Ransomware Group intelligence
Everest
ActiveTrack Everest with 426 published victims and 2 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Everest is tracked by Breach House as a ransomware group with 426 published victims.
United States is currently the most targeted country in this dataset.
2 known leak locations are currently associated with this group.
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (2)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 4h ago | ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion |
| Leak location 2 | Onion service | Up checked 4h ago | everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion |
Top Activity Sectors (16)
- Not identified 108
- Finance / Legal / Insurance 51
- Healthcare / Pharma 45
- Communication / Marketing 43
- Services 36
- IT 27
- Manufacturing / Engineering 15
- Transportation / Travel / Logistics 15
- Energy 14
- Construction / Real Estate 10
- Retail / E-commerce 7
- Public Sector 7
- Agriculture / Food 6
- Hospitality / Food & Beverage / Tourism 6
- Telecommunications 5
- Education 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Everest, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v19.2. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: everest uses PowerShell scripts to execute malicious commands and deploy ransomware payloads across compromised systems.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: everest modifies Windows Registry Run Keys to ensure ransomware execution persists across reboots on compromised hosts.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: everest disables or modifies security tools like antivirus software to evade detection during initial compromise and execution phases.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: everest deletes Volume Shadow Copies and backup directories via system commands to prevent data recovery without payment.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1003.001 LSASS Memory Credential Access
What they do: everest accesses LSASS memory using credential-stealing tools to harvest user credentials for lateral access and evasion.
What that means: Adversaries may attempt to access credential material stored in the process memory of the Local Security Authority Subsystem Service (LSASS).
-
T1135 Network Share Discovery Discovery
What they do: everest performs network share discovery to identify accessible remote directories for lateral movement and victim data targeting.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: everest exploits SMB/Windows Admin Shares for lateral movement between networked systems within victim environments.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: everest encrypts victim files using custom ransomware binaries to maximize impact and force ransom payments.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: everest executes Service Stop commands to terminate critical services, disrupting operational continuity during ransomware deployment.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: everest invokes system recovery inhibition commands to prevent backup restoration and isolate compromised machines.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Tools Observed (8)
▼Software Everest has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Credential theft
ProcDump
Discovery & enumeration
SoftPerfect NetScan
Offensive security tooling
Cobalt Strike
Metasploit
Meterpreter
Remote monitoring & management
AnyDesk
Atera
Splashtop
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
EVERESTRANSOMWARE.txt
Dear [snip], Greetings from the Everest team. Your systems have been attacked, the files are encrypted. You can read about us in our blog (Tor browser needed) Blog : ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad.onion Or read about our group in Twitter Also, our team was able to bypass your "Dataprotection" as any other your protection software and more than 1 Terabyte of internal files were exfiltrated to our servers, which we can confirm with great joy and ease The list contains financial documents, internal orders, KYC information(documents,photos...), trusted representatives personal info Client risk levels,loans, debt and client data. Various financial documentation, backups , etc. etc. The information was collected both from personal PCs and from centralized storage locations. If an agreement is reached with us, this information will never be published and the problem will disappear as if it never happened, otherwise it will be posted on our blog and darknet. Which will lead to even greater financial and reputational losses on your part. Also you will get 1.Attack logbook (months of experience with your company) with full list of vulnerabilities and bypass methods 2.Advices how to singifically improve your security and avoid such attacks in the future 3.We will delete all files from your company 4.We will attack your company no more Yours trully Everest Team Email to contact: [email protected] Your key: [snip]
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (426)
Search, filter and paginate the victim timeline for Everest. Showing 201–300 of 426.
