Ransomware Group intelligence
Incransom
ActiveTrack Incransom with 986 published victims and 7 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Incransom is tracked by Breach House as a ransomware group with 986 published victims.
United States is currently the most targeted country in this dataset.
7 known leak locations are currently associated with this group.
Leak Status Distribution
986
- Leaked 281 28.5%
- Pending 702 71.2%
- Deleted 3 0.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (7)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 6 | Onion service | Up checked 5h ago | incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion |
| Leak location 7 | Onion service | Up checked 5h ago | incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion |
| Leak location 2 | Onion service | Down checked 5h ago | incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion |
| Leak location 5 | Web location | Down checked 5h ago | incapt.su |
| Leak location 1 | Onion service | Down checked 5h ago | incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion |
| Leak location 4 | Web location | Down checked 5h ago | incapt.blog |
| Leak location 3 | Web location | Down checked 5h ago | incbackend.top |
Top Activity Sectors (18)
- Communication / Marketing 173
- Healthcare / Pharma 116
- Finance / Legal / Insurance 114
- Services 81
- Manufacturing / Engineering 76
- Education 58
- Not identified 56
- Construction / Real Estate 53
- Public Sector 45
- IT 40
- Retail / E-commerce 32
- Transportation / Travel / Logistics 24
- NGOs / Associations 24
- Energy 22
- Hospitality / Food & Beverage / Tourism 17
- Agriculture / Food 14
- Telecommunications 11
- null 2
Typical Attacks (35)
▼How Incransom typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via INC Ransom, INC Ransomware.
-
T1588.002 Tool Resource Development
What they do: INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.
What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.
-
What they do: INC Ransom has used compromised valid accounts for access to victim environments.
What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
-
T1190 Exploit Public-Facing Application Initial Access
What they do: INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.
What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
-
T1566 Phishing Initial Access
What they do: INC Ransom has used phishing to gain initial access.
What that means: Adversaries may send phishing messages to gain access to victim systems.
-
T1047 Windows Management Instrumentation Execution
What they do: INC Ransom has used WMIC to deploy ransomware.
What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
-
T1059.003 Windows Command Shell Execution
What they do: INC Ransom has used `cmd.exe` to launch malicious payloads.
What that means: Adversaries may abuse the Windows command shell for execution.
-
T1106 Native API Execution
What they do: INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.
What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
-
T1569.002 Service Execution Execution
What they do: INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.
What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
-
T1036.005 Match Legitimate Resource Name or Location Stealth
What they do: INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.
What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
-
T1070.004 File Deletion Stealth
What they do: INC Ransom has uninstalled tools from compromised endpoints after use.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1140 Deobfuscate/Decode Files or Information Stealth
What they do: INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.
What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1046 Network Service Discovery Discovery
What they do: INC Ransom has used NETSCAN.EXE for internal reconnaissance.
What that means: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
-
T1049 System Network Connections Discovery Discovery
What they do: INC Ransom has used RDP to test network connections.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1057 Process Discovery Discovery
What they do: INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.
What that means: Adversaries may attempt to get information about running processes on a system.
-
T1069.002 Domain Groups Discovery
What they do: INC Ransom has enumerated domain groups on targeted hosts.
What that means: Adversaries may attempt to find domain-level groups and permission settings.
-
T1083 File and Directory Discovery Discovery
What they do: INC Ransomware can receive command line arguments to encrypt specific files and directories.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1087.002 Domain Account Discovery
What they do: INC Ransom has scanned for domain admin accounts in compromised environments.
What that means: Adversaries may attempt to get a listing of domain accounts.
-
T1120 Peripheral Device Discovery Discovery
What they do: INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.
What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
-
T1135 Network Share Discovery Discovery
What they do: INC Ransom has used Internet Explorer to view folders on other systems.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1652 Device Driver Discovery Discovery
What they do: INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.
What that means: Adversaries may attempt to enumerate local device drivers on a victim host.
-
T1680 Local Storage Discovery Discovery
What they do: INC Ransomware can discover and mount hidden drives to encrypt them.
What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
-
T1021.001 Remote Desktop Protocol Lateral Movement
What they do: INC Ransom has used RDP to move laterally.
What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
-
T1570 Lateral Tool Transfer Lateral Movement
What they do: INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.
What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
-
T1074 Data Staged Collection
What they do: INC Ransom has staged data on compromised hosts prior to exfiltration.
What that means: Adversaries may stage collected data in a central location or directory prior to Exfiltration.
-
T1560.001 Archive via Utility Collection
What they do: INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.
What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
-
T1071 Application Layer Protocol Command and Control
What they do: INC Ransom has used valid accounts over RDP to connect to targeted systems.
What that means: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
-
T1105 Ingress Tool Transfer Command and Control
What they do: INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.
What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.
-
T1219 Remote Access Tools Command and Control
What they do: INC Ransom has used AnyDesk and PuTTY on compromised systems.
What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
-
T1537 Transfer Data to Cloud Account Exfiltration
What they do: INC Ransom has used Megasync to exfiltrate data to the cloud.
What that means: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
-
T1486 Data Encrypted for Impact Impact
What they do: INC Ransom has used INC Ransomware to encrypt victim's data.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1489 Service Stop Impact
What they do: INC Ransomware can issue a command to kill a process on compromised hosts.
What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
-
T1490 Inhibit System Recovery Impact
What they do: INC Ransomware can delete volume shadow copy backups from victim machines.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
-
T1491.001 Internal Defacement Impact
What they do: INC Ransomware has the ability to change the background wallpaper image to display the ransom note.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
-
T1657 Financial Theft Impact
What they do: INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.
What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.
Tools Observed (11)
▼Software Incransom has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery
AdFind
Advanced IP Scanner
Discovery & enumeration
AdFind
Advanced IP Scanner
Exfiltration
BackBlaze
MEGA
Restic
RClone
s5cmd
LOLBAS (living-off-the-land binaries)
Finger
PsExec
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.
