ADDRESS — in the path itself. Marketing lists sell for money. This one is annotated with purchase history. Relocation buyers are premium leads. - S2 MEDICAL - S4 LITIGATION Held. 120 medical files exist (their own audit counted them). Litigation: we confirm their December escrow dispute is public (Porchlight Homes v. Almeida & Shaheen, Henrico — google it, BizSense covered it). Virginia residents: §18.2-186.6. Illinois relocations: BIPA. Opposing counsel and journalists: samples on request. Media & researchers: samples on request, we answer fast We keep our word to everyone who pays. We keep it also to everyone who does not. |
||||||
| Ransomware | FBC id32089 View details | South Africa | Retail / E-commerce | — | leaked | |
|
Furniture Bargaining Council in South Africa. This is the tariff council for the furniture, mattress and upholstery industry.The platform serves employers and employees in the industry in regions such as Gauteng, North West, Mpumalanga, Limpopo and the Free State to handle legal and administrative processes. |
||||||
| Ransomware | JP Molyneux Studio id31867 View details | United Kingdom | — | leaked | ||
|
JP Molyneux Studio Ltd showcases the exclusive work of internationally renowned interior designer Juan Pablo Molyneux. |
||||||
| Ransomware | UFOC id31875 View details | Taiwan, Province of China | — | — | leaked | |
|
United Fiber Optic Communication Inc. (UFOC) is an established, publicly traded telecommunications company from Taiwan. The company acts as a total solution provider for communication networks and specializes in the manufacture of fiber optic cables and the provision of integrated technological systems. |
||||||
| Ransomware | Global Terminal Services id31876 View details | Türkiye | — | leaked | ||
|
GTS legally registered as Global Terminal Hizmetleri A.Ş. It is the largest independent storage terminal for liquid fuels and oil in the entire Mediterranean region. 470gb |
||||||
| Ransomware | LT Group / Fortune Tobacco Corp id31551 View details | Philippines | — | — | leaked | |
|
Amount: 27 GB | Files: 14,836 They ignored our messages for 72 hours.. Now we publish the details of the breach. Data leaked: 107 Passports (MRZ) 1,712 Bank Statements (PNB + Holco USD accounts) 212 Promissory Notes (Eton Properties, PHP 2.53B debt) 231 BIR/eFPS credentials Samples: Passport_Johnny_Tan.pdf Holco_USD_Statement.pdf Eton_Debt_212.pdf Full leak: August 18. Contact: Session ID provided in emails. Pay for the data or pay for its permanent deletion. Otherwise, the full dump will be public. |
||||||
| Ransomware | AHENK lab id31021 View details | Türkiye | IT | — | leaked | |
|
Ahenk Laboratuvarı is an ISO 15189-accredited medical laboratory in Turkey, founded in 1998 and located in Istanbul-Şişli. The company offers services in clinical biochemistry, microbiology, pathology, and genetics, and collaborates with Limbach Laboratories in Germany. |
||||||
| Ransomware | DIATER id31011 View details | Spain | Healthcare / Pharma | — | leaked | |
|
(Laboratorio de Diagnóstico y Aplicaciones Terapéuticas, SA), a Spanish biopharmaceutical company founded in 1999 and headquartered in Madrid.The company specializes in the research, development and manufacture of products for allergy diagnostics and allergen immunotherapy (ASIT). |
||||||
| Ransomware | Pasello id31012 View details | Italy | IT | — | deleted | |
|
Pasello Trattamenti Termici Srl , an Italian specialist company for the heat treatment of metal alloys. |
||||||
| Ransomware | Takis srl id31007 View details | Italy | Manufacturing / Engineering | — | leaked | |
|
Takis Biotech is an Italian biotechnology company founded in 2009 and headquartered in Rome. The company specializes in contract research (R&D services), preclinical immunology, and the development of genetic vaccines and therapeutic antibodies. |
||||||
| Ransomware | Hardware Asesorias Software Ltda id30967 View details | Chile | — | — | pending | |
|
Hardware Asesorías Software Ltda (HAS Ltda) is a technology provider based in Bucaramanga, Colombia, specializing in the distribution of hardware and software licenses . The company acts as an official partner for brands such as Apple, Adobe, and HP, serving business customers, government agencies, and engineering firms. |