| Type | Target | Discovered | Country | Business Category | Intel Link |
|---|---|---|---|---|---|
| Ransomware | New American Funding id21172 View details | United States | Communication / Marketing | ||
|
[AI generated] New American Funding is a family-owned mortgage lender with a nationwide presence. Since its founding in 2003, the firm has been dedicated to helping Americans finance their homes. They offer a variety of loans including FHA, VA, HARP, and Conventional loans. The company is known for its efficient processes, exceptional service, innovative use of technology, and strong commitment to providing equal housing opportunities. |
|||||
| Ransomware | Rezayat Group id21122 View details | Saudi Arabia | Construction / Real Estate | ||
|
[AI generated] Rezayat Group is a diversified multinational conglomerate based in Saudi Arabia. Their operations span across various sectors including oil & gas, petrochemicals, power generation, construction, real estate, trading, and healthcare. They work with a network of global partners, providing services and products in many countries around the world. |
|||||
| Ransomware | Katz & Doorakian Law Firm, P.L. - File tree upload id21106 View details | Finance / Legal / Insurance | |||
|
[AI generated] N/A |
|||||
| Ransomware | Fishman, Larsen & Callister - Full leak published id21105 View details | United States | Other | ||
|
[AI generated] N/A |
|||||
| Ransomware | Department of Culture and Tourism Abu Dhabi - Download link id21104 View details | United Arab Emirates | Transportation / Travel / Logistics | ||
|
[AI generated] The Department of Culture and Tourism Abu Dhabi (DCT Abu Dhabi) enables the transformation of the emirate into a global cultural hub. It enhances Abu Dhabi's global image through its rich cultural and historical heritage by stimulating tourism. It organizes events, establishes museums, preserves local heritage, and promotes the Emirati culture internationally. |
|||||
| Ransomware | Arlington Occupational Health and Wellness - Full leak published id20957 View details | United States | Healthcare / Pharma | ||
|
[AI generated] N/A |
|||||
| Ransomware | Avantic Medical Lab - Full leak published id20956 View details | Healthcare / Pharma | |||
|
[AI generated] N/A |
|||||
| Ransomware | Arlington Occupational Health and Wellness id20791 View details | United States | Healthcare / Pharma | ||
|
[AI generated] Arlington Occupational Health and Wellness, located in Arlington, Virgin, offers a comprehensive array of health services to businesses. Their services include fitness-for-duty evaluations, immunizations, and health exams that are designed to improve and maintain workplace health and safety. Their team of healthcare professionals is dedicated to providing customized, efficient, and high-quality health solutions. |
|||||
| Ransomware | PeopleCheck id20790 View details | Australia | Communication / Marketing | ||
|
[AI generated] PeopleCheck is a global service offering employment background checks and pre-employment screening. They specialize in criminal background checks, employment, education and reference checks, identity checks, and other verifications. The firm complies with data protection laws and ensures confidential, prompt, and thorough service to businesses. |
|||||
| Ransomware | Katz & Doorakian Law Firm, P.L. id20789 View details | United States | Finance / Legal / Insurance | ||
|
[AI generated] Katz & Doorakian Law Firm, P.L. is a law firm based in Northville, Michigan. Their team of experienced attorneys specializes in a wide range of legal areas including business law, criminal defense, family law, real estate law and estate planning. They are dedicated to advocating for their clients' rights and guiding them through the legal process. They pride themselves on their personalized and thorough approach to their clients' legal matters. |
|||||
| Ransomware | Avantic Medical Lab id20788 View details | United States | Healthcare / Pharma | ||
|
[AI generated] "Avantic Medical Lab" is a state-of-the-art diagnostic laboratory specializing in providing high-quality medical lab testing services. They use the latest technologies for accurate and timely results. Services include blood tests, urinalysis, microbiological testing, molecular diagnostics, and more. Their experienced team emphasizes patient care and data security, providing services for individuals, healthcare providers, and corporations. |
|||||
| Ransomware | Fishman, Larsen & Callister id20787 View details | United States | Finance / Legal / Insurance | ||
|
[AI generated] "Fishman, Larsen & Callister" is a full-service law firm based in Fresno, California, USA. Their team of experienced attorneys specializes in several areas of law, including corporate, real estate, litigation, labor & employment, and estate planning. The firm is dedicated to providing the highest quality legal services, emphasizing professionalism, integrity, and attention to detail. |