Victims (986)
Search, filter and paginate the victim timeline for Incransom. Showing 1–100 of 986.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | fairfeelegalservices.com id34522 View details | United States | Finance / Legal / Insurance | pending | ||
|
fairfeelegalservices.com 488 |
||||||
| Ransomware | verveba.com \ www.att.com id34523 View details | United States | Retail / E-commerce | pending | ||
|
verveba.com \ www.att.com 528 |
||||||
| Ransomware | www.coopecaja.fi.cr id34524 View details | Costa Rica | Retail / E-commerce | pending | ||
|
www.coopecaja.fi.cr 470 |
||||||
| Ransomware | nowaszkola.com id34525 View details | Poland | Retail / E-commerce | pending | ||
|
nowaszkola.com 480 |
||||||
| Ransomware | FINANCIAMENTO LTDA id33866 View details | Brazil | — | pending | ||
|
H2 Financiamento h2financiamento.com.br Total leak: 1.53 TB, 3.619.372 Files, 908.472 Folders Data: Clients Personal ID/Passport, Driver license, Clients (RG / CIN) CPF (Cadastro de Pessoas Físicas), Birth certificate, Clients Risk Assessment, Finance doc's, Bank statements, Tax invoice and a lot of other personal information. Data type: High Confifential Partners: Caixa Economica Federal, Construtora Tenda, Cury Construtora, Santander Brasil, Morgan Stanley The full version of the publication is coming soon. |
||||||
| Ransomware | Great Lakes id33823 View details | India | — | pending | ||
|
The Great Lakes Institute of Management (GLIM) is a leading business school in India with campuses in Chennai and Gurgaon. The institution holds global accreditations (AACSB and AMBA) and ranks among the top 10 business schools in India. +91-44-27489000 https://www.greatlakes.edu.in/e-learning-programs/#cyber-security |
||||||
| Ransomware | Wolf & Sofsky GmbH id33812 View details | Germany | — | pending | ||
|
Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrücken, Germany. The company operates on highly complex projects and maintains a significant financial position. Critical Information We Possess Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company. Commercial Information: Contracts with clients, commercial offers, contract terms — these form the foundation of Wolf & Sofsky's competitive advantage. Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation. Technical Assets: Technical plans, project drawings, architectural solutions — the company's unique intellectual property. Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects. |
||||||
| Ransomware | brookslawfirm.com id33780 View details | United States | — | pending | ||
|
personal data 8200 client hippa etc |
||||||
| Ransomware | hsc.mb.ca id33695 View details | Canada | — | pending | ||
|
The Health Sciences Centre in Winnipeg, one of the largest medical institutions, was targeted by us that resulted in the largest data breach among healthcare institutions. Our group chose not to completely disrupt the facility’s operations, recognizing the potentially devastating consequences that such an action could have had on patients’ lives and health. Nevertheless, Health Sciences Centre management stated that no sensitive data had been affected, despite having been informed otherwise. The data included, but was not limited to, the following information: Patient medical records: Full name, date of birth, address and phone number Hospital medical record number Diagnoses, medical history, allergies and medications Laboratory results, imaging reports Appointment dates, treatment details and physician information. Employee and healthcare professional information: Names, contact details, dates of birth and employee numbers Employment, payroll and banking information Professional credentials, work schedules and departmental assignments. Financial and insurance information: Billing records and payment histories Insurance or benefits claim information. Confidential hospital documents: Internal emails and staff communications System configurations, network diagrams and security procedures Database backups and exported spreadsheets. We would have very much preferred to avoid making this data breach public, but the management has left us with no other choice. |
||||||
| Ransomware | The New Community School id33546 View details | United States | — | pending | ||
|
The New Community School is an independent co-educational day school located in Richmond, VA, catering to students in grades 5-12 with dyslexia. The school offers a customized curriculum designed to unlock each student's potential, emphasizing small class sizes and a student-centered approach. With a focus on nurturing relationships and community connections, TNCS empowers students to achieve success academically and personally. The school also provides a range of extracurricular activities, including arts, athletics, and community service opportunities. |
||||||
| Ransomware | Wavecrest HFA id33537 View details | United States | null | pending | ||
|
12,143 Files, 267 Folders 23,991,067,648 bytes |
||||||
| Ransomware | Tec Imports id33538 View details | Brazil | — | pending | ||
|
Tec Imports group offers a complete range of logistics solutions, from coordinating shipments from the manufacturer's plant to the end customer, whether by sea, air, or road. Commercial Department - [email protected] Importation - [email protected] Export - [email protected] Hospitalar – Cosmético - [email protected] Professional Hairdressing Machines [email protected] Tec Zipper - [email protected] Phone/Fax: +55 11 3809-6870 Phone/Fax: 55 27 3318-0888 |
||||||
| Ransomware | UAE Pro League id33539 View details | United Arab Emirates | — | pending | ||
|
The UAE Pro League is the top division of professional soccer in the United Arab Emirates. GENERAL INQUIRIES +971-2-4044999 [email protected] MEDIA INQUIRIES +971-2-4044999 [email protected] |
||||||
| Ransomware | City of Cloverdale id33540 View details | United States | Public Sector | pending | ||
|
Cloverdale is a small city in Sonoma County, Northern California, set among the vineyards and rolling hills of the Alexander Valley. Known for its small-town charm, wineries, outdoor recreation, and historic downtown, it is about 85 miles north of San Francisco |
||||||
| Ransomware | acmestamping.com id33530 View details | United States | Services | pending | ||
|
Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs. Employees: 20 Revenue: $5 Million Phone Number: (412) 771-5720 |
||||||
| Ransomware | harborpacific.com id33531 View details | United States | Transportation / Travel / Logistics | pending | ||
|
Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs. Employees: 20 Revenue: $5 Million Phone Number: (425) 488-7131 |
||||||
| Ransomware | architekt-vondanwitz.de id33532 View details | Germany | Services | pending | ||
|