||||||
| Ransomware | Tesco Engineer id30968 View details | Thailand | — | — | pending | |
|
Tesco Engineer Co., Ltd. is a Thai construction and manufacturing company based in Bangkok, operating in civil engineering and industrial pipe manufacturing since 1976. |
||||||
| Ransomware | High Class Car Limo id30931 View details | United States | Transportation / Travel / Logistics | — | pending | |
|
High Class Limousine & Car Service Corp. is a licensed private passenger transportation service in New York City, founded in 1995, specializing in non-emergency medical transportation . The company provides rides to medical appointments, dialysis sessions, and rehabilitation facilities, and has locations in Manhattan and the Bronx. |
||||||
| Ransomware | West African Resources ltd id30934 View details | Australia | — | — | pending | |
|
West African Resources Limited (ASX: WAF) isan Australia-based, mid-tier gold mining and exploration companywith its primary operations located in Burkina Faso, West Africa . Founded in 2006, the company is headquartered in Subiaco, Western Australia, and focuses on the acquisition, development, and mineral processing of high-grade gold assets. |
||||||
| Ransomware | Caspian One id30935 View details | Azerbaijan | — | — | deleted | |
|
Caspian One is an international provider of IT services and specialist talent for industries such as FinTech investment banking and broadcasting. Based in England the company offers professional recruitment and managed technology solutions and operates in Europe and North America. |
||||||
| Ransomware | Schaad, Balass, Menzl and Partner AG id30860 View details | Switzerland | Other | leaked | ||
|
SBMP (Schaad Balass Menzl & Partner AG) is a specialized Swiss IP boutique with offices in Zurich and Winterthur, offering comprehensive services in patent law, trademark law, and design protection. With over 50 years of experience and a team of lawyers and technical experts, the firm supports companies across all industries, from filing to enforcement. |
||||||
| Ransomware | HİDROMEK id30861 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
HİDROMEK is a leading Turkish manufacturer of heavy construction machinery recognized globally for its high-performance award-winning heavy equipment. Founded in Ankara in 1978 by mechanical engineer Hasan Basri Bozkurt the company operates six state-of-the-art production facilities across Turkey and Thailand. Its heavy machinery operates in more than 130 countries spanning six continents. Over 880 gigabytes of sensitive internal data were stolen from this company |
||||||
| Ransomware | KEMEK id30862 View details | Lithuania | Manufacturing / Engineering | pending | ||
|
KEMEK Engineering a leading technology and automation company in the Baltics The company was founded in 1995 and develops customized solutions for industrial companies. |
||||||
| Ransomware | KeNHA id30852 View details | Kenya | Public Sector | pending | ||
|
The Kenya National Highways Authority (KeNHA) agency responsible for the construction, management, and maintenance of national highways (classes S, A, and B) in Kenya. |
||||||
| Ransomware | BioResearch id30853 View details | Poland | Healthcare / Pharma | pending | ||
|
BioResearch Group to Warsaw clinical research center specializing in early phases (I, FIH, SAD, MAD) and bioequivalence studiesThe company offers comprehensive services for the pharmaceutical and CRO sectors, with its own clinic and laboratory. |
||||||
| Ransomware | Relesa id30854 View details | Argentina | Retail / E-commerce | pending | ||
|
Grupo Relesa a multinacional Spanish company specializing in the fabrication and summary of rejillas metálicas (tramex). The main function is the digital platform and the client portal of Reginald Lee SA, one of the official distributors of more important products of Coca-Cola in Argentina. |
||||||
| Ransomware | Carrier AB id30855 View details | Sweden | Manufacturing / Engineering | pending | ||
|
Carrier Transport AB a Swedish transport and logistics company headquartered in Jordbro near Stockholm. |
||||||
| Ransomware | Enedo Power id30856 View details | Finland | Energy | pending | ||
