Ransomware Group intelligence

Dragonforce

Active

Track Dragonforce with 672 published victims and 5 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 672 Known published victims in this dataset

First discovered 2023-12-13 Earliest victim discovery date

Last discovered 2026-10-14 Latest victim discovery date

Inactive since 2 days Days since the latest known victim

Top country United States 313 victims

Known locations 5 Leak or negotiation infrastructure tracked

Dragonforce is tracked by Breach House as a ransomware group with 672 published victims.

United States is currently the most targeted country in this dataset.

5 known leak locations are currently associated with this group.

672

Leaked 138 20.5%
Pending 534 79.5%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 5	Onion service	Up checked 4h ago	`xjhmtitnrdrgzw4vmsghirdoo2fk35a3tzj4enlmah4pvehdspydsiyd.onion`
Leak location 1	Onion service	Up checked 4h ago	`z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion`
Leak location 2	Onion service	Down checked 4h ago	`3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion`
Leak location 4	Onion service	Down checked 4h ago	`dragongoztkdfmnd7jkchznd3fvkpdmeh4vhbt6p3usrlsoy5dw2bhyd.onion`
Leak location 3	Onion service	Down checked 4h ago	`dragonforxxbp3awc7mzs5dkswrua3znqyx5roefmi4smjrsdi22xwqd.onion`

Communication / Marketing 130
Manufacturing / Engineering 91
Finance / Legal / Insurance 71
Services 58
IT 47
Construction / Real Estate 45
Healthcare / Pharma 37
Hospitality / Food & Beverage / Tourism 25
Not identified 24
Retail / E-commerce 22
Energy 22
Transportation / Travel / Logistics 20
Public Sector 20
Education 14
Agriculture / Food 13
NGOs / Associations 12
Telecommunications 10

Typical Attacks (10)

▼

MITRE ATT&CK does not currently catalogue Dragonforce, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.

T1059.001 PowerShell Execution

What they do: dragonforce executes malicious payloads via PowerShell scripts injected into legitimate processes for command execution.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1685 Disable or Modify Tools Defense Impairment

What they do: dragonforce disables antivirus tools by terminating security processes and modifying Windows Defender settings.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1027.002 Software Packing Stealth

What they do: dragonforce packs its malware binaries to evade static detection by security tools.

What that means: Adversaries may perform software packing or virtual machine software protection to conceal their code.
T1070.004 File Deletion Stealth

What they do: dragonforce deletes Volume Shadow Copies via vssadmin /delete shadows to prevent rollback recovery.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1110 Brute Force Credential Access

What they do: dragonforce brute-forces local accounts using Hydra to obtain credentials for initial access.

What that means: Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained.
T1018 Remote System Discovery Discovery

What they do: dragonforce discovers remote hosts via SMB enumeration to identify high-value targets across networks.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1135 Network Share Discovery Discovery

What they do: dragonforce scans network shares using net use commands to discover victim file structures for targeting.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1021.002 SMB/Windows Admin Shares Lateral Movement

What they do: dragonforce moves laterally through SMB shares using mapped drives to access additional systems.

What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
T1486 Data Encrypted for Impact Impact

What they do: dragonforce encrypts victim files using a custom ransomware binary with AES-256 encryption keys.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1490 Inhibit System Recovery Impact

What they do: dragonforce runs system shutdown commands to prevent recovery attempts and maximize disruption.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.

Tools Observed (20)

▼

Software Dragonforce has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

LaZagne Mimikatz

Defense evasion

ADVobfuscator Darkside/TrueSight driver (BYOVD) Hangzhou Shunwang Technology driver (BYOVD) PCHunter ProcessHacker

Discovery

AdFind Advanced IP Scanner PingCastle SoftPerfect NetScan

Discovery & enumeration

AdFind Advanced IP Scanner PingCastle SoftPerfect NetScan

Exfiltration

MEGA RClone

LOLBAS (living-off-the-land binaries)

PsExec

OffSec

Cobalt Strike

Offensive security tooling

Cobalt Strike

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Ransom Notes (2)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

readme.xt txt · 1966 chars

Good afternoon,

As you can see you have been attacked by a ransomware program! We The DragonForce Ransomware Cartel offer you to make a deal with us. We can make a deal with you, all you need to do is contact us by following the instructions below.
We are in no way connected to politics, we always keep our word. You have a chance to decrypt your files and avoid being published on our blog! Use this opportunity and also don't waste your time.
The approximate date of deletion of the decryptor program, as well as publication on our blog 26/04/2025 00:00 UTC.

- # 1 Communication Process,

In order to contact us you need to click on the special link below, which is listed in #2.
After that the negotiation process begins, in which you have the opportunity to request several things from us,

1. make a test decrypt.
2. get a list of the files stolen from you.

At the conclusion of our negotiations we agree on a price, we set the price ourselves based on your income/your insurance.
We scrutinize your documents and are well aware of how much income your company has per year.

- # 2 Access to the meeting room,

To access us please download Tor Browser which is available here. (https://www.torproject.org/)
Once you download the special anonymous browser you need to follow this link, http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
Your unique ID: [snap] - use it to enter our meeting room.

- # 3 Additional Support Contacts,

Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

- # 4 Recommendations,

Do not try to recover your files with third-party programs, you will only do harm.
Do not turn off / reboot your computer.
Be courteous in our meeting room.
Do not procrastinate.

- # 5 Blog and News,

Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion
DragonNews: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion/news

View on RansomLook

[rand].README.txt txt · 1625 chars

Hello! 

Your files (orcl, IADeAPP, [snip] dbs) have been stolen from your network and encrypted with a strong algorithm. We work for money and are not associated with politics.
All you need to do is contact us and pay.

--- Our communication process:

	1. You contact us.
	2. We send you a list of files that were stolen.
	3. We decrypt 1 file to confirm that our decryptor works.
	4. We agree on the amount, which must be paid using BTC.
	5. We delete your files, we give you a decryptor.
	6. We give you a detailed report on how we compromised your company, and recommendations on how to avoid such situations in the future.
   
--- Client area (use this site to contact us):

	Link for Tor Browser: http://3pktcrcbmssvrnwe5skburdwe2h3v6ibdnn5kbjqihsg6eu6s6b7ryqd.onion
	>>> Use this ID: [snip] to begin the recovery process.
	
	* In order to access the site, you will need Tor Browser, 
	  you can download it from this link: https://www.torproject.org/

--- Additional contacts:

	Support Tox: 1C054B722BCBF41A918EF3C485712742088F5C3E81B2FDD91ADEA6BA55F4A856D90A65E99D20

--- Recommendations: 

	DO NOT RESET OR SHUTDOWN - files may be damaged.
	DO NOT RENAME OR MOVE the encrypted and readme files.
	DO NOT DELETE readme files.

--- Important:

	If you refuse to pay or do not get in touch with us, we start publishing your files.
	21/01/2024 00:00 UTC the decryptor will be destroyed and the files will be published on our blog.
	
	Blog: http://z3wqggtxft7id3ibr7srivv5gjof5fwg76slewnzwwakjuf3nlhukdid.onion

Sincerely, 01000100 01110010 01100001 01100111 01101111 01101110 01000110 01101111 01110010 01100011 01100101

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (672)