Architektur in der Symbiose aus der erfahrenen und sicheren Anwendung der innovativen Bauteilevorfertigung, mit ökonomischer Umsetzung, ist seitüber 40 Jahren unsere Leidenschaft. Employees: 20 Revenue: $5 Million Phone Number: 06761/95900 |
||||||
| Ransomware | magnals.com id33520 View details | United States | Retail / E-commerce | pending | ||
|
confidential data belonging to all these companies; magnals.com is responsible for the leak. [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] standard [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] [email protected] |
||||||
| Ransomware | Sangre de Cristo Electric Association id33389 View details | United States | Energy | pending | ||
|
Sangre de Cristo Electric Association (SDCEA) has been informed that a substantial volume of sensitive information has been compromised. The affected information includes customer personally identifiable information, financial and payment data, utility account information, and information associated with the organization’s energy infrastructure and operational technology environment. The information includes details concerning electrical distribution infrastructure, substations, transformers, feeders, operational systems, renewable-generation assets, outage information, and SCADA/EMS-related environments. The compromise data also include highly sensitive authentication and security information, including control-system credentials, API keys, and OT security configurations. We previously proposed resolving the incident through a peaceful and confidential process. According to our account, negotiations were subsequently discontinued after SDCEA CEO Jon Beyer indicated that the organization had decided to end discussions. As a result, we are issuing this public statement concerning the incident. In addition, we will take further disruptive actions to ensure that, in the future, those responsible for making these decisions approach the security of the resources entrusted to them—including the people within their area of responsibility—with greater awareness and seriousness. |
||||||
| Ransomware | Rimrock Foundation id33373 View details | United States | Other | pending | ||
|
Rimrock is the largest drug and alcohol addiction treatment center in the region, offering a comprehensive range of services for adults dealing with substance use and co-occurring disorders. The organization approaches addiction as a holistic illness that affects an individual's emotional, physical, spiritual, and social well-being. Their innovative and compassionate care includes various treatment options such as inpatient and outpatient programs, counseling services, and specialized therapies. Rimrock aims to create opportunities for recovery and balance in the lives of those impacted by addiction and mental illness. |
||||||
| Ransomware | Guardian Pharmacy LLC id33367 View details | United States | Healthcare / Pharma | pending | ||
|
Hacked; more news coming soon. . . |
||||||
| Ransomware | Den Hartog Industries id33368 View details | United States | Manufacturing / Engineering | pending | ||
|
Den Hartog Industries specializes in plastic and metal manufacturing, offering a wide range of products including tanks, marine products, and custom molded parts. Their divisions include Ace Roto-Mold, Injection Molding, Blow Molding, and Sowjoy, catering to agricultural, industrial, OEM, and marine clients. Known for innovation and high-quality standards, they provide comprehensive services from design to delivery. Den Hartog Industries is committed to exceeding customer expectations with their diverse product offerings. |
||||||
| Ransomware | Northern Counties Health Care id33369 View details | United States | Healthcare / Pharma | pending | ||
|
With five community Health Centers, two dental centers, and a certified Home Health Care & Hospice division, NCHC provides health care services to patients throughout Vermont |
||||||
| Ransomware | Post Metal Recycling id33370 View details | United States | Manufacturing / Engineering | pending | ||
|
Post Metal Recycling specializes in buying scrap metal from businesses and individuals, offering both ferrous and non-ferrous recycling services. They provide on-site scales for accurate measurements and facilitate various recycling options including yard drop-off, roll-off service, and site clean-up. The company emphasizes the environmental benefits of recycling, such as energy conservation and resource preservation. With a commitment to honesty and excellent customer service, Post Metal Recycling aims to create jobs and generate income through their operations. |
||||||
| Ransomware | bcx.co.za id33274 View details | South Africa | Services | pending | ||
|
www.bcx.co.za BCX (Business Connexion) https://www.zoominfo.com/c/business-connexion-pty-ltd/372844609 Total leak: 500 GB 4,224,088 Files, 596,613 Folders The leak includes source code, technical documentation and other confidential information. Source code: 6 fully functional business applications 15+ integration libraries/modules 10+ test and utility projects BUSINESS APPLICATIONS 1) Cemetery Management / Cemres 2) mSCOA Posting Level Creator 3) SolarReceipting 4) PortalSSO / Solution_Menu 5) StopWatch Reports 6) ChangeRequestManager INTEGRATION PLATFORM 1. WfService 2. SolarMenuStructure 3. AssemblyConnector 4. Purchase Requisition Connectors 5. BcxConnector 6. XMConnect 7. HelpRoutine 8. Lookup Connectors etc Numerous vulnerabilities have been found in current versions of business applications! |
||||||
| Ransomware | bakemyday.se id33261 View details | Sweden | Retail / E-commerce | leaked | ||
|
Bake My Day vill erbjuda fler människor hantverksmässiga, äkta och generösa konditori- och bageriupplevelser! Våra rykande färska bröd och bakverk är bakade från grunden för hand på utvalda råvaror. Employees: 10 Revenue: $5 Million Phone Number: 010 199 71 71 |
||||||
| Ransomware | AHEAD id33221 View details | United States | Services | pending | ||
|
AHEAD is a Chicago-based IT consulting and engineering firm specializing in the digital transformation of large enterprises. It offers strategic consulting and managed services across cloud, cybersecurity, data and AI, infrastructure, and operations. The company positions itself as an "engineering-led" partner that takes responsibility for outcomes at every stage — from design to ongoing operations. Following its acquisition of CDI, AHEAD's revenue exceeded $3.7 billion, with a workforce of more than 2,500 employees across 40 locations worldwide. |
||||||
| Ransomware | nsbsd.org id33222 View details | United States | Other | pending | ||
|