|||||
| Ransomware | Bowles Womack & Company, P.C id20636 View details | United States | Services | ||
|
[AI generated] Bowles Womack & Company, P.C is an accounting firm based in Texas, US. It specializes in delivering comprehensive accounting services to business owners, individuals, and executives. Their services range from basic tax management and accounting services to more in-depth services such as audits, financial statements, and financial planning. They emphasize professionalism, responsiveness, and quality in their work. |
|||||
| Ransomware | Department of Culture and Tourism Abu Dhabi - Full leak published id20552 View details | United Arab Emirates | Transportation / Travel / Logistics | ||
|
[AI generated] The Department of Culture and Tourism Abu Dhabi is a governmental organization in charge of conserving and promoting the Emirate's cultural heritage and tourism sector. They plan festivals, concerts and other cultural events, manage major tourist sites and museums, work to attract international visitors, and regulate the tourism industry in Abu Dhabi. |
|||||
| Ransomware | Jordan Kuwait Bank - Full leak published id20421 View details | Jordan | Finance / Legal / Insurance | ||
|
[AI generated] Jordan Kuwait Bank is a leading banking institution that offers financial and banking services. The mention of "full leak published" suggests there might've been an incident where confidential information could have been exposed or compromised, potentially impacting the bank's security and client information. Note: any data breach allegations should be thoroughly researched for verification. |
|||||
| Ransomware | Mediclinic Group id20237 View details | South Africa | Healthcare / Pharma | ||
|
[AI generated] Mediclinic Group is a private hospital group based in South Africa, with international operations in Switzerland, Southern Africa (South Africa and Namibia), and the United Arab Emirates. Established in 1983, Mediclinic's main services include acute care, specialist-oriented and multidisciplinary healthcare services. Its focus areas include hospitals, clinics and day clinics. |
|||||
| Ransomware | Department of Culture and Tourism Abu Dhabi id20236 View details | United Arab Emirates | Transportation / Travel / Logistics | ||
|
[AI generated] The Department of Culture and Tourism - Abu Dhabi (DCT Abu Dhabi) drives the emirate's cultural agenda while stimulating its economic growth. Its mission revolves around conserving and promoting the heritage and culture of Abu Dhabi. It organizes festivals, develops museums, and manages libraries, while also overseeing the tourism sector, enhancing the emirate's status as a destination of distinction. |
|||||
| Ransomware | Coca-Cola id20184 View details | United Arab Emirates | Hospitality / Food & Beverage / Tourism | ||
|
[AI generated] Founded in 1886, Coca-Cola is a world-renowned beverage corporation and manufacturer headquartered in Atlanta, Georgia. It's widely recognized for its flagship product, Coca-Cola, although it offers more than 500 brands in over 200 countries. In addition to its namesake soda, its portfolio includes beverages like tea, coffee, water, juice, and energy drinks. |
|||||
| Ransomware | PDI Health id20007 View details | United States | Healthcare / Pharma | ||
|
[AI generated] PDI Health is a leading mobile healthcare service provider that offers solutions ensuring the safety and well-being of workplaces. They specialize in preventive care, including COVID-19 testing, vaccinations, and mobile clinics, to workplaces, communities, and individuals. Their mission is to create healthier environments by providing convenient access to necessary healthcare services. |
|||||
| Ransomware | Khidmah id19936 View details | United Arab Emirates | Communication / Marketing | ||
|
[AI generated] Khidmah LLC is a comprehensive real estate services company based in Abu Dhabi, United Arab Emirates. Founded in 2009, the company provides a wide range of solutions including property management, leasing and sales, facilities management, home maintenance, cleaning, landscaping, and pool maintenance. With its customer-focused approach, Khidmah caters to residential, retail and commercial properties. |
|||||
| Ransomware | Kaefer id19935 View details | United Kingdom | Communication / Marketing | ||
|
[AI generated] Kaefer is a global company that specializes in providing services in insulation technology, interior outfitting, surface protection, passive fire protection & refractory, and access solutions. Headquartered in Bremen, Germany, the firm operates in various sectors such as industry, offshore, marine, and construction. Established in 1918, Kaefer aims to provide energy efficient solutions and services. |
|||||
| Ransomware | Balance Diagnostics id19771 View details | United States | Healthcare / Pharma | ||
|