Search, filter and paginate the victim timeline for Dragonforce. Showing 1–100 of 672.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	Lane Equipment id33848 View details	2026-10-14	United States	—	pending
Lane Equipment Company has been a trusted food service partner in Texas since 1966, specializing in the sales, leasing, repairs, and parts for commercial kitchen equipment. They offer a wide range of products including soft serve machines, frozen beverage machines, ice machines, and refrigeration solutions. With four locations in Houston, San Antonio, Austin, and the Rio Grande Valley, they cater to restaurant professionals and commercial kitchen needs. Their services also include maintenance and parts support, ensuring comprehensive solutions for their clients. ID 33848
Ransomware	Canadian Mennonite University (CMU) id33726 View details	2026-10-12	Canada	—	leaked
Canadian Mennonite University (CMU) is a Christian institution in Winnipeg, Manitoba, offering undergraduate degrees in various fields such as arts, business, music, and sciences, along with three graduate degree programs. The university focuses on a small community environment that fosters academic, social, and spiritual growth, welcoming students from diverse backgrounds and beliefs. CMU emphasizes preparing students as skilled problem solvers and leaders committed to positive change in their communities and beyond. It offers financial aid and supports approximately 50% of its students through scholarships and bursaries ID 33726
Ransomware	TQC S.A. id33697 View details	2026-10-11	Peru	—	pending
(A release of 750 GB of data, compressed into archives for convenience.) TQC Tecnología Química Comercio S. A. specializes in providing high-quality solutions for the agricultural, veterinary, and environmental health sectors, promoting sustainable agriculture. The company aims to support the development and well-being of these sectors by offering a wide range of products tailored to their needs. With a commitment to excellence, TQC seeks to be a leading provider in Peru and other markets in South America. They work closely with farmers to exceed expectations and contribute to community growth. ID 33697
Ransomware	TEXMA International Co., Ltd id33693 View details	2026-10-10	Taiwan, Province of China	—	leaked
TEXMA International Co., Ltd. is a leading Taiwanese apparel manufacturer specializing in high-quality women's woven apparel, activewear, and sportswear. Founded in 1975, the company operates under a "Taiwan orders, global production" business model, supplying some of the world's most recognizable fashion brands. ID 33693
Ransomware	Petrosul Distribuidora, Transportadora e Comércio de Combustíveis Ltda. id33548 View details	2026-10-07	Brazil	—	leaked
Petrosul is a Brazilian company established in 1994, specializing in fuel storage terminal operations since 2015. The company offers state-of-the-art infrastructure, real-time control, and efficient management to ensure quality service. Its primary clients include businesses in need of reliable fuel storage solutions. Petrosul operates terminals in Sorocaba, Paulínia, and Senador Canedo. ID 33548
Ransomware	RÉSO id33545 View details	2026-10-07	France	—	leaked
Réso specializes in secondary works, offering a wide range of products including ceilings, partitions, floors, technical floors, and facades. They provide modular and dry partitions, acoustic products, and various accessories, ensuring a comprehensive solution for construction needs. With numerous agencies across France and a team of specialists trained in the latest innovations, Réso serves a diverse clientele with thousands of available products. Their commitment to quality and service is reflected in their partnerships and significant projects. 676 GB of confidential information about their customers, partners, employees were stolen. The entire network was locked including nearly 8TB of Veeam backups. The company has failed to reach for an agreement. ID 33545
Ransomware	winfashion id33135 View details	2026-09-24	United States	Retail / E-commerce	leaked
══════════════════════════ ══════════════════════════ ══════════════════════════ WINFASHION TECHNOLOGIES DUMP: DATA LEAK ANALYSIS OF A B2B ERP PLATFORM FOR THE FASHION INDUSTRY ══════════════════════════ ══════════════════════════ ══════════════════════════ This is a preliminary analysis, processing of sensitive data is currently underway. Target: WinFashion Technologies (Los Angeles, USA) — an international B2B provider of ERP solutions (WF125sR / Fabric ERP V.10) for 250+ fashion brands. Offices in New York, Shanghai, and India. Integrations: Shopify, Acenda, JOOR, NuORDER, CommerceHub, FashionGo. BPO/EDI processing via Inovis/QRS. DUMP VOLUME: ~205K files / ~13K directories / ~73 Gigabytes AT-RISK FILES: 125,274 (61.0%) Critical: 9,350 High: 78,174 Medium: 37,750 PRELIMINARY FINDINGS: ▸ kaktus.bak (5.64 GB) — full MSSQL backup of the "Kaktus" client's ERP installation (Customer Master, Style Master, EDI, AR) ▸ 6 SSL PFX containers + EDI-VAN client certificate for ECGrid/OpenText ▸ 33,307 .shxml files — WinSCP SFTP session logs (hosts, paths, sizes) ▸ 332 ASP.NET Web.config files — potentially hardcoded Shopify / Authorize.Net secrets ▸ 171 files with PAN / CreditCard / Cardholder / Payment data — Authorize.Net payment processing code ▸ 39 files with IBAN / SWIFT / BankAccount data — bank account details ▸ 259 Invoice Register / Invoice data files — Excel payment registers (up to 124 MB) CLIENT DATA (~40 BRANDS): ▸ STYLEMASTER.xlsx (48 MB) — aggregated product catalog export ▸ Vendors.XLS (20 MB) + test customers.XLS (7 MB) — Kaktus vendors and customers ▸ 40,621 EDI files (.edi / .850 / .856 / .810 / .997 / .852 / .832 / .846) — full B2B trade lifecycle (PO, ASN, invoices, price catalogs) INTELLECTUAL PROPERTY: ▸ 8,577 .cs files — integration source code (Authorize.Net, Shopify, Acenda, JOOR, NuORDER, DSCO) ▸ 5,828 .pbd files — PowerBuilder WF125sR ERP core ▸ 3,398 .sql files — DB schema, triggers, CLR procedures ▸ 18 .dbf / .mdf files — legacy DBASE / FOXPRO / MSSQL tables without encryption HR / PII: ▸ INV EMPLOYEE ALLOWANCE YTD.xlsx (76 MB) — employee HR data ▸ AR Aging 12.30.25.xls + AR Aging 12.29.25.XLS — accounts receivable for Monrow and Kaktus clients REGULATORY RISKS: ▸ PCI DSS — compromise of PAN processing code + Authorize Excel registers ▸ CCPA / CPRA — HR-PII (76 MB), California jurisdiction ▸ FTC — "total security" claims amidst PFX / DBF / Web.config compromise ▸ SEC (Regulation FD) — risk for publicly traded client issuers ▸ GDPR — PII of customers / vendors across ~40 brands The dump represents a cross-tenant B2B SaaS incident involving the disclosure of trade secrets for ~40 fashion brands, the compromise of the Authorize.Net payment infrastructure, and the exposure of the full ERP source code. ID 33135
Ransomware	Arizona Vascular Medical Equipment, Inc id33134 View details	2026-09-24	United States	Healthcare / Pharma	leaked
Arizona Vascular Medical Equipment, Inc. is a trusted provider of specialized medical devices, focusing primarily on compression therapy solutions and vascular care equipment. Headquartered in Mesa, Arizona, the company is dedicated to improving patient mobility and quality of life by delivering high-quality medical products and personalized customer service across the United States. ID 33134
Ransomware	BMGP Groupe id33128 View details	2026-09-24	France	Manufacturing / Engineering	leaked
BMGP Groupe (Polyresine) is an established French manufacturer specializing in the formulation, production, and distribution of synthetic resins and high-performance technical polymers. Founded in 1972, the company serves a wide range of industrial sectors, providing tailored chemical formulations for applications such as industrial flooring, waterproofing, encapsulation, and specialized coatings. They are known for engineering reliable, durable chemical solutions to meet complex industrial specifications. ID 33128
Ransomware	Elite Industech Co., Ltd id33129 View details	2026-09-24	Thailand	Manufacturing / Engineering	leaked
Elite Industech Co., Ltd. (established in 2003) is a certified Class-A waste treatment plant based in Kaohsiung, Taiwan. The company operates within the circular economy sector, specializing in the eco-friendly processing of electronic waste (E-waste) and the recycling of rare and precious metals ID 33129
Ransomware	HEC Group id33130 View details	2026-09-24	Taiwan, Province of China	Services	leaked
On August 30, HEC Group issued an official statement addressed to shareholders of TPE:3032 and other stakeholders, announcing that the company had been the target of a cyberattack. In its statement, the company claimed that the breach was detected immediately, that high-tech countermeasures were deployed, and that no corporate documentation was lost. The incident was characterized as a minimal, random occurrence. The reality, however, is starkly different. Our operation against the company began weeks prior to that publication. Due to a systemic failure to implement basic security principles, we gained nearly total control over the infrastructure supporting the development and commercial operations of the entire corporate group. We conducted a methodical and comprehensive review of the documentation, exfiltrating a vast amount of data. We remained undetected for as long as necessary to secure everything we sought. Only after completing our objectives did we initiate the data encryption process, the company's technical staff did not even detect our presence until many hours later. At the time of their official announcement, HEC Group's leadership knew the statement was entirely false. Its sole purpose was to manipulate stock market trading. Instead of contacting us to mitigate the damage, management chose to deceive the exchange. When we finally managed to contact the company's leadership and offered them a chance to make their official statement more truthful in exchange for the deletion of the taken documents, they showed no interest. If the leadership of HEC Group has decided to pursue a path of selfdestruction, we will not stand in their way. To prove that HEC Group’s statement was a fabrication and that our claims are accurate, we will now publish a portion of the exfiltrated data. This initial release will consist of over 360,000 files, drawn from a total volume measuring in terabytes. This data will provide stock exchange regulators and partner companies with exhaustive evidence of the actual events. The remaining documents will not be released publicly at this time, as we have devised a more strategic use for them. While the countdown timer below this publication runs, the companies affiliated with HEC Group, their shareholders, and regulatory authorities have time to prepare. HEC Group has one final opportunity to accept our proposal and avoid the consequences. ID 33130