North Slope Borough School District is a public school district serving the remote communities of Alaska's North Slope, headquartered in Utqiaġvik. It operates 11 schools across the borough, enrolling approximately 2,044 students from Pre-K through 12th grade. The district's mission is rooted in Iñupiaq culture, aiming to develop students who are "empowered, culturally rooted, bilingual, healthy, critical, creative, life-long learners". For the 2025-2026 fiscal year, the district received $38,766,371 in local funding from the North Slope Borough, with per-pupil spending significantly above the national average at approximately $40,367 |
||||||
| Ransomware | pharma5.ma id33161 View details | Morocco | Healthcare / Pharma | leaked | ||
|
Pharma5 21, Rue des Asphodèles, Maârif Extension, 20100 Casablanca, Morocco 05 22 23 62 15 pharma5.ma Leaked data: 50Gb Corporate and financial information, data on products and their supply, quality control and certification, drug testing and related issues, employee personal data, counterparties, and much more. |
||||||
| Ransomware | bnlawmacau.com www.bn-ip.com id33151 View details | Macao | Finance / Legal / Insurance | pending | ||
|
full data all country |
||||||
| Ransomware | welgenone.com id33152 View details | United States | Manufacturing / Engineering | pending | ||
|
Welgen One is a mobile wellness service provider based in Georgia, USA, offering personalized wellness care and dispensary access across Atlanta. The company focuses on delivering innovative healthcare solutions, including remote patient monitoring and onsite wellness programs, to enhance overall well-being. Targeting individuals seeking convenient and comprehensive health services, Welgen One aims to revolutionize the healthcare experience by prioritizing patient-centered care. With a commitment to accessibility and customization, they utilize advanced technology and data to optimize health outcomes |
||||||
| Ransomware | ukbjja.org id33153 View details | United Kingdom | — | pending | ||
|
full data |
||||||
| Ransomware | Grupo Caberj id33138 View details | Brazil | — | pending | ||
|
O Grupo Caberj, que oferece uma ampla gama de seguros, foi hackeado há 10 dias |
||||||
| Ransomware | Lemon Law id33090 View details | United States | Finance / Legal / Insurance | pending | ||
|
Virginia A Lemon PLLC 267 Stratton Aly, Lewisburg, West Virginia, USA vlemonlaw.com Leaked data: 16.8 Gb, 42к files corporate documents, litigation materials, client personal data, financial documents and reporting, personal files of employees, and much more. |
||||||
| Ransomware | SECOND HOUSE id33018 View details | Spain | — | pending | ||
|
Second House (Second House, S.L.) is a privately held real estate company headquartered in Barcelona, Spain, with over 26 years of experience in the property sector. Their business model centers on buying properties and adding value to them — through renovation works, improving rental situations, and legalizing the existing state of buildings — effectively driving renewal of the real estate market in Barcelona and its surroundings. They are actively acquiring in the Barcelona area (including L'Hospitalet, Badalona, Sant Cugat, etc.) |
||||||
| Ransomware | Maryann Kriger id33019 View details | United States | — | pending | ||
|
At Bonita Orthodontics, Dr. Maryann Kriger and our friendly team provide personalized orthodontic care using state-of-the-art technology. As a board-certified orthodontist and Elite Invisalign Provider, Dr. Kriger takes a conservative approach — creating simple, affordable treatment plans that deliver beautiful, lasting smiles. Call today to schedule your free consultation! We have reached out to Bonita Ortho on multiple occasions to prevent this leak, warning them that it exposes the private information of patients who are minors. Despite this, our messages have been ignored. |
||||||
| Ransomware | www.roancampingholidays.com id32964 View details | Netherlands | Hospitality / Food & Beverage / Tourism | leaked | ||
|
Roan Luxury Camping Holidays is a Dutch tour operator specializing in deluxe mobile home and tent rentals at 4- and 5-star campsites across Europe |
||||||
| Ransomware | www.kendallhunt.com id32965 View details | United States | Education | leaked | ||
|
Founded in 1944, Kendall Hunt Publishing is a publisher of hands-on, inquiry-based science, mathematics, and gifted curricula for grades PreK-12. Their research and standards-based programs are available in both print and digital components that encompass students, teachers, and parents. Kendall Hunt is headquartered in Dubuque, IA. |
||||||
| Ransomware | Silicon Integrated Systems id32929 View details | Taiwan, Province of China | IT | pending | ||
|
Silicon Integrated Systems Corporation (SiS) is a Taiwan-based professional IC design company specializing in analog and mixed-signal technologies. |
||||||
| Ransomware | www.appliancefactory.com id32918 View details | United States | Manufacturing / Engineering | pending | ||
|
Appliance Factory & Mattress Kingdom offers a wide range of discount appliances and mattresses, providing unbeatable savings to customers across multiple locations including Colorado, Kentucky, Wyoming, and Indiana. Their extensive product lineup includes kitchen appliances, laundry machines, refrigeration units, and various mattress types from well-known brands. The company emphasizes next-day delivery, professional installation, and financing options to enhance customer convenience. Targeting homeowners and trade partners, they pride themselves on excellent service and a hassle-free shopping experience. |
||||||
| Ransomware | www.diarco.com.ar id32919 View details | Argentina | Services | leaked | ||
|
Diarco is a company that operates in the HR & Staffing industry. It employs 1000to4999 people and has 1Gto5G of revenue. The company is headquartered in San Telmo, Capital Federal, Argentina. |
||||||
| Ransomware | jms building corporation id32736 View details | United States | Construction / Real Estate | pending | ||
|
JMS Building Construction is a full service Insurance Restoration construction company that handles every step of the Insurance Restoration process, from dealing with your insurance company to restoring your home's integrity WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! |
||||||
| Ransomware | cullottalaw.com id32723 View details | United States | Finance / Legal / Insurance | pending | ||
|
Cullotta Bravo Law Group is a personal injury law firm based in Aurora, IL, with over 35 years of experience in various legal areas including personal injury, nursing home abuse, and workers compensation. |
||||||
| Ransomware | https://mediengruppethiel.de/ id32713 View details | Germany | Services | pending | ||
|