|
Enedo Power (company renamed Inission Power) develops high-quality, intelligent power supply systems for critical infrastructure and industrial applications. The company, part of the Swedish Inission Group with Finnish roots, focuses on robust power supplies, power systems, and LED drivers for industries such as defense and railway technology. |
||||||
| Ransomware | CNA id30857 View details | Italy | Services | pending | ||
|
CNA Toscana Centro a trade association that provides services and protection to artisans and businesses in the provinces of Prato and Pistoia. The portal manages union representation, tax services, the EPASA-ITACO welfare association, and supports business development and digitalization. |
||||||
| Ransomware | Vinilon id30858 View details | Chile | Manufacturing / Engineering | — | pending | |
|
Vinilon Group one of the leading manufacturers and distributors of pipe systems in Indonesia. |
||||||
| Ransomware | Aldaco Avance 2022 S.L. id30507 View details | Spain | Construction / Real Estate | — | pending | |
|
Aldaco is a Spanish company specializing in industrial engineering, construction materials, civil engineering, mining and labor security, with seats in Asturias, Galicia and Madrid. The company distributes machines and technical tools, offers specialized asesoramients and support for professional projects. |
||||||
| Ransomware | Catcorp id30421 View details | — | Other | — | pending | |
|
Business direction: Mew mew |
||||||
| Ransomware | Weinberg ''93 Építő Kft. id30422 View details | Hungary | Other | pending | ||
|
Weinberg ''93 Építő Kft., a prominent Hungarian construction and steel fabrication company. Overview: Founded in 1993 and headquartered in Sбrospatak, it is a 100% privately owned Hungarian company. Core Services: The firm specializes in general contracting and the manufacture of complex steel structures. Major Projects: They have handled significant industrial developments, including: - Volvo Trucks Hungary: Completed a 5,500 mІ advanced truck center in Ecser. - Continental Automotive: Construction of electronics manufacturing plants. - East Gate PRO Business Park: Developed BREEAM-certified sustainable warehouses. - Becton Dickinson: Expansion of a major syringe factory in Hungary. Recognitions: The company has received numerous awards, such as the Lechner Цdцn Award (2024) and the Steel Structure Award (2022). Over 650 gigabytes of sensitive internal data were stolen from this company: all commercial information about contractors, information about specialized construction technologies and metal structure production, internal financial transactions, and operations demonstrating corruption in construction projects. We invite all journalists, lawyers, and law enforcement agencies to review this information. |
||||||
| Ransomware | The Morton Grove Park District id30423 View details | United States | Services | pending | ||
|
The Morton Grove Park District (MGPD) is a separate municipal agency established in 1951, governed by five elected commissioners and subject to Illinois state laws. Their motto is: Everyone who lives in, works in, or visits Morton Grove has constitutional rights, no matter their citizenship or immigration status. The Village is committed to making sure every person feels safe, supported, and respected. More than 50 GB of data containing personal and sensitive information belonging to both internal employees and the organization's clients and suppliers. Documents on financial plans and internal policies are protected by a non-disclosure policy. (Including racist and sexist insights) We invite all journalists, lawyers, and law enforcement agencies to review this information. |
||||||
| Ransomware | LA SEVILLANITA SRL id30424 View details | Argentina | Retail / E-commerce | pending | ||
|
LA SEVILLANITA is the leading transport company in Argentina. |
||||||
| Ransomware | Schlenker and Cantwell, P.A. id30425 View details | United States | IT | pending | ||
|
Schlenker & Cantwell, P.A. is a certified public accounting firm based in the USA, offering services such as tax preparation and planning, auditing and assurance, bookkeeping, payroll, financial reporting, consulting, and estate-trust management. |