Ransomware	arsrenacer.com id33017 View details	2026-09-20	Argentina	Services	leaked
ARS RENACER, S.A. DUMP: ANALYSIS OF A HEALTH INSURANCE COMPANY LEAK ═══════════════════════════════════════════════════ ARS Renacer, S.A. (Dominican Republic) is a private Health Risk Administrator (ARS), licensed by SISALRIL (Law 87-01). Member of ADIMARS. It serves hundreds of thousands of affiliates through 24 regional offices. DUMP VOLUME: 274,404 files / 158,693 critical and high-risk files ▸ 50,894 files in the "Usuarios" (Users) folder — user accounts for all systems ▸ .ssh/ + .bash_history + .gitconfig — access keys and command history of IT personnel ▸ 4,501 files — direct affiliate databases (names, cédulas [national IDs], phone numbers, addresses) ▸ 3,000 backup files — potentially complete database dumps ▸ 679 files — employee payroll data ▸ 500 files — passwords and access tokens to financial systems MEDICAL DATA (PHI): ▸ 19,443 medical service authorization files — diagnoses, procedures, patient names ▸ 13,928 pre-certification files ▸ 810 pre-certification files (treatment details) ▸ 199 medical record files (expediente clínico) ▸ 1,569 prescription files linked to diagnoses ▸ 252 claims files containing PHI FINANCIAL DATA: ▸ 4,863 financial transaction files — payments, refunds, bank details ▸ 3,676 account files with affiliates' financial data ▸ 3,467 financial documents (reports, balance sheets, budgets) ▸ 1,293 files containing financial system secrets and tokens REGULATORY RISKS: ▸ Law 172-13 (Personal Data Protection) — Article 13 directly violated; penalties: 6 months to 2 years in prison + fines up to 150 minimum wages per incident ▸ Law 42-01, Article 28 (Confidentiality of clinical records) ▸ Law 53-07 (Cybercrime) — mandatory DICAT investigation ▸ Circular SSRL-INT-2025-000827 SISALRIL — direct requirement to protect PHI ▸ Precedent: SISALRIL fine of 2.3 million DOP for 5 incidents (2021); the current leak is orders of magnitude larger OTHER RISKS: ▸ Exploitation of the Traspaso Digital system (SISALRIL, 2025) for massive illegal transfers of affiliates using leaked credentials ▸ Blackmailing patients with the threat of disclosing diagnoses ▸ BEC (Business Email Compromise) attacks on management (Board of Directors' data is in the dump) ▸ Synthetic identity theft and fabrication of fake cédulas ▸ Mass Habeas Data lawsuits — will paralyze the legal department The dump contains a complete cross-section of the medical insurance company: from server SSH keys to the diagnoses of hundreds of thousands of patients and affiliates' bank details. The data cannot be invalidated — a cédula and medical history are immutable. ID 33017
Ransomware	Community Property Management id32887 View details	2026-09-16	United States	IT	leaked
full data 200 GB+ We have been in business since 1978 as a management firm specializing in the management of common interest developments including condominiums and planned unit developments. CPM rapidly evolved into one of the premier association management firms in the industry and is on the forefront of innovative and specialized services. Our reputation for attentiveness to the needs of each association is one of which Community Property Management is very proud. Our dedication to excellence and our staffs skills and professionalism have become the trademark at Community Property Management. Management level personnel attend courses offered through Community Associations Institute, a national organization of community association, and California Association of Community Managers. CPM has also earned its Accredited Management Organization designation with IREM, and Certified Property Manager from CAI, the industries highest designation. We are responsive and dedicated to our Associations and their unique service requirements. We have found, over the years that association needs are constantly changing. Therefore, we analyze and formulate objective plans for the guidance and support of the Association through its Board Members. Our company has developed expertise in all areas of association management and keeps Board Members updated on law changes. We stand ready to assist you with all your Associations requirements. ID 32887
Ransomware	Owen Leigh Optometry id32888 View details	2026-09-16	United Kingdom	Healthcare / Pharma	leaked
Full DATA 400 GB+ The brain uses the eyes to gather information about our surroundings. The brain cannot process all our view so it must first decide what to look for. The eyes-brain system then has to select that information, usually by shifting eye position and often by shifting focus. How the eyes-brain go through this process is the real test of visual efficiency. Here at Owen Leigh Optometry, we specialise in helping patients of all ages to develop flexibility in their vision to meet all their needs and interests. We start this by observing and measuring your eye-brain system with a wide range of visual challenges. Eye health and eyesight are important, but this must not be the end point of developing good vision. We want to take you much further than that, to explore ways that you can see more, feel more, move better, plan better and understand quicker. We use 'visual efficiency glasses', vision exercises (vision therapy) and 'training/learning lenses' to help you develop your own vision. We add visual hygiene, consider coloured lenses and refer to other disciplines if that will help you meet your goals. “What we see is dependant upon what we are looking for and what we managed to see last time.” ID 32888
Ransomware	Medical Department Store id32754 View details	2026-09-11	United States	Healthcare / Pharma	leaked
Medical Department Store in united state ID 32754
Ransomware	rubbermill.com id32621 View details	2026-09-06	United States	Manufacturing / Engineering	leaked
═════════════════ ═════════════════ ═════════════════ RUBBERMILL, INC. DUMP: BREAKDOWN OF AN OEM MANUFACTURER LEAK ═════════════════ ═════════════════ ═════════════════ Target: RubberMill, Inc. (North Carolina, USA) — contract manufacturer of non-metallic components for appliance, HVAC, automotive, and heavy equipment. Certifications: ISO 9001:2015, WOSB, WBENC. Probable defense contracts (Mil-Spec). DUMP SIZE: ~296K files / 276K data objects / 340+ GB ▸ 146 GB disk image (.mrimg) — full copy of the system ▸ AES PASSWORDS.xlsx file + APWDxx libraries — credentials ▸ outlook.pst (487 MB) — corporate email archive ▸ creditcard.xls — payment data ▸ EMPLOYEE CALL LIST + Employee Information Record Form — PII ▸ Insurance data ▸ Tax forms containing SSNs ENGINEERING DATA: ▸ 3,000+ CAD files (.dxf, .stp, .dwg) with client part numbers: 7J314, K2A31, K7K11, V1324, etc. ▸ Complete set of 3D models ▸ Client drawings FINANCIAL DATA: ▸ Sales analysis.mdb (38 MB) — complete sales database ▸ commercial terms ▸ customer segmentation REGULATORY RISKS: ▸ C-TPAT / NAFTA / Certificate of Origin ▸ Conflict Minerals Reporting Template ▸ Supplier Quality Assurance Manual ▸ Probable Mil-Spec specifications The dump contains a full cross-section of the business: from passwords and SSNs to automotive OEM drawings and military specifications. ═════════════════ ═════════════════ ═════════════════ ID 32621
Ransomware	Homewood Sales id32622 View details	2026-09-06	United States	—	leaked
Homewood Sales Corporation specializes in equipment life extension solutions, offering a wide range of products including automatic voltage regulators, control panels, and motors, all built to Westinghouse specifications. With over a century of expertise, they provide exceptional quality in industrial and power distribution units and components. Their services include global sourcing, factory revitalization, and technical support, ensuring precise and expert assistance for their clients. Homewood primarily serves industries requiring reliable power distribution and equipment maintenance solutions. ID 32622
Ransomware	Norwood Law Firm id32623 View details	2026-09-06	United States	Finance / Legal / Insurance	leaked
Norwood Law is a Tulsa-based legal firm that specializes in personal injury law, criminal defense, business law, and family law. Founded by attorney Joe Norwood in 2004, the firm is known for its success in high-profile cases and achieving significant legal victories for its clients. The team also includes Todd Maxwell, who specializes in contracts, construction law, and dispute mediation. Norwood Law serves clients in Oklahoma seeking expert legal representation in complex legal matters. ID 32623
Ransomware	Frato id32081 View details	2026-08-24	Brazil	IT	leaked