Die Mediengruppe Thiel aus Ludwigsfelde ist Ihr verlässlicher Druck- und Werbepartner, wenn es um individuelle Lösungen für innen und außen geht. Ob eindrucksvolle Printprodukte, maßgeschneiderte Werbetechnik oder professionelle Geschäftsausstattung – bei uns erhalten Sie alles aus einer Hand. Dank unseres breiten Leistungsspektrums sparen Sie sich Wege, Schnittstellen und Zeit – und können sich ganz auf Ihr Kerngeschäft konzentrieren. Unser engagiertes Team aus Ideengebern, Technik-Profis und Gestaltern begleitet Sie dabei von der ersten Idee bis zur fertigen Umsetzung. |
||||||
| Ransomware | Wellness Partners network(combined revenue) id32648 View details | United States | Services | leaked | ||
|
Headquartered in Clinton, New York Community Wellness Partners is a faith based non-profit organization that provides healthcare, housing and community services. They also have 24/7 skilled-nursing care to older adults who require residential medical care and support services. |
||||||
| Ransomware | myglobal.com id32460 View details | Malaysia | Services | leaked | ||
|
My Global Services Sdn Bhd is the first authorized distributor of OLED LiFi in Malaysia, specializing in OLED LiFi technology, mechanical and electrical engineering, as well as civil and construction services. The company provides solutions for scientists and research workers, offering sales and support for scientific equipment. Their services include civil and structural engineering, ensuring a comprehensive approach to their clients' needs. With a focus on innovative lighting solutions, they aim to enhance the capabilities of their clients across various sectors. Employees: 10 Revenue: $5 Million Industry: Architecture, Engineering & Design Phone Number: +60 358922797 |
||||||
| Ransomware | Asfaltos y Pavimentos S.A. (Asfalpasa) id32421 View details | Spain | Agriculture / Food | leaked | ||
|
Empresa dedicada a la fabricación, transporte y extendido de mezclas asfálticas así como todo tipo de servicios relacionados con la construcción y mantenimiento de carreteras, vias públicas y privadas. Desde sus comienzos en 1982 Asfaltos y Pavimentos (ASFALPASA) se basa en un equipo humano especializado y experimentado en la actividad que posteriormente llevaría a cabo la empresa. Dicha experiencia aporta a la empresa un rápido crecimiento y un alto grado de especialización y competitividad que hace de Asfalpasa una de las empresas más conocidas de su sector. |
||||||
| Ransomware | Westfield Public School District id32422 View details | United States | Education | leaked | ||
|
Westfield Public Schools is dedicated to educating all students to reach their highest potential as engaged citizens who value diversity. The district focuses on inclusivity, community engagement, wellness, and comprehensive financial planning to enhance the educational experience. Their strategic plan outlines long-term goals and strategies to align resources with the needs of students and staff. The intended clients include students, families, and the broader community in Westfield, NJ. |
||||||
| Ransomware | Trucka id32423 View details | Mexico | Transportation / Travel / Logistics | leaked | ||
|
Trucka is a transportation and logistics company that helps businesses move goods across different regions. They handle everything from local deliveries to long-distance shipping, working with companies of all sizes. Their trucks cover major routes, making sure packages and freight get where they need to go safely and on time. With a team of experienced drivers and a solid network of shipping routes, Trucka makes moving cargo simple and reliable. |
||||||
| Ransomware | Policlinico Triestino id32424 View details | Italy | Healthcare / Pharma | leaked | ||
|
Policlinico Triestino S.p.A. is a private healthcare network based in Trieste, Italy, that operates hospitals, nursing homes, and outpatient clinics. |
||||||
| Ransomware | Multiver Ltée id32425 View details | Canada | — | leaked | ||
|
Multiver Ltée specializes in the manufacturing of glass products, offering a range of solutions from sealed to tempered and shaped glass. With over 50 years of experience, the company is renowned for its craftsmanship and commitment to timely delivery. They have successfully completed various architectural projects, showcasing both subtle and bold designs. Their intended clients include those looking to enhance their construction with high-quality glass features. |
||||||
| Ransomware | Metales Panamericanos id32426 View details | Panama | Manufacturing / Engineering | pending | ||
|
English Metales Panamericanos, previously known as ACERO PANAMA, is the main construction & steel supplier to the Construction industry in Panama, initially focus in steel materials, now our new mission is extended to different constructions systems, Electrical Solutions, Equipment & Devices, zing ceilings, strollers, metal wires, windows structures, gypsum, among others. Spanish Metales Panamericanos S.A. (METALPAN), previamente conocida como ACERO PANAMA, es una dinmica y exitosa sociedad 100% panamea que se constituyo como METALPAN en el ao 1991, y que ha sabido transformarse y crecer con firmeza para responder de manera rpida y eficaz a las exigencias del clientes con altos niveles de competitividad presentes en el mercado nacional. |
||||||
| Ransomware | specialtytextile.com id32412 View details | United States | Manufacturing / Engineering | pending | ||
|
Specialty Textile Services is a U.S. textile services company founded in 1996, specializing in linen rental and processing for the hospitality industry. Headquartered in Phoenix, Arizona, with a branch in San Diego, California, the company employs between 201 and 500 people. Serving mid-to-high-end restaurants, hotels, and other hospitality providers, Specialty Textile Services offers flexible rental programs covering a full line of linens, kitchen textiles, uniforms, and dust control products — all delivered clean and ready for use. Key features include: flexible pickup and delivery schedules, including multiple weekly service visits; all-inclusive service pricing with no upfront investment required from customers; an in-house commercial laundry facility operating 7 days a week, 365 days a year, with rapid emergency response available for special requests. |
||||||
| Ransomware | New Century Ophthalmology Group id32339 View details | United States | Healthcare / Pharma | pending | ||
|
New Century Ophthalmology is a leading ophthalmology practice located in Raleigh and Oxford, NC, specializing in advanced eye care services including cataract surgery, glaucoma treatment, and oculoplastic procedures. The practice is dedicated to providing personalized, high-quality care with a focus on patient well-being and innovative treatment options. Their team of fellowship-trained specialists utilizes state-of-the-art technology to ensure optimal outcomes for a variety of eye conditions. New Century Ophthalmology serves a diverse clientele seeking comprehensive eye health solutions and aesthetic enhancements |