||||||
| Ransomware | WiBeats S.r.l. id30426 View details | Italy | IT | pending | ||
|
WIBEATS is one among the last few independent Italian Asset Management and Loans Service group, specialised performing and non performing real estate. Over 150 gigabytes of internal email datastore were stolen from this company. more than 50 GB of internal sensitive data containing contracts and official papers containing construction and renewal permits |
||||||
| Ransomware | Grupo Vanguardia id30427 View details | Mexico | Construction / Real Estate | pending | ||
|
Grupo Vanguardia is an automotive group |
||||||
| Ransomware | WH Müller id30428 View details | Germany | Education | pending | ||
|
WH Müller is a family business in the field of electrical engineering and IT technology. |
||||||
| Ransomware | DOCTUS USA Inc id30429 View details | United States | Healthcare / Pharma | pending | ||
|
Doctus offers top-tier medical records services in the USA, specializing in the management and organization of medical documentation. |
||||||
| Ransomware | ACU - The Automobile Club of Uruguay id30430 View details | Uruguay | NGOs / Associations | pending | ||
|
[AI generated] The Automobile Club of Uruguay (ACU) is a nonprofit organization based in Uruguay that provides services to motorists and travelers. It offers roadside assistance, vehicle inspections, travel planning, and tourism-related services. Operating within the automotive services and transportation industry, ACU also promotes road safety and mobility across Uruguay. It maintains affiliations with international automobile club networks, extending member benefits abroad. |
||||||
| Ransomware | CIATI id30431 View details | Argentina | IT | pending | ||
|
CIATI is a technology center dedicated to providing analytical services, technical assistance, and research and development for the food, geochemistry, and environmental industries. |
||||||
| Ransomware | Quetzal Química id30432 View details | Mexico | Manufacturing / Engineering | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Abhay Prabhavana id30433 View details | India | NGOs / Associations | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Güven Mühendislik Makina id30434 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | 3Gi Solutions, is an IT Services Provider located in Montreal, Quebec. id30435 View details | Canada | IT | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Werken Química Brasil S.A. id30436 View details | Brazil | IT | pending | ||
|
Werken Química Brasil S.A. is a company specializing in the development and supply of chemical products, headquartered in Indaial, Santa Catarina. It operates primarily within the textile industry, offering solutions for pretreatment, dyeing, printing, yarn lubrication, and effluent treatment, with a focus on functional technologies. |
||||||
| Ransomware | Židlochovice city id30437 View details | Czechia | Public Sector | pending | ||
|
Internal city administration documents have been leaked. Personal data from the database will be sold on darknet forums. Mayor 'Jan Vitula' claims the attack was prevented and no data was stolen. An investigation has been launched with the police, and countermeasures are being taken. =) xD In press: https://www.denik.cz/regiony/zidlochovice-hackeri-kyberneticky-utok-vykupne-data-software-ransomware-kldr.html https://www.irozhlas.cz/zpravy-domov/poslete-bitcoiny-nebo-vas-nepustime-k-datum-urad-v-zidlochovicich-zjistuje-skody_2603172012_bva https://www.***.cz/cs/aktuality/dulezite-upozorneni-mimoradne-uzavreni-meu.html Over 150 gigabytes of internal data |
||||||
| Ransomware | BARCELONA URBAN PROPERTY CHAMBER id30438 View details | Spain | IT | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Optimal Care SA id30439 View details | Argentina | — | pending | ||
|
Optimal Care Sociedad Anonima manufactures cleaning applications. The Company offers wet wipes for personal care, baby wipes, make-up remover, multipurpose wipes, and cleaning applications. Optimal Care serves customers in Spain. |
||||||
| Ransomware | Anidaport - Investimentos Imobiliários Lda., Lisbon, Portugal id30440 View details | Portugal | — | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | LIVISTO id30441 View details | Poland | — | pending | ||