(release includes data for the entire group of companies across all countries of operation, financial documentation, shareholder information, personal data of employees and clients, and much more) FRATO is recognized for its commitment to quality and style, merging traditional craftsmanship with innovative design. Drawing inspiration from diverse cultures and breathtaking locations worldwide, the brand creates a unique international aesthetic. It offers an exceptional interior lifestyle concept through its flagship stores located across America, Europe, and the Middle East. FRATO's intended clients are those seeking sophistication and inspiration for their living spaces. ID 32081
Ransomware	Criba id32082 View details	2026-08-24	Argentina	Services	pending
(release includes data on Argentina, Uruguay, and other countries, as well as financial documents and client documentation, including a vast amount of information not intended for public disclosure) CRIBA Empresa Constructora Argentina specializes in providing comprehensive solutions for every stage of construction projects, leveraging over 70 years of experience. The company focuses on quality, efficiency, and safety, ensuring that they can execute even the most ambitious architectural designs. Their portfolio includes a variety of projects such as commercial offices, healthcare facilities, and residential buildings. CRIBA is committed to maintaining a zero-accident policy, prioritizing the safety of their workforce. ID 32082
Ransomware	Brookview Financial id32079 View details	2026-08-24	Canada	Finance / Legal / Insurance	leaked
(data of many thousands of customers, including credit reports, SSNs, addresses, etc.) Brookview Financial is a boutique private lender specializing in quick-close financing solutions for real estate projects. Established in 1992, the company has served as a trusted capital partner for thousands of real estate investors across the nation. They offer a range of loan programs, including commercial bridge loans, fix & flip loans, and special situation financing, with amounts ranging from $75,000 to over $50 million. Known for their personal service and flexible terms, Brookview can close deals in as little as 7 days. ID 32079
Ransomware	Wozair id32080 View details	2026-08-24	United Arab Emirates	Manufacturing / Engineering	leaked
Wozair specializes in the design, manufacture, and installation of heavy-duty heating, ventilating, and air conditioning (HVAC) products for various sectors including Marine, Naval, Military, Nuclear, Oil and Gas, Powergen, and Renewables. Their product range includes air handling units, dampers, filtration solutions, and refrigeration systems. Wozair also offers services such as system design, project management, manufacturing, commissioning, and maintenance. The company aims to provide bespoke solutions to meet specific client requirements while ensuring a safe working environment. ID 32080
Ransomware	Hogan Omidi P.C. id31948 View details	2026-08-21	United States	—	leaked
Hogan Omidi, P.C. is a boutique law firm specializing in family law, including divorce, child custody, and property division, with a focus on high-asset cases. The firm is led by experienced attorneys who have authored key reference materials on Colorado family law, providing them with a unique advantage in legal representation. They serve a diverse clientele, including executives, business owners, and professionals, ensuring personalized and strategic legal solutions. With offices in Denver and Aspen, they are dedicated to protecting clients' interests and achieving favorable outcomes in family law matters. ID 31948
Ransomware	R & D Machine and Engineering id31830 View details	2026-08-18	United States	—	leaked
&D Machine and Engineering, LLC specializes in CNC machining of precision metal components primarily for the aerospace, defense, and space industries. The company is known for its ability to maintain tight tolerances and produce complex geometries using advanced 5-axis milling and coordinate measuring machines. With a commitment to quality, R&D Machine has built a strong customer base that includes respected blue-chip companies like NASA. Acquired by Compass Precision in 2022, the company continues to focus on manufacturing mission-critical components for demanding applications. ID 31830
Ransomware	Vermont XCenter id31786 View details	2026-08-17	Brazil	—	leaked
A Vermont coloca seus clientes estrategicamente no Centro das Decisões, pois entende que o cliente deve estar no Centro das Atenções. Com isso estabelecido, a companhia acredita que é mais simples interpretar o mercado a partir dos desejos e perspectivas do mesmo. Vermont XCenter: Centro de interAções modernas que promovem experiências em relacionamento. Soluções de Contact Center que contam com um avanço tecnológico do atendimento e que se adaptam às necessidades de um consumidor cada vez mais exigente e conectado; Soluções de Tecnologia: Pensada por meio de um portfólio que vai desde fábrica de software, mapeamento e modelagem dos processos de negócios (BPM) até Service e Help Desk. Com Skills técnicos e avançadas linguagens de programação. ID 31786
Ransomware	GB Group S.A id31664 View details	2026-08-13	Poland	IT	leaked
GB Group is one of Haiti’s largest private industrial and trading conglomerates. Headquartered in Port-au-Prince, it operates across nine core industries including construction materials, consumer goods, and energy. Recently, the organization transitioned its corporate identity to B\|G\|O (Builders of Great Opportunities). ID 31664
Ransomware	QPC Global id31562 View details	2026-08-11	United Kingdom	IT	leaked
Quest Personal Care Global Ltd is a global company specializing in affordable beauty and personal care products, with over 30 years of experience and a presence in more than 65 countries. They offer a diverse range of innovative brands and products, including skincare, haircare, and fragrance, aimed at helping consumers look and feel their best. The company focuses on speed to market, consumer insights, and sustainable practices, ensuring high-quality products that are both effective and environmentally friendly. Their mission is to simplify beauty for everyone by providing inclusive and trend-led products to retail partners and distributors worldwide ID 31562
Ransomware	EduSpa id31370 View details	2026-08-06	United States	Education	leaked
Parkmungak has been operating since 1972, providing a range of services and products tailored to meet the needs of its clients. The company focuses on delivering high-quality solutions and has established a reputation for excellence in its field. With a commitment to innovation and customer satisfaction, Parkmungak aims to serve a diverse clientele. Their offerings include various services designed to enhance user experience and operational efficiency. ID 31370
Ransomware	Primary Eye Care id31357 View details	2026-08-06	United States	Healthcare / Pharma	pending
We offer a full range of options to meet your eyecare needs. From advanced custom LASIK laser vision correction and cataract surgery to glasses, contact lens fittings and routine eye tests, we can provide the treatment that is right for you. ID 31357
Ransomware	P. A. Inc. (Performance Alloys) id31291 View details	2026-08-05	United States	Other	leaked
P.A. Inc. is a leading distributor of high nickel alloy and specialty stainless steel piping products, based in Houston, Texas. The company offers a comprehensive inventory of materials including Nickel 200, Alloy 400, Alloy 600, and various titanium grades, catering to industries requiring high-temperature and corrosion-resistant solutions. Their services include custom fabrication and a qualitative specification assurance process to ensure product quality. P.A. Inc. serves clients in sectors such as specialty chemicals, oil and gas, and petrochemicals, providing efficient and effective procurement solutions. ID 31291
Ransomware	Mike Graham Heating And Air Conditioning id31292 View details	2026-08-05	United States	Construction / Real Estate	leaked
Mike Graham Heating, Air Conditioning & Plumbing is a trusted HVAC and plumbing service provider based in Wichita Falls, Texas, serving the local community since 1994. The company offers a wide range of services including air conditioning, heating, indoor air quality solutions, and comprehensive plumbing services. Their target clients include homeowners and businesses in Wichita County and surrounding areas, seeking reliable and professional home service assistance. With a commitment to customer satisfaction, they provide upfront estimates, emergency services, and tailored solutions to meet individual needs. ID 31292
Ransomware	Baicizhan id31180 View details	2026-08-03	China	Education	pending
Baicizhan is a language learning platform specializing in English instruction. It offers a wide range of tools and resources designed to help users overcome the challenges of learning English. ID 31180
Ransomware	TUI China id31179 View details	2026-08-03	China	Hospitality / Food & Beverage / Tourism	pending
An affiliate of TUI Group, the world's number one leisure tourism business, TUI China was established in late 2003 as the first joint venture with foreign majority share in the Chinese tourism industry. Passports, visas, internal documentation, legal and financial documents, etc. ID 31179
Ransomware	Lamont Pridmore id31082 View details	2026-07-31	United Kingdom	Finance / Legal / Insurance	pending