||||||
| Ransomware | zummocorp.com id32331 View details | United States | IT | leaked | ||
|
Zummo is a global incumbent in the design, manufacture and commercialization of automatic fresh fruit juice extraction machines, mainly aimed at the food service and food retail segments. |
||||||
| Ransomware | www.lichtvision.com id32332 View details | United Kingdom | Manufacturing / Engineering | pending | ||
|
Lichtvision specializes in innovative lighting design, focusing on architectural spaces through the use of daylight, artificial light, and immersive media technologies. With a team of 40 designers, architects, and engineers, they provide sustainable and aesthetically pleasing lighting solutions for a variety of projects, including museums, offices, and retail spaces. Established in 1997, Lichtvision has a global presence with studios in major cities and emphasizes a holistic approach to lighting that enhances the quality of life. Their work is characterized by a blend of creativity, technical expertise, and a commitment to ecological sustainability. |
||||||
| Ransomware | www.renorefractories.com id32333 View details | United States | Manufacturing / Engineering | pending | ||
|
RENO Refractories, Inc. specializes in the manufacturing of refractory products and services for various industrial applications, including aluminum, iron and steel, cement and lime, foundries, mini mills, and hydrocarbon processing. With over 35 years of experience, the company is committed to innovation and quality, providing advanced research and development, technical support, and installation services. Their product offerings include a full range of monolithic products and the revolutionary ElectroCast product line. RENO aims to optimize the profits and safety of their clients by delivering superior refractory technology across North America. |
||||||
| Ransomware | cimbsecurities.com id32334 View details | Malaysia | Finance / Legal / Insurance | pending | ||
|
Bank |
||||||
| Ransomware | wittmann id32260 View details | Mexico | Manufacturing / Engineering | pending | ||
|
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation.NDA files |
||||||
| Ransomware | Oilquip Inc id32253 View details | United States | Services | pending | ||
|
Oilquip Inc, established in 1960, is a comprehensive fluid power distributor that specializes in hydraulics, pneumatics, oil conditioning, and system integration. The company is dedicated to providing innovative electro-hydraulic and electro-mechanical solutions while exceeding customer expectations. Their services include design and engineering, fluid conditioning, power generation, and repairs and upgrades, catering to a diverse range of clients. Oilquip prides itself on its customer-focused approach, flexibility, and commitment to excellence in all aspects of its operations. |
||||||
| Ransomware | BENCIVIL id32204 View details | United States | IT | pending | ||
|
Benchmark Civil Engineering Services, Inc. is a civil engineering firm based in Allentown, PA, specializing in civil engineering, traffic studies, forensic engineering, and land surveying. The company serves municipalities and clients in the Lehigh Valley and surrounding areas, providing expert services in traffic and transportation engineering, land development, and construction engineering. With a focus on professionalism and integrity, Benchmark is committed to guiding clients through the design, approval, and construction processes. Their highly trained staff utilizes state-of-the-art technology to ensure project success and compliance with regulations. |
||||||
| Ransomware | Rohloff Group id32198 View details | South Africa | Services | pending | ||
|
KFC Rohloff Group franchise partner Total leak: 536 GB, 103,196 Files, 30,805 Folders Data: Employees personal , Loan applications, Employees banking details, ID's, Bank account statements, Employees ACKNOWLEDGEMENT OF DEBT, RESULT OF THE DISCIPLINARY HEARING, Financial documentation for royalties, Food Cost Reconciliation and a lot of other documentation. Data type: Confidential Full publication coming soon. |
||||||
| Ransomware | Ruby Seven Studios id32193 View details | United States | IT | pending | ||
|
Ruby Seven Studios Inc. https://www.rubyseven.com/ Total leak: 114 GB (123,463,823,360 bytes), 133,851 Files, 49,357 Folders. Data: Source code, Games Rules, Game assets, Game math, GDD, IGT, Analytics report Finance doc's, Royalty Reports, Tax invoice, Inventions Agreement - Employee intellectual property assignment, non competition and confidentiality agreement Personal ID/Passport, Share holders list. Data type: Confifential Partners: IGT (International Game Technology), Konami Gaming, Wazdan, Bluberi Gaming, CHAYOWO TECHNOLOGY, Everi & Aristocrat Bally's Corporation, Delaware North Gaming, Pechanga Resort & Casino, Mystic Lake Casino Hotel, Affinity Interactive, Choctaw Casinos & Resorts. Full publication coming soon. |
||||||
| Ransomware | FFKR Architects id32078 View details | United States | Manufacturing / Engineering | pending | ||
|
FFKR Architects is a leading architecture and interior design firm based in Utah, with additional offices in Arizona and Idaho. They offer a wide range of services including architecture, landscape architecture, interior design, and environmental graphic design. The firm is known for its design excellence and commitment to environmental leadership, serving various sectors such as healthcare, education, hospitality, and commercial projects. With a team of over 170 professionals, FFKR empowers clients through innovative visualization techniques, ensuring informed decision-making. |
||||||
| Ransomware | el-group id32011 View details | Switzerland | null | pending | ||
|
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. |
||||||
| Ransomware | BANGKOKCABLE id31891 View details | Thailand | — | pending | ||
|
About Bangkok Cable Bangkok Cable is Thailand's leading manufacturer of electric wires and cables, boasting over five decades of sustainable growth. The company is committed to connecting people with power and driving economic development through innovative manufacturing technologies. With a production capacity of 30,000 metric tons per year for copper and 15,000 metric tons for aluminum cables, Bangkok Cable adheres to high-quality standards and sustainable practices. Their products serve a wide range of clients, contributing to the country's development and enhancing the quality of life through reliable electrical power. |
||||||
| Ransomware | UNIPLASTICS.COM id31892 View details | United States | — | pending | ||
|