[AI generated] Balance Diagnostics is a medical technology company that specializes in developing advanced healthcare technologies for the diagnosis and treatment of balance disorders. These include dizziness, vertigo, and other balance-related health problems. The company's proprietary diagnostic tools and technologies are used by healthcare professionals all over the world to improve patient outcomes. |
|||||
| Ransomware | Jamjoom Pharma id19710 View details | Saudi Arabia | Healthcare / Pharma | ||
|
[AI generated] Jamjoom Pharma is a leading pharmaceutical company based in Jeddah, Saudi Arabia. Formed in 2000, it's part of the diverse Jamjoom Group. The company develops, manufactures, and distributes a wide variety of prescription drugs and over-the-counter products. They focus on therapeutic areas such as dermatology, antibiotics, cardiovascular, gastroenterology, and neuropsychiatry, serving both domestic and international markets. |
|||||
| Ransomware | Jordan Kuwait Bank id19709 View details | Jordan | Finance / Legal / Insurance | ||
|
[AI generated] Jordan Kuwait Bank (JKB) is a Middle Eastern banking institution founded in 1972. It operates in Jordan, Palestine, and Cyprus, offering a range of financial products and services. These services include personal and corporate banking, foreign trade services, and treasury and investment services. JKB is a subsidiary of Kuwait Projects Company (Holding) and is noted for its innovative digital banking applications. |
|||||
| Ransomware | C2S Technologies Inc. id17155 View details | United States | IT | ||
|
https://c2stechs.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | ITSS id17154 View details | Switzerland | Finance / Legal / Insurance | ||
|
The ITSS GLOBAL internal network was attacked by our group. During the incident, more than 173 GB of internal important data were exfiltrated to our servers, including internal and confidential banking information, as well as contract information. Company representative should follow the instructions to contact us before time runs outhttps://www.itssglobal.com |
|||||
| Ransomware | Weeks, Brucker & Coleman, Ltd | Legal Services id16872 View details | United States | Finance / Legal / Insurance | ||
|
Weeks, Brucker & Coleman, Ltd internal network was attacked by our group. During the incident, more than 150GB of internal important data were exfiltrated to our servers, including internal and confidential information https://www.weeksbrucker.com/ |
|||||
| Ransomware | Solaris-pharma.com id16753 View details | United States | Healthcare / Pharma | ||
|
Full data publication |
|||||
| Ransomware | Woodlake id16691 View details | Healthcare / Pharma | |||
|
EMRs,Test Results,Patient’s History,Patient’s private information,Billing information etc.Total volume data : 180GBCompany representative should follow the instructions to contact us before time runs outhttps://woodlakecenter.com |
|||||
| Ransomware | Volt Infrastructure id16690 View details | United States | Construction / Real Estate | ||
|
The Volt Infrastructure internal network was attacked by our group. During the incident, more than 526 GB of internal important data were exfiltrated to our servers, including internal and confidential information, as well as contract informationCompany representative should follow the instructions to contact us before time runs outhttps://voltinfra.com |
|||||
| Ransomware | The Hoff Brand SL id16689 View details | Spain | Transportation / Travel / Logistics | ||
|
Total volume data :More than 630,000 customers data and orders: Name,Email,Financial Status,Paid at,Fulfillment Status,Fulfilled at,Accepts Marketing,Currency,Subtotal,Shipping,Taxes,Total,Discount Code,Discount Amount,Shipping Method,Created at,Lineitem quantity,Lineitem name,Lineitem price,Lineitem compare at price,Lineitem sku,Lineitem requires shipping,Lineitem taxable,Lineitem fulfillment status,Billing Name,Billing Street,Billing Address1,Billing Address2,Billing Company,Billing City,Billing Zip,Billing Province,Billing Country,Billing Phone,Shipping Name,Shipping Street,Shipping Address1,Shipping Address2,Shipping Company,Shipping City,Shipping Zip,Shipping Province,Shipping Country,Shipping Phone,Notes,Note Attributes,Cancelled at,Payment Method,Payment […] |
|||||
| Ransomware | Solaris Pharma id16631 View details | United States | Healthcare / Pharma | ||
|
The Solaris Pharma internal network was attacked by our group. During the incident, more than 400 GB of internal important data were exfiltrated to our servers, including internal and confidential information, as well as contract information To restore access to files and prevent the publication of internal documents A company representative should contact us using […] |
|||||
| Ransomware | Welcomehallmission.com id16613 View details | Canada | Other | ||
|
2 TB of internal data are free to downloadLink:http://bifpwatchoxp7tsb2kpes37b23ogjrb2kj4wgr7yncf4hhgsfahu7jad.onion/welcomehall/ |
|||||