Lamont Pridmore is a leading independent chartered accountancy practice based in Carlisle, Cumbria, and Lancashire, offering a comprehensive range of accountancy, tax, and business advisory services. Their expertise spans various sectors including agriculture, tourism, and family businesses, catering to both individuals and organizations throughout the North of England and Southern Scotland. The firm specializes in services such as asset and wealth management, corporate finance, and tax planning, aiming to support clients in improving their financial performance. The release consists of a single archive that expands to 250 GB of data once unpacked. This includes both internal company documentation and client data containing confidential financial information. ID 31082
Ransomware	RUS Industrial id31079 View details	2026-07-31	United States	Manufacturing / Engineering	pending
RUS Industrial specializes in heavy industrial construction services, catering to sectors such as chemical refineries, petrochemical plants, oil and gas facilities, and mission-critical data centers. ID 31079
Ransomware	www.mbmlawsc.com id31080 View details	2026-07-31	United States	Finance / Legal / Insurance	pending
MBM Law (Moore Bradley Myers) is a South Carolina-based law firm founded in 1971. For over half a century, the firm has represented individuals, families, and businesses across a wide range of legal matters ID 31080
Ransomware	Katathani Phuket Beach Resort id30969 View details	2026-07-27	Thailand	Hospitality / Food & Beverage / Tourism	pending
Katathani Phuket Beach Resort is a luxury beachfront resort located on Kata Noi Beach in Phuket, Thailand, offering a range of accommodations from suites to family-friendly rooms. The resort features world-class amenities including multiple dining options, a spa, fitness facilities, and a kids club, catering to couples, families, and solo travelers alike. Guests can enjoy stunning ocean views, direct beach access, and a variety of recreational activities, ensuring a memorable stay in a tranquil setting. With its commitment to providing exceptional service and a serene atmosphere, Katathani is an ideal destination for those seeking relaxation and luxury in paradise. ID 30969
Ransomware	Syntron Bioresearch id30898 View details	2026-07-26	United States	IT	pending
Syntron Bioresearch, Inc. specializes in manufacturing rapid in vitro diagnostic tests and detection readers, focusing on fertility and over-the-counter tests for ovulation and pregnancy. The company is licensed as a Medical Device Establishment by the US FDA and the State of California Department of Health Services, and is ISO certified. Their intended clients include healthcare providers and individuals seeking reliable diagnostic solutions. Syntron is committed to meeting the needs of its customers with high-quality products and services. ID 30898
Ransomware	Deluxe Medical Supply id30899 View details	2026-07-26	United States	Healthcare / Pharma	pending
Deluxe Medical Supply is a distributor of healthcare supplies that focuses on delivering quality home healthcare products and services. They provide a wide range of medical equipment, including mobility aids, incontinence supplies, and compression therapy garments, aimed at restoring independence and confidence for their clients. Their knowledgeable staff is dedicated to offering fast and efficient service to both patients and medical professionals. The company intends to serve individuals needing home healthcare solutions while ensuring affordable options and high-quality products. ID 30899
Ransomware	ID engineering id30823 View details	2026-07-24	Indonesia	Manufacturing / Engineering	pending
ID Engineering & Automated Systems is a machine builder and integrator with over 50 years of combined experience, established in 2002. The company specializes in producing quality, turn-key equipment and offers both stand-alone equipment and fully robotic work cells. With a strong focus on quality, reliability, and operator ergonomics, they cater to the manufacturing industry by meeting demands for safety and process control. Their commitment to competitive pricing and on-time delivery, along with a dedicated workforce, underscores their success in the field. ID 30823
Ransomware	Koshkaryan Law Group id30743 View details	2026-07-22	United States	Finance / Legal / Insurance	pending
Koshkaryan Law Group is a legal firm specializing in personal injury and criminal defense cases. They prioritize client service and provide personalized attention to ensure favorable outcomes for their clients. The firm offers free initial consultations and is dedicated to keeping clients informed about their legal options. With a strong track record of recovering over $138 million for clients, they aim to advocate vigorously on behalf of those they represent. ID 30743
Ransomware	One Community FCU id30734 View details	2026-07-21	United States	Finance / Legal / Insurance	leaked
One Community FCU offers a range of financial services including loans, savings accounts, and online banking solutions. Their products cater to individuals seeking personal, auto, mortgage, and credit card loans, as well as those interested in savings and checking accounts. In this release we provide a portion of the documentation we obtained from the company: databases, internal documentation, client data, client documents, client financial information (including statements that clients supplied to One Community FCU from other banks), documentation on delinquent payments. Additionally, the release contains reports and documentation produced by TraceSecurity LLC (6300 Corporate Blvd, Suite 200, Baton Rouge, LA 70809). TraceSecurity LLC handled security matters for One Community FCU. In our view, that work was performed very poorly. These shortcomings contributed to the data breach, though they were not the sole cause, so we believe it is necessary to publish them. ID 30734
Ransomware	NewNet id30660 View details	2026-07-18	Saudi Arabia	IT	pending
NewNet S.A. is a Colombian company specializing in managing IT risks, offering advanced and personalized data protection services. Their extensive range of services includes information security, cybersecurity, business continuity, and governance, risk, and compliance (GRC) solutions. They cater to various sectors, providing consulting, technology, and managed services to ensure optimal IT operations for their clients. With a commitment to quality and collaboration with recognized manufacturers, NewNet S.A. has been delivering reliable and secure technology solutions since 1996 ID 30660
Ransomware	Petrini Valores id30611 View details	2026-07-16	Argentina	—	pending
Petrini Valores S.A. specializes in personalized wealth management and financial planning, offering tailored financial solutions for individuals, families, and businesses. They provide private banking services, corporate solutions, and sales & trading expertise, ensuring clients can access both local and international markets. The company focuses on creating customized portfolios aligned with clients' profiles and objectives, utilizing innovative strategies and technology. With a commitment to exploring capital market opportunities, Petrini Valores aims to deliver flexible and disruptive financial strategies. ID 30611
Ransomware	Sinai Grand Casino id30612 View details	2026-07-16	Egypt	Hospitality / Food & Beverage / Tourism	pending
Sinai Grand Casino is the premier casino in the Middle East, offering a luxurious gaming experience with a variety of games including roulette, blackjack, and poker. The casino provides 24/7 services, entertainment shows, and dining options, making it a top destination for visitors in Sharm El Sheikh. It caters primarily to international tourists, as Egyptian nationals are not permitted to enter due to government regulations. With a commitment to exceptional customer service, Sinai Grand Casino also offers complimentary transportation for qualified players and guests. ID 30612
Ransomware	Kee Wah Bakery id30594 View details	2026-07-16	Hong Kong	IT	pending
Kee Wah Bakery specializes in traditional and innovative baked goods, offering a wide range of products including mooncakes, festive treats, and gift items. The company prides itself on using high-quality ingredients and advanced techniques to create its renowned products. Targeting both individual consumers and corporate clients, Kee Wah Bakery also provides promotional offers and a membership program for added benefits. With a commitment to quality and tradition, the brand continues to uphold its legacy in the baking industry. ID 30594
Ransomware	Southport Outdoor Living id30591 View details	2026-07-16	United Kingdom	Retail / E-commerce	pending
Southport Outdoor Living is a Canadian company established in 2008, specializing in outdoor patio furniture. They offer a wide range of products including lounge furniture, dining sets, grills, umbrellas, and custom cushions, all with a focus on quality and thoughtful design. Their services include design consultation and a commitment to supporting local suppliers by providing Canadian-made products. The company aims to deliver exceptional value and reliable service to clients in Toronto, Woodbridge, and Vaughan. ID 30591
Ransomware	Metro Design Cente id30592 View details	2026-07-16	Mexico	Retail / E-commerce	pending
Metro Design Center offers a variety of design ideas through its room settings, creating an experience reminiscent of Architectural Digest. The center is conveniently located in the Lehigh Valley, making it accessible to a wide range of clients ID 30592
Ransomware	North Atlantic Engineering Consultants id30593 View details	2026-07-16	Botswana	Transportation / Travel / Logistics	pending