|
LIVISTO is an international pharmaceutical company with extensive experience in the veterinary market. |
||||||
| Ransomware | Industrie Tecnologiche it id30442 View details | Italy | — | pending | ||
|
Industrie Tecnologiche is a software development center for the food industry. |
||||||
| Ransomware | VBW Makelaars and Taxateurs id30443 View details | Netherlands | NGOs / Associations | pending | ||
|
VBW Makelaars & Taxateurs specializes in real estate and property valuations in the Netherlands. Real estate agency and certified appraisers |
||||||
| Ransomware | Eko-Flor Plus d.o.o. id30444 View details | Croatia | — | pending | ||
|
Eko-Flor Plus d.o.o. is the largest private waste management company in Croatia. Headquartered in Oroslavje, the company specializes in collecting, sorting, and processing municipal and non-hazardous waste. |
||||||
| Ransomware | Zaffrani Srl id30445 View details | Italy | — | pending | ||
|
Zaffrani Srl, an Italian manufacturer specializing in advanced agricultural machinery. Founded in 1959, the company is headquartered in the Marche region of Italy and has become a global leader in crop harvesting and drying technology. |
||||||
| Ransomware | Grupo Mercurio id30446 View details | Mexico | — | pending | ||
|
Grupo Mercurio is a leading Mexican business conglomerate primarily recognized for its dominance in the bicycle and sports industry. Based in San Luis Potosí, the group operates one of the largest bicycle manufacturing plants in Mexico. |
||||||
| Ransomware | Maxplast AND Senoco id30447 View details | Türkiye | — | pending | ||
|
Senoco Tekstil Sanayi ve Ticaret A.Ş., a Turkish company specializing in the production of nonwoven fabrics. Maxplast is a Turkish manufacturing company based in Gaziantep that specializes in plastic packaging and houseware solutions. Founded in 2016, the company produces a wide range of PET and PE containers for various industries, including food, cosmetics, agriculture, and chemistry. https://www.maxplast.com.tr/ |
||||||
| Ransomware | Gerusia S.L. id30448 View details | Spain | — | pending | ||
|
Gerusia S.L., a Spanish service company headquartered in Oviedo, Asturias. Founded in 1995 and managed by women, the company provides a wide range of cleaning, auxiliary, and social-sanitary services for both public and private sectors throughout the Asturias region. |
||||||
| Ransomware | Elmoris id30449 View details | Lithuania | — | pending | ||
|
Founded in 1996 in Vilnius, Lithuania, UAB Elmoris is a major manufacturer specializing in light metal packaging and "twist-off" lug caps for the food industry. The company is noted for producing PVC-free, environmentally friendly caps and providing metal printing services, holding AEO certification for international trade. |
||||||
| Ransomware | ONE Contact id30450 View details | Sweden | — | pending | ||
|
ONE Contact is a Swedish-managed contact center located in Barcelona, Spain, offering customer service, telemarketing, and retention strategies targeted at the Scandinavian market. Services include 1st/2nd line support and digital customer service solutions, with a physical office located on Calle Padilla in Barcelona. |
||||||
| Ransomware | Consulting Valladolid id30451 View details | Spain | — | pending | ||
|
Consulting Valladolid S.A. is a professional firm with over 40 years of experience providing comprehensive legal, tax, labor, and accounting services in Valladolid, Spain. The firm utilizes advanced technology to deliver tailored advisory solutions for both companies and individuals |
||||||
| Ransomware | ADM Value Barcelona id30452 View details | Spain | — | pending | ||
|
ADM Value is a leading international company specializing in outsourced customer relationship management (CRM) and Business Process Outsourcing (BPO) |
||||||
| Ransomware | Ring Textile Production RTP SRL id30453 View details | — | — | pending | ||
|
rtpbz.ro is the official domain for Ring Textile Production RTP SRL, a Romanian textile manufacturing company based in Buzău. Industry: Manufacture of outerwear and tricot clothing, specializing in women's nightwear, underwear, and cotton/linen apparel. |