| Ransomware | Evidn id16562 View details | Australia | Communication / Marketing | ||
|
Total amount of stolen data : 50GBhttps://www.evidn.comCompany representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Genie Healthcare id16234 View details | United States | Healthcare / Pharma | ||
|
Database including the entire history of employee records and personal data!More than 4,400 personal IDs.Total amount of stolen data : 110GBhttps://geniehealthcare.com/Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Izmocars id16233 View details | United States | Communication / Marketing | ||
|
Total volume data:More than 200GB of .msg files Files including:izmoltd izmocars izmolaw izmomedia izmolimited.com izmocars.be carazoosolutions.com auto-marketing.pro carazoo.com carsite.com cartalking.com citadeldefence.com citadelint.in citadelint.net cpa-marketing.pro deepheritage.com deepjansevasamiti.com dgipro.com dgipro-design.com digitalnanotechsg.com franchisenow.pro ipricecars.com izmocars.fr izmocrm.com izmodirect.com izmoeurope.be izmoinc.com izmolaw.com izmomedia.com izmonet.com izmostock.com izmostudio.com izmoweb.com izmoweb.in legal-marketing.pro partsgorilla.com smart-shiksha.com logixworld.com izmotion.com netmobyl.com si2microsystems.com vtcl.in sankeshwar.in medical-marketing.pro tejsoni.com motortrend.in […] |
|||||
| Ransomware | Total Patient Care LLC;A Sensitive Touch Home Health;Alphastar Home Health Care;Heart of T id16127 View details | United States | Healthcare / Pharma | ||
|
https://gofile.io/d/XWQ7HJ |
|||||
| Ransomware | Artistic Family Dental;Value Dental Center;Sparkling Smiles Family Dentistry id16126 View details | United States | Healthcare / Pharma | ||
|
https://gofile.io/d/NOUMwo |
|||||
| Ransomware | Myhealthcarebilling id16019 View details | United States | Healthcare / Pharma | ||
|
https://www.myhealthcarebilling.com/Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Sarah Car Care id15992 View details | United Arab Emirates | Communication / Marketing | ||
|
Total amount of stolen data : 100GBhttps://sarahcarcare.com/Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | CO-VER Power Technology SpA id15900 View details | Italy | IT | ||
|
Total amount of stolen data : 800GBhttps://www.co-ver.it/Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Medical Technology Industries, Inc. id15897 View details | United States | IT | ||
|
Total amount of stolen data : 900GBhttps://mti.netCompany representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Concord Orthopaedics id15604 View details | United States | Healthcare / Pharma | ||
|
Medical records and personal data of all patients from 2018 More than 30,000 identity documents https://www.concordortho.com/ Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | STIIIZY id15603 View details | United States | Communication / Marketing | ||
|
Client’s Personal data and ID’s Total personal records : 422,075 https://www.stiiizy.com/ Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | IndicaOnline id15485 View details | United States | Communication / Marketing | ||
|
Client’s Personal data and ID’s Total personal records : 422,075 https://indicaonline.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Bio-Clima Service Srl id15348 View details | Italy | Communication / Marketing | ||
|
https://bioclimaservice.it/Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Total Patient Care LLC id15347 View details | United States | Healthcare / Pharma | ||
|
Medical records and personal information Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | A Sensitive Touch Home Health;Alphastar Home Health Care;Heart of Texas Home Healthcare Se id15346 View details | United States | Healthcare / Pharma | ||
|
Medical records and personal information Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Pincu Barkan, Law Office and Notary id15304 View details | Israel | Finance / Legal / Insurance | ||
|
More than 230,000 files including personal ID’s copies, fbi crime records, birth certificates etc. https://pincu-law.co.il/https://barkan-law.com/ |
|||||
| Ransomware | Value Dental Center id15278 View details | Egypt | Healthcare / Pharma | ||
|
Medical and personal data of 5000 patients https://valuedentalcentercicero.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Artistic Family Dental id15277 View details | United States | Healthcare / Pharma | ||
|
Medical and personal data of 5000 patients https://artisticfamilydental.comhttps://sparklingsmilesdentist.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | Asaro Dental Aesthetics id15276 View details | Türkiye | Healthcare / Pharma | ||
|
Medical and personal data of 3800 patients https://asarodentalaesthetics.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | MedElite Group id15220 View details | United States | Healthcare / Pharma | ||
|
Medical and personal data of 119,000 patients https://medelitegrp.com Company representative should follow the instructions to contact us before time runs out |