Universal Plastics Inc. is a family-owned commercial specialty subcontractor with over 50 years of experience, specializing in custom wall panel systems, wall protection, and high-impact wall coverings. They serve a diverse clientele, including commercial projects such as airports and medical facilities, providing innovative solutions with materials like FRP, stainless steel, and plastic laminates. As a master distributor for Marlite in Northern California, they also offer a wide range of products including solid surfaces and decorative wall panels. Their commitment to quality and customer service makes them a leader in the industry. |
||||||
| Ransomware | CDGARVINLAW id31893 View details | United States | — | pending | ||
|
CHRISTOPHER D. GARVIN (Docket #2352300) is a Wood-Ridge attorney admitted to New York State in 1990 and registered with the Office of Court Administration (OCA) of the New York State Unified Court System. Employer - CHRISTOPHER D. GARVIN, ESQ. COUNSEL AT LAW. The attorney graduated from SETON HALL UNIVERSITY. The registered office is located at 268 Valley Blvd, Wood Ridge, NJ 07075-1202, contact telephone: (201) 804-7681. Current lawyer status: registered. |
||||||
| Ransomware | EXEL id31894 View details | Canada | — | pending | ||
|
Exel Systems Inc. specializes in providing high-quality custom heating, ventilation, and air conditioning (HVAC) and energy recovery products. Established in 1993, the company serves the institutional, commercial, and industrial markets, collaborating with building owners, consulting engineers, and contractors to deliver innovative and energy-efficient solutions. Their extensive product range and expertise enable them to handle complex projects tailored to specific client needs. Exel Systems encourages clients to explore their website for new products and application information to enhance building sustainability. |
||||||
| Ransomware | SpearFin Ltd id31824 View details | Mauritius | — | pending | ||
|
SpearFin Ltd https://spearfin.net SpearFin offers a wide range of services including fund administration, corporate services, compliance support, and investor relations. Assets Under Administration US$10 billion. The leak occurred on June 26, 2026. Total leak: 416 GB Leak included: NDA, Correspondence Client, KYC - Passports, Certificates, Investing documents, Share Registry and Holders, Anti-Money Laundering (AML) audit, Agreements, Application forms, Bank Statements, Bank Payrolls, Loans Documents, Certificates of GBC (Global Business Company), Register of Directors and many other financial documents. Clients: YuMee Seven Six, BAMBOO BAY PRIVATE LIMITED, Asio Global Fund, 3B Capital, Abans Group, Amicorp Capital, Apex Fund Services Ltd, Pangaea Fund Limited, AL Farah Overseas Limited, Zinnia Group, AMG Services Ltd, NEO SEMI SG PTE. LTD, MIC ELECTRONICS LIMITED, Zenbridge Capital Pvt. Ltd., Zinnia Investment Advisers Pvt Ltd, Onpoint Ventures Limited, Wilson Group, Blue River, Capital Advisors Private Limited, Zenbridge Capital Pvt Ltd, Topland Group Holdings, Africa Opportunities Fund, Appollo Fund Limited and many other... Type of information: Confidential Full publication coming soon... |
||||||
| Ransomware | ssf-int.com ssf-ing.de id31825 View details | Germany | — | pending | ||
|
SSF International GmbH is an engineering firm headquartered in Munich, Germany. A subsidiary of SSF Ingenieure AG, the company provides comprehensive engineering services in project management, supervision, consultancy, design, quality management, and special construction design worldwide. It specializes in railways, high-speed railway lines, metro and light rail, Maglev lines, and large infrastructure projects, including bridges and railway stations. The company serves international clients across various stages of project development, from early studies and design to construction, commissioning, operation, and maintenance. Its service portfolio includes BIM and GIS solutions, environmental protection, and specialized solutions for acoustic and vibration control. |
||||||
| Ransomware | nyklawfirm.com nyk.ae id31826 View details | United Arab Emirates | — | pending | ||
|
/ |
||||||
| Ransomware | Foresee Pharmaceuticals id31822 View details | Taiwan, Province of China | — | pending | ||
|
Foresee Pharmaceuticals Co., Ltd. https://www.foreseepharma.com Total leak: 1,2TB Leak includes: Drug Master File, ASMF, FDA/EMA, R&D, Financial statements, Clinical study reports and other confidential information. Projects: CAMCEVI, SIF, Casppian, NCE, Aderamastat, Linvemastat, FP-045, FP-016, FP-018, FP-014... Partners: Accord BioPharma, Intas Pharmaceuticals, Primevera Therapeutics, Accord Healthcare... Type of information: Confidential |
||||||
| Ransomware | SD Associates Sdn Bhd id31810 View details | Malaysia | — | pending | ||
|
SD Associates (SDA) is a globally expanding company that prides itself in providing quality service to every client. We provide comprehensive professional project management and engineering consultancy services in diverse market segments. Our multi-disciplinary teams consisting of experienced Project Managers, Professional Engineers, Architects, Quantity surveyors, and Technical Support Managers. We are an ISO 9001, ISO 45001, and ISO 14001 certified WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! |
||||||
| Ransomware | Third Coast Bancshares id31811 View details | United States | — | pending | ||
|
While Third Coast Bancshares (NASDAQ:TCBX) shares continue to rise rapidly and reach new highs, its leadership is concealing one of the largest data breaches in the history of the U.S. financial sector. This situation raises serious questions about the company’s conduct. In the near future, we intend to publish a comprehensive analytical report examining the TCBX activities. The public will then have an opportunity to assess the practices carried out by the company, including violations of applicable laws and regulations, as well as the conduct of certain shareholders and business partners. Our report will also examine allegations involving individuals connected to financial-sector regulators and law enforcement. Corruption, manipulation of data, regulatory non-compliance, and the submission of potentially misleading reports represent only a small part of the concerns we intend to address. We believe the time has come to initiate short positions. Our forthcoming publications are expected to raise significant questions about the company and could have broader implications for confidence in the U.S. financial sector. As for clients and stakeholders of the financial institution, We strongly recommend that clients safeguard their funds and consider withdrawing them in the near term. Stay tuned for further updates and the release of our detailed findings. |