Established in the early 1980's North Atlantic Engineering Consultants has since inception conscientiously led the way with holistic sustainable energy solutions and responsible engineering practice. With a human resource base of professionals of the highest calibre, who are qualified and experienced in project design, co-ordination and management, the firm has grown steadily over the years with a steadfast commitment to quality and cutting-edge design, establishing itself as a trend setter in the field of sustainable building services engineering. ID 30593
Ransomware	Heritage Mechanical LLC id30583 View details	2026-07-15	United States	Construction / Real Estate	pending
Built on a family legacy of proud steamfitters dating back to over 100 years, Heritage Mechanical was established in 2012 to provide quality mechanical service to the commercial construction industry. Opening its doors with only three employees and a master plan, the company has since grown rapidly to become one of the fastest growing mechanical construction firms serving the DMV. ID 30583
Ransomware	Isegen South Africa (Pty) Ltd id30577 View details	2026-07-15	South Africa	Manufacturing / Engineering	pending
Isegen South Africa (Pty) Ltd is a South African chemical company founded in 1974. It is the sole producer of certain chemical products in South Africa. Data that will be published: Corporate correspondence Passport / personal identification data Contracts Certificates Intellectual property data And other related information ID 30577
Ransomware	Hughes Atwood & Mullaly pllc id30578 View details	2026-07-15	United States	Finance / Legal / Insurance	pending
Hughes Atwood & Mullaly PLLC is a full-service law firm that offers professional legal services to individuals, businesses, and institutions in the Upper Valley Region of New Hampshire and Vermont. The firm specializes in various practice areas including Business Law, Civil Litigation, Criminal Law, Estate Planning, Real Estate, Divorce Law, Municipal Law, Collections, and Landlord-Tenant issues. Their experienced attorneys are dedicated to providing caring legal support tailored to their clients' needs. The firm does not solicit legal business from clients in jurisdictions where they are not licensed to practice. ID 30578
Ransomware	Shillen Mackall & Seldon id30579 View details	2026-07-15	United States	NGOs / Associations	pending
Shillen Mackall Seldon Spicer & Fraas is a law firm dedicated to representing personal injury victims primarily in Vermont, New Hampshire, and Florida since 1980. They offer legal services for a wide range of personal injury cases, including car accidents, medical malpractice, and workers' compensation. The firm is committed to providing compassionate legal counsel and fighting for the rights of clients facing physical, emotional, and financial challenges after accidents. With a team of experienced attorneys, they strive to secure maximum compensation for their clients while ensuring a supportive and understanding environment. ID 30579
Ransomware	Stephens Precision id30580 View details	2026-07-15	United States	Manufacturing / Engineering	pending
Stephens Precision, Inc. is a versatile HUBZone manufacturing facility in Vermont, specializing in the machining of mechanical assemblies, components, and tooling for aerospace, defense, commercial, and research sectors. As a Woman-Owned Small Business, they offer solutions from prototype to volume production, emphasizing lean manufacturing and cost control through various programs. The company prides itself on achieving 100% quality and delivery ratings from major clients like Boeing and GE Aviation. With a commitment to quality and a skilled workforce, they provide precision machined parts and a wide range of materials, ensuring strong partnerships with their clients. ID 30580
Ransomware	Edison Global Networks Limited id30548 View details	2026-07-14	Hong Kong	Energy	pending
Edison Global Networks Limited is a Hong Kong-based IT system integrator and managed service provider with regional offices in Shenzhen, Shanghai, and Beijing. They specialize in cloud solutions, network infrastructure, disaster recovery, global data center services, and communication systems. ID 30548
Ransomware	SITAV SpA id30549 View details	2026-07-14	Italy	Transportation / Travel / Logistics	pending
SITAV specializes in the construction, maintenance, revision, and restoration of trains and railway vehicles, ensuring maximum efficiency for high-speed trains, regional transport carriages, trams, and subways. The company has been operational since its founding, providing corrective and ordinary maintenance services primarily for Trenitalia. With a focus on innovation and safety, SITAV employs a team of experts and advanced technologies to guarantee that every vehicle is in perfect operational condition. Their services also include revamping, which modernizes existing trains to enhance the travel experience. ID 30549
Ransomware	Graphic International Centre id30550 View details	2026-07-14	United States	IT	pending
Graphic International Centre LLC (GIC) has been providing top-tier printing solutions and office automation products in the UAE since 1982. The company specializes in managed print services, large format printing, and a variety of office accessories, catering to diverse sectors including hospitality, education, oil & gas, and retail. GIC is committed to empowering creativity with high-quality products like Copic markers and advanced printing technologies. With a focus on exceptional customer support, GIC aims to meet the evolving needs of its clients through innovative and technology-driven solutions. ID 30550
Ransomware	Road Ahead Technologies Consultant id30551 View details	2026-07-14	China	Transportation / Travel / Logistics	pending
马路科技 specializes in advanced 3D scanning and measurement solutions, offering a range of products including GOM ATOS 3D scanners, industrial CT systems, and 3D printers. They serve various industries such as automotive, aerospace, and medical devices, providing high-precision measurement and reverse engineering services. As the authorized distributor for ZEISS in China, they ensure high-quality products and support for their clients. Their services also include software solutions for quality management and 3D data analysis ID 30551
Ransomware	Intron Technology Holdings id30542 View details	2026-07-14	Taiwan, Province of China	Manufacturing / Engineering	pending
Intron Technology Holdings Limited is a fast-growing automotive electronics solutions provider in China focuses on providing solutions targeting critical automotive electronic components applied in New Energy, Body Control, Safety and Powertrain systems. The Group utilizes its research and development and engineering capabilities to provide solutions incorporating advanced semiconductor devices to help OEMs achieve industry leading performance. ID 30542
Ransomware	Atcom id30543 View details	2026-07-14	China	Telecommunications	pending
ATCOM Technology Co., LTD. specializes in manufacturing VoIP products, including various types of IP phones and IP PBX systems. They offer a range of solutions such as self-built VoIP, cloud VoIP, call center VoIP, and Wi-Fi VoIP solutions tailored for enterprises. Their focus is on creating value for customers through innovative products and excellent service. The intended clients include businesses looking for reliable and efficient communication systems. ID 30543
Ransomware	Midal Cables id30544 View details	2026-07-14	United Arab Emirates	Manufacturing / Engineering	pending
Founded in 1977, Midal Cables manufactures alluminum rods and wires, overhead line conductors, aluminum clad steel and extruded products. Midal Cables has offices located in Bahrain, London, Toronto, Kuala Lampur and Nairobi. ID 30544
Ransomware	Omax Autos id30545 View details	2026-07-14	India	Manufacturing / Engineering	pending
OMAX Autos Limited is a leading manufacturer of sheet metal components, specializing in the production of auto and non-auto components. The company serves various sectors, including commercial vehicles, passenger cars, and railways, with a focus on innovative design and manufacturing solutions. OMAX is committed to bridging the gap between human and technology, evolving from a manufacturing to an engineering company. Their mission emphasizes a performance-driven culture and respect for intellectual property. ID 30545
Ransomware	Ifage id30546 View details	2026-07-14	Switzerland	Education	pending
Ifage is a foundation based in Geneva dedicated to the continuous education and professional development of adults. It offers a wide range of courses in languages, management, administration, industry, construction, and new technologies. The foundation serves individuals seeking to enhance their skills and obtain recognized certifications, including federal diplomas and international certificates. Its clients include professionals looking to advance their careers and companies seeking training solutions for their employees. ID 30546
Ransomware	asimar.com id30540 View details	2026-07-14	Mexico	Other	pending
Asimar \| Asian Marine Service PCL is a leading shipyard in Thailand with over 35 years of experience in the shipbuilding and repair industry. The company specializes in ship repair, ship building, steel fabrication, and engineering services for marine, offshore, and onshore sectors. Committed to quality and timely delivery, Asimar aims to achieve ultimate client satisfaction while adhering to classification society standards. Established in 1981, Asimar has evolved from a marine survey company to a prominent player in the ship repair services market. ID 30540
Ransomware	momenta.cn id30537 View details	2026-07-14	China	IT	pending
Momenta is an AI and autonomous-driving company. All source code, financial documents, configuration files, employee database, and more were stolen. Servers and workstations were encrypted. Momenta is trying to hide everything from Chinese regulators, the HKEX commission, and investors while reporting a $751M profit from its recent IPO. With a $9B+ market capitalization, this amounts to one of the largest financial frauds in Chinese history. ID 30537