||||||
| Ransomware | Bombas Ideal id30454 View details | Brazil | — | pending | ||
|
Bombas Ideal is a Spanish manufacturer established in 1902 specializing in water pumps and pressure systems for agricultural, industrial, and fire protection applications. Based in Valencia, the company offers a range of vertical, submerged, and solar pumping solutions with international operations. |
||||||
| Ransomware | SH Hoteles (Spain) id30455 View details | Spain | — | pending | ||
|
This chain operates various urban and beach properties primarily in the Valencia and Alicante regions. Key Properties: SH Valencia Palace: A 5-star hotel located near the city center of Valencia. SH Villa Gadea: A luxury resort in Altea known for its extensive Thalasso-Spa facilities. SH Inglés: A boutique hotel situated in a renovated 18th-century palace in Valencia's historical center. Other locations: Includes properties in Jávea, Denia, and Gandía |
||||||
| Ransomware | Bridgeport S.p.A. id30456 View details | Italy | — | pending | ||
|
Bridgeport a leading Italian manufacturing company specializing in the production of valves for air, gas, and fluids. |
||||||
| Ransomware | AKSV id30457 View details | Denmark | — | deleted | ||
|
AK Service & Vedligehold is a Hillerød-based contractor providing construction, maintenance, and energy solutions across Zealand, Denmark. The company specializes in electrical work, heat pumps, charging stations, carpentry, and masonry services. |
||||||
| Ransomware | EFCA id30458 View details | Germany | — | pending | ||
|
EFCA a specialized accounting firm based in Paris, France. Core Expertise With over 30 years of experience, the firm specializes in real estate accounting and property management. Key services and areas of focus include: Property Management Support: Expertise in managing accounts for property administrators and real estate agencies. Trustee & Agent Accounting: Mastery of "comptabilité mandants" (client/trustee accounting) and navigating relationships with guarantee funds. Tax & Advisory: Handling complex tax and accounting issues specific to the real estate market. |
||||||
| Ransomware | Starconn id30459 View details | Taiwan, Province of China | — | pending | ||
|
Starconn (registered as Chief Land Electronic Co., Ltd.) is a top-five connector manufacturer based in Taiwan. Founded in 1978, the company specializes in high-precision connectors for telecommunications, data centers, and consumer electronics. Core Products & Services Connectors: They produce a wide range of connectors, including high-speed backplane (up to 25Gbps), FPC, and EDSFF E1.S connectors. Target Markets: Their components are used in desktops, laptops, LCD panels, servers, storage, and networking equipment. Manufacturing Capabilities: The company integrates plastic mold tooling, micro-injection molding, and automated assembly. Technical Services: They offer R&D partnerships for custom system designs, utilizing CAE software for mechanical and signal integrity simulations. Company Details Headquarters: Wugu District, New Taipei City, Taiwan. Presence: They have significant operations and certifications (ISO 9001, IATF 16949) in both Taipei and Kunshan, China. Intellectual Property: As of 2022, they held over 500 patents. |
||||||
| Ransomware | Picassent id30460 View details | Spain | — | pending | ||
|
Ayuntamiento de Picassent (Picassent City Council), a municipality located in the Horta Sud region of Valencia, Spain. |
||||||
| Ransomware | UFL id30461 View details | Papua New Guinea | — | pending | ||
|
United Finance Limited (UFL) is a 100% nationally owned financial institution based in Papua New Guinea. Registered in 2017 and fully established in April 2019, the company provides personal and commercial lending services designed to assist individuals and small businesses with quick access to capital. |
||||||
| Ransomware | FIRESTA id30462 View details | Czechia | — | pending | ||
|
Firesta-Fišer, a.s. is a Czech construction company based in Brno, established in 1990, specializing in transport infrastructure, including bridge, road, and railway construction. With over 600 employees, the company also operates in Slovakia, Poland, and Romania. |