|||||
| Ransomware | MCNA Dental id15088 View details | United States | Healthcare / Pharma | ||
|
More than 1 million personal EMR’s https://gofile.io/d/yeIPm4 https://www.mcna.net/ |
|||||
| Ransomware | Arctrade id15087 View details | Switzerland | Finance / Legal / Insurance | ||
|
Time to resolve : More than 40,000 customers info and other internal data https://arctrade.com ISO, State,LDC,Load Zone,Customer,LDC Acct ID #,Account Group,Is Special Needs,Is Switch Hold,Customer Added Date,Last Upload Date,Current Status,Current Status Change Date,Latest EDI Date,Contract Approval Date,Contract Status,Legal Document Language,Contract,Deal Type,Fixed Rate (MWh),Broker Fee Rate (MWh),Original Contract Begin,Original Contract End,Actual Contract Begin,Actual Contract End,Renewal Contract […] |
|||||
| Ransomware | Spine by Villamil MD id14960 View details | United States | Healthcare / Pharma | ||
|
More than 1000 medical data of the company’s patients https://spinebyvillamilmd.com/ Time until publication: |
|||||
| Ransomware | Aspen Healthcare id14959 View details | United Kingdom | Healthcare / Pharma | ||
|
More than 1500 Medical Records and Personal Information https://aspenhealthcareservices.com Time until publication: |
|||||
| Ransomware | Pacific Pulmonary Medical Group id14958 View details | United States | Healthcare / Pharma | ||
|
Medical records and personal data of all patients from 2021 Company representative should follow the instructions to contact us before time runs out https://pacificpulm.com/ |
|||||
| Ransomware | Country Inn & Suites by Radisson id14830 View details | United States | Hospitality / Food & Beverage / Tourism | ||
|
Thousands and thousands of client’s personal information,credit cards info, internal emails, incidents, messages Full calendar of past and future bookingsAnd complete negligence in storing passwords and private data, Evidences that management is aware of events and is not taking any actionThe company must follow the instructions to resolve the issue with us before the timer ends, […] |
|||||
| Ransomware | CreaGen Inc id14816 View details | United States | Services | ||
|
Research data and other internal documents,contracts ,laboratory tests https://creageninc.com Time to resolve : |
|||||
| Ransomware | Broward Realty Corp id14623 View details | United States | Services | ||
|
Company must contact and resolve the issue by the end of October 21 or all data will be published 2972 NW 60th St, Fort Lauderdale FL 33309Phone 954-645-7020 & 954-645-7733 Marylou Adams [email protected] 954-444-6626George Weaver [email protected] 954-806-3268Zsa-Zsa Weaver [email protected] 754-215-9533 |
|||||
| Ransomware | Pureform Radiology Center id14416 View details | Canada | Healthcare / Pharma | ||
|
We were able to hack into the Pureform Radiology Center in Canada.All medical records, internal documents were stolen. But the most valuable thing we found was a zero-day exploit in the software of the company that acquired Pureform. Pureform’s president hired a recovery negotiator, unaware that he was dealing with a complete amateur who was […] |
|||||
| Ransomware | MCNA Dental 1 million patients records id14311 View details | United States | Healthcare / Pharma | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published More than 1 million personal EMR’s + different internal company documents https://www.mcna.net/ Example :5511310,NICOLE M GARCIA,2901 BAYARD ST,LAREDO, TX 78046,12/07/2005,(956) 949-0951,4174985,526285913,MATTHEW A STAAT,3768,MCNA,Eligible,2019-01-08 00:00:00,2018-11-20 00:00:00,2019-01-08 00:00:00,2016-07-26 00:00:00,2016-07-26 00:00:00,4. 1 Year +,NULL,2021-06-02,Active,648,$25.00,$564.00,$0.00,TEXAS CHIP,NICOLE,M,GARCIA,2901 BAYARD ST,,LAREDO,TX,78046 […] |
|||||
| Ransomware | Mitsubishi Chemical Group id14111 View details | Japan | Manufacturing / Engineering | ||
|
Since Mitsubishi Chemicals think that this situation doesn’t bother them much and are more worried about the earthquake 6 terabytes of internal data containing drawings, developments, contracts. Also information about incidents within the companyTo contact us, use e-mail [email protected], then you will receive all further points after we understand that you are seriously interested. Strictly […] |
|||||
| Ransomware | Horizon View Medical Center id13733 View details | United States | Healthcare / Pharma | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published https://horizonviewmed.com(702) 641-85006170 N Durango Dr Ste 220 Las Vegas, NV 89149 |
|||||
| Ransomware | NIDEC CORPORATION id13731 View details | Japan | Services | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be published https://www.nidec.com |
|||||
| Ransomware | Speed Advisory id13556 View details | United States | Services | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 150 GB https://www.speedadvisors.com/https://hubercpas.comhttps://dspeedcpa.com |