Ransomware	Northeast Rescue Systems id30523 View details	2026-07-13	United States	NGOs / Associations	pending
Northeast Rescue Systems is a dedicated provider of specialized rescue, safety, and protective equipment serving emergency services and industrial safety communities throughout the New England region. The company is known for supplying a wide selection of highquality gear, including protective clothing, technical rescue tools, detection instruments, and missioncritical hardware tailored to the demanding needs of first responders and safety professionals. With a focus on reliability, expert guidance, and personalized service, Northeast Rescue Systems supports teams that operate in hazardous environments by equipping them with trusted products from reputable manufacturers and fostering strong relationships built on professionalism and trust ID 30523
Ransomware	Nicholson y Cano Abogados id30522 View details	2026-07-13	Argentina	Finance / Legal / Insurance	pending
Nicholson y Cano is a leading full-service law firm in Argentina, established in 1976, with a team of 29 partners and over 150 lawyers. The firm provides exceptional legal services to both local and international clients across all sectors of the economy, focusing on strategic solutions that drive business success. With expertise in 20 practice areas, they handle complex legal matters and transactions. Their commitment to client success is reflected in their personalized attention and innovative approaches. ID 30522
Ransomware	degeremcia.com id30512 View details	2026-07-13	Türkiye	Other	pending
DEGEREMCIA is a food operator that is dedicated to the production, distribution and sale of prepared food. It operates mainly through its own chain of fast-food stores; its main brands include Naturissimo and Soldia. ID 30512
Ransomware	www.twtci.com Trans World Trading id30513 View details	2026-07-13	Philippines	IT	pending
Trans World Trading Company, Inc. is a leading business conglomerate in the Philippines, recognized for its trust and reliability since 1946. The company specializes in providing sustainable material solutions through its divisions in plastics, chemicals, industrial products, and agrochemicals. With a strong commitment to integrating global innovations with local expertise, it serves various industries across the nation. Trans World continues to expand its operations and influence, shaping the future of the Philippine industry ID 30513
Ransomware	Al - Saidi Factory id30505 View details	2026-07-12	Saudi Arabia	Other	pending
Al Saidi Al Saidi Trading and Industry is a prominent group of companies providing tailored chemical and logistics solutions primarily for clients in the Middle East. They offer a comprehensive range of global logistics services, including supply chain management and freight forwarding, designed to enhance business efficiency. Additionally, the company specializes in manufacturing chemicals for the Oil & Gas and petrochemical industries, focusing on reliability and sustainability. With a commitment to high-quality, environmentally friendly products, Al Saidi aims to support clients in maximizing their operational effectiveness. ID 30505
Ransomware	STEP Oiltools id30506 View details	2026-07-12	Romania	Energy	pending
STEP Oiltools is a leading global provider of solids control and drilling waste management services, primarily serving the oil and gas and civil engineering industries. The company offers a range of products including mini separation systems, modular recyclers, and dewatering systems, aimed at enhancing efficiency and sustainability in drilling operations. With a commitment to health and safety, STEP Oiltools has received recognition for its high standards in workplace safety. Their clientele includes major players in the energy sector, civil construction, and water treatment markets. ID 30506
Ransomware	Access Equipment Hire id30499 View details	2026-07-11	Australia	IT	pending
Access Group International is a leading privately owned provider of access, material handling, power generation, and construction equipment. The company is dedicated to safety, performance, and reliability, serving Australia's demanding industries with dependable equipment and expertise. Their integrated services include maintenance, OEM manufacturing, transport, logistics, and workforce solutions, allowing for seamless project support. With a focus on adaptability and tailored solutions, Access Group International is a trusted partner for projects of all sizes. ID 30499
Ransomware	The Schuett Companies id30465 View details	2026-07-10	United States	Healthcare / Pharma	pending
The Schuett Companies, Inc. is a family-owned business with over 50 years of experience specializing in affordable housing for seniors, individuals with disabilities, and families. They manage approximately 1,600 housing units across Minnesota, North Dakota, and South Dakota. Since 1968, they have also offered Home Health Care services through their CompassionCare program, ensuring residents can age in place comfortably. The company's commitment to providing a supportive community emphasizes the importance of a stable home for a healthy life. ID 30465
Ransomware	hive360.com id30309 View details	2026-07-07	United States	IT	pending
HIVE360 is a UK-based employment administration and employee benefits specialist. They help businesses streamline their payroll and HR operations while improving employee engagement ID 30309
Ransomware	amplesurveyor.com id30310 View details	2026-07-07	United States	IT	pending
Ample Surveyor Services Limited is a professional property and construction consultancy firm based in Hong Kong. ID 30310
Ransomware	hwaseng id30085 View details	2026-06-29	Taiwan, Province of China	Manufacturing / Engineering	leaked
A Taiwanese manufacturer with forty years of experience, specializing in the high-precision production of metal fasteners, precision-machined parts, and components for the electronics and automotive industries. ID 30085
Ransomware	agroprime id30086 View details	2026-06-29	Brazil	Agriculture / Food	leaked
development of specialized software (SaaS) for automating agribusiness management and monitoring field personnel ID 30086
Ransomware	stni.co.kr id30087 View details	2026-06-29	Korea, Republic of	Manufacturing / Engineering	leaked
Creating accurate virtual replicas involves production facilities, workshops, and equipment for modeling, testing, and optimizing technological processes. ID 30087
Ransomware	vipimaging id30088 View details	2026-06-29	United States	Healthcare / Pharma	leaked
VIP Imaging is the largest mobile nuclear imaging company in Southern California, specializing in cardiac PET/CT and SPECT studies for cardiologists. The company is employee-owned and prides itself on having the best technicians and technology in the industry, ensuring high-quality patient care and support for proper billing. ID 30088
Ransomware	medipakpharma.com id30090 View details	2026-06-29	Pakistan	Healthcare / Pharma	leaked
The Pakistani pharmaceutical company Medipak Limited (***.com) specializes in the manufacture of infusion solutions, medical devices, and pharmaceutical products. ID 30090
Ransomware	Aptora id30047 View details	2026-06-27	United States	IT	leaked
Aptora is an aggressively growing software company in Lenexa, KS. The company offers award-winning software and consulting services to the service and contracting industries. In 2006, the company were voted one of the top twenty-five companies in the Kansas City area by the Business Journal. Aptora also provides data hosting and processing services for its clients on its own infrastructure. During our visit, we took not only the company’s own data but also the databases of its clients. Unfortunately, the company showed no interest in preserving its clients’ data. When we contacted them, they told us the company had assured them there was no leak. That’s not true. For the release, we have prepared not only Aptora data but also archives containing the databases of more than 100 of its clients. This could affect Aptora leadership, and they may decide to prevent publication. ID 30047
Ransomware	bits-pilani.ac.in id30081 View details	2026-06-22	India	Education	leaked
BITS Pilani is a premier Indian private research university and "Institution of Eminence" known for elite engineering and science programs across five campuses. Founded in 1964, it is highly selective with a 1.47% acceptance rate and offers a 0% attendance policy with mandatory industry immersion. ID 30081
Ransomware	mihana-v.com id30082 View details	2026-06-22	Russian Federation	IT	leaked
Here is the comprehensive corporate overview of MIHANA Seisakusho Co., Ltd. based on their official company profiles, technical catalogs, and industrial registries ID 30082
Ransomware	Tecfi SpA id29941 View details	2026-06-16	Italy	IT	leaked
Tecfi is a company specialising in the design, production and sale of fastening systems. Going into more detail, three production lines can be highlighted. ▪ Plastic and rubber moulding ▪ Sheet metal moulding with blanking ▪ Cold stamping and flatbed rolling machines ID 29941
Ransomware	Ink id29861 View details	2026-06-14	United Kingdom	Communication / Marketing	leaked
(including internal documentation, counterparties, contractors, software, correspondence, and the like) INK is an award-winning production studio based in London specialising in CGI, Animation and Retouching. We combine the technical and the beautiful to bring ideas to life across film, print and interactive platforms. ID 29861