||||||
| Ransomware | GEOPARTNER Sp. z o.o. and GEOPARTNER GEOMATICS Sp. z o.o. id30463 View details | Poland | IT | pending | ||
|
Geopartner Geomatics Sp. z o.o. is a Gdańsk-based engineering firm specializing in advanced surveying, mapping, and BIM services for the infrastructure sector. The company utilizes LiDAR scanners and drones to support road and rail projects, operating in the Polish and Swedish markets. GEOPARTNER Sp. z o.o. is a Polish engineering firm specializing in geophysical and geotechnical services, primarily focused on investigating ground conditions for energy, infrastructure, and mining projects. |
||||||
| Ransomware | JOSO id30464 View details | Norway | Other | pending | ||
|
JOSO, a Norwegian industrial engineering and manufacturing company. Based in Lonevåg, Norway, the company specializes in producing high-quality mechanical components and hardware. |
||||||
| Ransomware | Integra and Operosa id30465 View details | Italy | Manufacturing / Engineering | pending | ||
|
The leaked files will be available for download on May 10, 2026. C.A.A. "Giorgio Nicoli" S.r.l. Integra S.r.l L'Operosa S.p.A. |
||||||
| Ransomware | 8.2 Group e.V. id30466 View details | Germany | IT | deleted | ||
|
8.2 Group an international network of over 40 independent engineering firms specializing in technical inspection, consulting, and engineering for renewable energy projects. Headquartered in Germany, the group provides services throughout the lifecycle of wind, solar, and battery storage projects worldwide. |
||||||
| Ransomware | PB Sprinkler Engineering Sp. z o.o. and PLISZKA Fire Protection Engineering id30467 View details | Poland | Retail / E-commerce | pending | ||
|
PB Sprinkler Engineering (formerly Pliszka Sprinkler) provides comprehensive fire protection solutions, including technical design in 2D and 3D, and customized, certified systems. The company specializes in electronic detection and fixed gas extinguishing systems. Pliszka is a Polish engineering firm based in Gdańsk with over 30 years of experience specializing in comprehensive active fire protection systems. The company provides design, installation, and maintenance services for automatic extinguishing, fire alarm, and smoke removal systems, along with 24/7 service. |
||||||
| Ransomware | SKK Networks Sp. z o.o. and UNICARD Systems Sp. z o. o. and SKK SA id30468 View details | Poland | Telecommunications | pending | ||
|
SKK Networks is a specialized IT infrastructure provider based in Kraków, Poland, that designs, builds, and maintains professional LAN and WLAN networks. They focus on creating high-performance connectivity solutions for challenging environments like high-bay warehouses, cold storage facilities, and industrial plants. Unicard Systems is a Polish manufacturer and integrator of security and building automation systems with over 30 years of experience. Based in Kraków, the company specializes in designing and implementing proprietary hardware and software solutions for business and public infrastructure. SKK Labels , a prominent Polish label manufacturer and printing company based in Kraków. With over 30 years of experience, the company provides comprehensive product marking solutions across various industries, including pharmaceutical, automotive, and logistics. |
||||||
| Ransomware | Dyhrberg AG Switzerland id30469 View details | Switzerland | Finance / Legal / Insurance | pending | ||
|
[AI generated] N/A |
||||||
| Ransomware | Grupolider | Grupo Actual id30470 View details | Angola | Construction / Real Estate | pending | ||
|
The leaked files will be available for download on May 10, 2026. Grupolider is a prominent Angolan conglomerate that has been operating in the national market since 1999. Headquartered in Catete, Luanda, the group initially started as a freight forwarding company and has since diversified into a wide range of sectors including agriculture, construction, and furniture. Grupo Actual is a human resources and recruitment agency in Portugal that provides temporary work solutions, permanent recruitment, and selection services.Following a rebranding in late 2025, the company formerly known as Leader now operates under the Actual brand. |
||||||