|||||
| Ransomware | SH Pension id13472 View details | Sweden | Other | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 100 GB https://www.shpension.se/ |
|||||
| Ransomware | The Law Office of Omar O. Vargas, P.C. id13396 View details | United States | Finance / Legal / Insurance | ||
|
Company must contact us using the instructions in next 3 days. Total amount of stolen data: 450 GB https://www.quenotedeporten.com |
|||||
| Ransomware | STUDIO NOTARILE BUCCI – OLMI id13395 View details | Italy | Other | ||
|
Company must contact us using the instructions in next 3 days. Total amount of stolen data: 400 GB https://studionotarilebucciolmi.it |
|||||
| Ransomware | Gramercy Surgery Center id13363 View details | Healthcare / Pharma | |||
|
Company has the last 24 hours to return to the chatTotal amount of stolen data : 465 GBhttps://gramercysurgery.com |
|||||
| Ransomware | Cukierski & Associates, LLC id13012 View details | United States | Services | ||
|
The company has 24 hours to contact us or the files will be published and clients notified https://cukierski.cpa |
|||||
| Ransomware | Diogenet S.r.l. id13011 View details | Italy | Other | ||
|
Company has the last 48 hours to contact us using the instructions left.In case of silence, all data will be published and clients notifiedTotal amount of stolen data : 115 GB https://www.diogenet.it/ |
|||||
| Ransomware | 2K Dental id13010 View details | United States | Healthcare / Pharma | ||
|
Company has the last 48 hours to contact us using the instructions left.In case of silence, all data will be published and clients notified https://www.2kdental.com |
|||||
| Ransomware | Zuber Gardner CPAs pt.2 id12959 View details | Other | |||
|
The company’s files are still on our servers and it is stupid to think that they are not there.The company has 24 hours to contact us or the files will be published and clients notifiedhttps://www.zubergardner.com https://gofile.io/d/PG1SoN 1GB |
|||||
| Ransomware | Voorhees Family Office Services id12816 View details | United States | Services | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 600 GBhttps://www.vfos.com |
|||||
| Ransomware | Wealth Depot LLC id12545 View details | United States | Services | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 450 GBhttps://wealthdepot.com |
|||||
| Ransomware | Zuber Gardner CPAs id12399 View details | United States | Other | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 350 GBhttps://www.zubergardner.com |
|||||
| Ransomware | Corr & Corr id12398 View details | United Kingdom | Other | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedTotal amount of stolen data : 100 GBhttps://corrca.com |
|||||
| Ransomware | Accounting Professionals LLC. Price, Breazeale & Chastang id12283 View details | United States | Communication / Marketing | ||
|
Company has the last 24 hours to contact us using the instructions left.In case of silence, all data will be publishedIncluding documents from over 2 thousands of your clientsTotal amount of stolen data : 574 GB https://accountingprofessionals.org/https://pbc-pa.com |
|||||
| Ransomware | Ayoub & associates CPA Firm id12251 View details | United States | Other | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be publishedIncluding documents from over 2 thousands of your clientsTotal amount of stolen data : 465 GB ayoub-associates.com |
|||||
| Ransomware | MORTON WILLIAMS id12201 View details | United States | Other | ||
|
150 GBhttps://gofile.io/d/mW8T5Uhttps://gofile.io/d/W1oksY https://www.mortonwilliams.com |
|||||
| Ransomware | Les Miroirs St-Antoine Inc id12138 View details | Canada | Services | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published herehttps://miroirstantoine.com |
|||||
| Ransomware | Fincasrevuelta Data Leak id11480 View details | Spain | Services | ||
|
38 GBhttps://www.fincasrevuelta.es/ https://gofile.io/d/7LIpPv |
|||||
| Ransomware | Crimsgroup Data Leak id11477 View details | United States | Services | ||
|
263 GBcrimsonenginc.com whitetailautomation.com scadahive.com herbert.com https://gofile.io/d/5e9bsshttps://gofile.io/d/qgGaRvhttps://gofile.io/d/h2Npd4https://gofile.io/d/eU4aGJ |
|||||
| Ransomware | Primeimaging Data Leak id11430 View details | United States | Communication / Marketing | ||
|
200 GB personal medical records, onco results, clients and employee personal data, passports and other documents https://primeimaging.com https://gofile.io/d/U0bWTihttps://gofile.io/d/utHvjxhttps://gofile.io/d/k4UHkshttps://gofile.io/d/ekGvQAhttps://gofile.io/d/B6134G |
|||||
| Ransomware | Crimsgroup id11370 View details | United States | Services | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here |
|||||
| Ransomware | Fincasrevuelta id11149 View details | Spain | Services | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://www.fincasrevuelta.es/ |
|||||