Ransomware	Cheoy Lee Shipyards id29822 View details	2026-06-12	Hong Kong	Other	leaked
Cheoy Lee Shipyards Ltd. specializes in the design and manufacturing of a diverse range of vessels, including tugs, ferries, crew boats, pilot boats, and luxury yachts. Their state-of-the-art facility in Zhuhai, China, is equipped with advanced machinery, enabling the production of high-quality vessels up to 70 meters in length. The company serves a global clientele, focusing on maritime industries that require innovative and efficient solutions for various operational needs. Cheoy Lee is committed to excellence, sustainability, and employee welfare, fostering a strong community within their workforce. ID 29822
Ransomware	Al Ishrak Contracting id29823 View details	2026-06-12	United Arab Emirates	Other	leaked
Al Ishrak Contracting Company, established in 1975 in Dubai, specializes in construction works including industrial warehouses, residential and commercial buildings, and civil engineering projects on a turnkey basis. The company boasts a skilled workforce of over 250 personnel, including engineers and project managers, dedicated to delivering quality and timely services. Their commitment to client satisfaction is reflected in their values of quality, integrity, teamwork, and technical excellence. Al Ishrak's diverse portfolio includes various projects such as commercial buildings, industrial sheds, and labor accommodations. ID 29823
Ransomware	Corniche Hotel Abu Dhabi id29827 View details	2026-06-12	United Arab Emirates	Hospitality / Food & Beverage / Tourism	leaked
At the heart of the Central Business District. Situated along the stunning Corniche stretch, our hotel’s 305 luxurious guest rooms offer breathtaking views of the Capital Garden and sparkling turquoise waters of the Arabian Gulf. There’s something here for everyone. Busy executives will appreciate our first-class business centre and car rental services, and families will love our childcare and babysitting services. Our health and fitness center, with sauna and steam room, will delight any globetrotter recovering from jet lag. And our wheelchair accessible rooms and public areas are a comfort for the physically impaired. Sightseeing couldn’t be simpler. Our hotel offers free scheduled pick up and drop off to the city’s main attractions: Yas Waterworld, Ferrari World, Corniche Public Beach, and World Trade Centre Mall. Book here for our Best Price Guarantee promise. Earn and spend loyalty points on all qualifying stays. The level of points, benefits and privileges are subject to availability and may vary at certain participating hotels. ID 29827
Ransomware	A. Liberty Engineering Co. Ltd id29829 View details	2026-06-12	Hong Kong	Manufacturing / Engineering	leaked
Founded in 1973 as Liberty Electrical Engineering Company Limited, A. Liberty Engineering Co Ltd has continually evolved to meet the dynamic needs of the electrical services sector. With a rich history in design and contracting, the company has expanded its offerings to include cutting-edge solutions in the realm of sustainable energy. In response to the burgeoning demand for electric vehicle infrastructure, A. Liberty Engineering proudly introduces its self-branded EV chargers, designed for both AC and DC supercharging. These state-of-the-art systems enhance the efficiency of electric vehicle charging while seamlessly integrating with existing Intelligent EV Charging and IoT LV Switchboard Monitoring systems. ID 29829
Ransomware	Al Shafar GRC id29830 View details	2026-06-12	United Arab Emirates	Services	leaked
ASGRC is a leading provider of Glass Fiber Reinforced Concrete (GRC) solutions, specializing in the design, manufacturing, and installation of high-quality products for both residential and industrial projects. Established in 2003, the company has grown to become the largest GRC facility in the UAE, known for its innovative and aesthetically pleasing cladding systems, decorative screens, domes, furniture, and precast units. ASGRC has contributed to iconic architectural landmarks in the UAE, combining craftsmanship with sustainability. The company also offers expert construction consulting services to ensure that client visions are realized effectively. ID 29830
Ransomware	The DRM id29831 View details	2026-06-12	Bahrain	Retail / E-commerce	leaked
Durrat Resort Management specializes in providing high-quality resort management services. Their offerings include operational management, marketing strategies, and guest services tailored to enhance the overall experience of resort guests. The company primarily targets luxury resort owners and investors looking to optimize their properties' performance. With a focus on excellence and customer satisfaction, Durrat aims to elevate the standards of resort management in the industry. ID 29831
Ransomware	Areco id29794 View details	2026-06-11	Sweden	IT	leaked
Areco Steel is the parent company of the privately-owned Areco Group, which includes five divisions: Areco Metals, Areco Profiles, Areco Direct, and Areco Properties. The company's business idea is to develop, manufacture, and globally market products and services tailored to the needs of industries. Their product offerings include various types of metals, profiles, and construction materials. Areco Steel aims to serve a diverse range of industrial clients with innovative solutions. ID 29794
Ransomware	Hong Kong Parkview id29802 View details	2026-06-11	Hong Kong	Construction / Real Estate	leaked
Hong Kong Parkview offers over 200 luxury serviced apartments and a private clubhouse featuring recreational and dining facilities. Located within Tai Tam Country Park, it provides a tranquil living experience just minutes from the city center. The complex includes amenities such as a fitness center, swimming pools, themed playrooms, and various dining options. Targeting both long-term residents and short-term guests, it serves as an ideal home away from home. ID 29802
Ransomware	Astec Valves & Fittings Pvt id29803 View details	2026-06-11	India	Manufacturing / Engineering	leaked
Astec Valves & Fittings Private Limited specializes in providing high-quality instrumentation and piping solutions for various industries, including Oil & Gas, Refining, Petrochemical, and Nuclear Power. Established in 1965, the company offers a range of products such as instrument tube fittings, valves, and integrated assemblies, with a focus on innovative technologies that enhance process measurement and reduce maintenance downtime. With a presence in 40 countries and over a million installations, Astec is recognized for its eco-friendly product technologies and has received multiple awards for technical innovation. Their clients include sectors like shipbuilding, water treatment, and pharmaceuticals, making them a trusted partner for instrumentation and piping engineers worldwide. ID 29803
Ransomware	Cekok id29804 View details	2026-06-11	Türkiye	Manufacturing / Engineering	leaked
Çekok Gıda is a leading fruit and vegetable producer in Turkey and Europe, known for its commitment to sustainable agriculture and high-quality products. The company cultivates 35 types of fruits and vegetables across 13,500 decares of farmland, utilizing advanced technology and adhering to strict environmental and safety ID 29804
Ransomware	Brian Cox id29805 View details	2026-06-11	United Kingdom	Other	leaked
Established in 1984, Brian Cox & Company is a leading estate agent in Middlesex, specializing in residential lettings and property management. With six local offices, they provide maximum exposure for homeowners seeking buyers or tenants. Their services include property valuation and a wide range of property types for rent and sale. The company caters to clients in Harrow, Sudbury, Greenford, and Northolt. ID 29805
Ransomware	Sayre Associates id29726 View details	2026-06-10	United States	Finance / Legal / Insurance	leaked
(Including clients, projects, emails and financial documents) Sayre Associates, Inc. is a civil engineering and land surveying firm based in Sioux Falls, South Dakota, established in 1969. The company offers a range of services including land development planning, parks and recreation facilities design, drainage and erosion control, and construction administration. They focus on delivering high-quality solutions through collaboration and innovation, serving clients in South Dakota, Iowa, and Minnesota. Their talented team of engineers and surveyors is dedicated to improving community efficiency and quality of life. ID 29726
Ransomware	REHA-ACTIV id29647 View details	2026-06-05	Germany	Healthcare / Pharma	leaked
REHA-ACTIV is a medical supply company that has been supporting individuals with health limitations for over 30 years. ID 29647
Ransomware	Copamex id29590 View details	2026-06-03	Mexico	Manufacturing / Engineering	pending
Copamex, headquartered in Monterrey, Mexico, and established in 1928, is a paper manufacturing company offering writing and printing, special, corrugated, and kraft paper solutions. ID 29590
Ransomware	SETS Solutions id29591 View details	2026-06-03	Lebanon	IT	leaked
SETS Solutions is a prominent information technology company based in Lebanon, serving the Middle East since 1990. The company specializes in a diverse range of technology solutions, including its flagship Human Resources Management System, People365, which encompasses Time Attendance, Payroll, and HR modules. Additionally, SETS offers services in data center solutions, security, cloud computing, and end-user computing, catering to various industries. With over 25 years of experience, SETS aims to enhance organizational efficiency and productivity through innovative technology solutions. ID 29591

‹ Prev 1 2 3 4 5 6 7 Next ›