| Ransomware | Raocala id10911 View details | United States | Other | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://raocala.com |
|||||
| Ransomware | Primeimaging database for sale id10633 View details | United States | Communication / Marketing | ||
|
1.8 Terabytes of company internal data for salePersonal medical records, onco results, clients and employee personal data, passports and other documents Price 20,000$ https://primeimaging.com |
|||||
| Ransomware | Alliedwoundcare id10397 View details | United States | Other | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://alliedwoundcare.com |
|||||
| Ransomware | Primeimaging id10396 View details | United States | Communication / Marketing | ||
|
Company has the last 24 hours to contact us using the instructions left. In case of silence, all data will be published here https://primeimaging.com |
|||||
| Ransomware | Full access to the school network USA id9846 View details | Education | |||
|
On sale access to the all school network.USA,state TXPasswords to the admin,network admin,students,directory,teachers and much more. Admin microsoftAzure portalDomain adminBackup serverDomain hosting,network company tox:A0E79CBC8D18DDA358665BEB91360B79CFCFD54040EAD197147F1EBAB92DC64D71909CA9E64C jabber:[email protected] [email protected] |
|||||
| Ransomware | Access to the large database of a US Medical organization id9434 View details | Healthcare / Pharma | |||
|
Available actions with patient data in the panelSearch, Edit, Print, DownloadThe base is replenished from different clinics, both public and privatehttps://www.srmcfl.comhttps://www.adventhealth.comhttps://www.advimg.comAnd many others Name DOB Gender SSN Address Home Phone Work PhoneSite MPI MRN Dept Num Patient Class Admitted Discharged Site Location Hospital Svc Point of CareFacility Building Room Bed Attending Referring Consulting Admitting Visit […] |
|||||
| Ransomware | We monetize your corporate access id9036 View details | Services | |||
|
Team looking for corporate accesses (shell,vnc, hvnc, rdp + vpn, teamviewer, anydesk etc.)Us Countries,Ca and Europe. A good percentage for partners, full transparency of work and confidentiality jabber:[email protected]@thesecure.biz email:[email protected]@cock.li |
|||||
| Ransomware | Agriloja.pt Full Leak id8672 View details | IT | |||
|
https://cloud.mail.ru/public/oAe6/ZfPMzZPwehttps://cloud.mail.ru/public/bLE1/ER3UPBi9Uhttps://cloud.mail.ru/public/xm59/WBf27NeNKhttps://cloud.mail.ru/public/AKZg/E5tw3gxhDhttps://cloud.mail.ru/public/CacU/12VBNB24Khttps://cloud.mail.ru/public/MpLj/K5kE7VJZchttps://cloud.mail.ru/public/yF12/XGd6tGSBehttps://cloud.mail.ru/public/GSyK/J6SVDyZxAhttps://cloud.mail.ru/public/1Ew9/m9PUuzTZmhttps://cloud.mail.ru/public/Zgk6/1FGxwV6tPhttps://cloud.mail.ru/public/BUDf/J7udioXHWhttps://cloud.mail.ru/public/7iFf/CnyaBkCmshttps://cloud.mail.ru/public/RUPe/Ubx1DENRQhttps://cloud.mail.ru/public/iN91/pLuzjttZfhttps://cloud.mail.ru/public/7wGE/qhkjwEmw7https://cloud.mail.ru/public/hiYo/jJFAdfV7Jhttps://cloud.mail.ru/public/D5e1/UCjQn5ebNhttps://cloud.mail.ru/public/TQch/zGrk6AHhuhttps://cloud.mail.ru/public/Hw6v/W61TLWzK7https://cloud.mail.ru/public/HC5v/ywcCXabXZhttps://cloud.mail.ru/public/aaDb/vBue6KzoPhttps://cloud.mail.ru/public/zada/pYKKsenJyhttps://cloud.mail.ru/public/Ju7z/ia79hAjdN |
|||||
| Ransomware | Cmranallolaw.com id8582 View details | Finance / Legal / Insurance | |||
|
-Confidential data of a law firm-Tax forms, dl, ssn etc.-Contracts-Personal data of clients-Financial documents-Internal correspondence and emails To fully delete these files, company representatives must contact by September 15, 2023.Otherwise, all this data will be published here and other forums,in the same way, the company’s customers will be notified and receive copies of their files |
|||||
| Ransomware | SKF.com id8432 View details | Communication / Marketing | |||
|
SKF’s network was compromised(by collaboration with Ransomed group) a few days ago. The company continues to be silent about the problem.A representative of the company should contact us immediately and get full picture of what happened, instructions have all been sended in the emails.Otherwise, we will start communicating with your competitors. Revenue : $8.1 Billions […] |
|||||
| Ransomware | Powersportsmarketing.com id8431 View details | Communication / Marketing | |||
|
PSM network was compromised(by collaboration with Ransomed group).Our group got 2.2 Tb of intertnal data.Inculduing 43,000 customer records. We already sent a message and there is no jokes. Data Stolen : 2.2 TerabytesData Info : Customer records,Customer InformationTime : Till 4.09.2023 |
|||||
| Ransomware | Statefarm.com id8430 View details | Agriculture / Food | |||
|
About 400,000,000 customer insurance records database was stolen from their network.No need to say anything moreWe are will wait for company representative until 05.09.2023 Otherwise all data will be sold to third parties |
|||||