||||||
| Ransomware | Lansing Urgent Care id31799 View details | United States | — | pending | ||
|
Lansing Urgent Care provides a range of urgent care services for both adults and children, including on-site medications, lab tests, and X-rays. Their facilities are designed for quick visits, with an average wait time of under one hour, and they offer telemedicine options for added convenience. The company caters to patients seeking immediate medical attention, sports physicals, and occupational health services. With multiple locations in Lansing, Okemos, and surrounding areas, they aim to deliver friendly and efficient healthcare. |
||||||
| Ransomware | Otter Tail County, Minnesota id31785 View details | United States | — | leaked | ||
|
https://ottertailcounty.gov/ |
||||||
| Ransomware | https://pacific-construction.com/ id31669 View details | United Kingdom | Construction / Real Estate | pending | ||
|
project data client data contract |
||||||
| Ransomware | cambrialawfirm.com id31670 View details | Canada | — | pending | ||
|
personal and medical cards of all clients. |
||||||
| Ransomware | clgroup id31657 View details | United States | Finance / Legal / Insurance | pending | ||
|
Compunnel, founded in 1994 and headquartered in Plainsboro, New Jersey, provides information technology consulting and staffing, custom business application development, and eLearning services |
||||||
| Ransomware | gamaus.com id31652 View details | United States | IT | pending | ||
|
https://www.zoominfo.com/c/greater-austin-merchants-cooperative-association/98978085 greater-austin-merchants-cooperative-association 400gb |
||||||
| Ransomware | BEDC.COM.AU id31599 View details | Australia | Education | pending | ||
|
Brighton East Dental Clinic (BEDC) is a family dental clinic dedicated to providing comprehensive dental care for families in Brighton, Caulfield, and Bentleigh. They offer a wide range of services including kids dentistry, general dentistry, cosmetic procedures, and preventative care, with a strong emphasis on patient needs and comfort. With over 30 years of experience, their team of certified dentists focuses on creating healthy, happy smiles while accepting all major health funds. The clinic is known for its convenient evening hours and commitment to emergency dental care. Employees: 50 Revenue: $5 Million Industry: Dental Practice Management Phone Number: +61 395788500 |
||||||
| Ransomware | diabetesandmetabolism.com id31600 View details | United States | Healthcare / Pharma | pending | ||
|
Diabetes and Metabolism Specialists is a specialty medical clinic located in San Antonio, TX, focused on the diagnosis and treatment of endocrine-related medical conditions. The clinic is staffed by board-certified endocrinologists, nurse practitioners, and certified diabetes educators who provide comprehensive care and education for chronic conditions such as diabetes, hyperparathyroidism, and metabolic syndrome. They emphasize professionalism and patient education, ensuring that clients understand their diagnoses and treatment options. The intended clients are individuals seeking specialized care for endocrine disorders and metabolic conditions. Employees: 50 Revenue: $5.5 Million Industry: Hospitals & Physicians Clinics Phone Number: (210) 494-3739 |
||||||
| Ransomware | stuartandassociates.com id31646 View details | United States | — | pending | ||
|
Stuart & Associates Commercial Flooring, Inc. specializes in providing high-quality commercial flooring solutions designed to enhance customer experiences. They offer a three-year warranty on new installations when clients purchase maintenance programs, ensuring satisfaction and value throughout the process. The company features a design center with extensive product samples and emphasizes delivering projects on budget and on schedule. Their target clients include businesses seeking safe, comfortable, and aesthetically pleasing flooring options. Employees: 50 Revenue: $6.4 Million Industry: Construction Management Phone Number: (316) 267-0743 |
||||||
| Ransomware | Louisville Bar Association id31481 View details | United States | NGOs / Associations | pending | ||
|
The Louisville Bar Association (LBA) provides a range of services including membership benefits, legal job placement, continuing legal education (CLE), and public service initiatives. It aims to support legal professionals at all stages of their careers while promoting diversity and community engagement within the legal field. The LBA also offers resources for individuals seeking legal representation and hosts various events and awards to recognize outstanding contributions in the legal community. Their intended clients include legal professionals, law firms, and individuals in need of legal assistance in the Louisville area. |
||||||
| Ransomware | ATMS id31462 View details | India | Other | pending | ||
|
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. |
||||||
| Ransomware | vprj.org id31352 View details | United States | NGOs / Associations | pending | ||
|
The Virginia Peninsula Regional Jail (VPRJ) is a state-authorized, regional correctional facility located in Williamsburg, Virginia, USA. Opened in 1997, VPRJ provides short-to-medium-term detention services, ensuring public safety and order across the Virginia Peninsula region under the governance of a multi-jurisdictional jail board. |
||||||
| Ransomware | lantisnet.com id31244 View details | United States | IT | pending | ||
|
Lantis Enterprises, Inc. is an American consulting and management organization historically rooted in rural healthcare, skilled nursing, and senior living operations. Headquartered in Spearfish, South Dakota, the firm has expanded its focus to cross-industry advisory services |
||||||
| Ransomware | Loyalist College id31243 View details | Canada | Education | pending | ||
|
The management of this institution was repeatedly warned about the disclosure of hundreds of personal data. Each of you who is faced with the consequences of the leak can be absolutely sure that the management of Loyalist College absolutely does not care about its students, employees and partners. ------------------------- Loyalist is Ontario's Destination College, empowering students, faculty, staff, and partners through experiential, industry cluster-based education, training and applied research programs. The College provides job-ready graduates for, and knowledge transfer to, industry and the community. |
||||||
| Ransomware | TRULITE GLASS & ALUMINUM SOLUTIONS id31240 View details | United States | Manufacturing / Engineering | pending | ||
|
TRULITE GLASS & ALUMINUM SOLUTIONS Date: August 2026 Overview Trulite Glass & Aluminum Solutions, a portfolio company of Truelink Capital (Los Angeles, CA), is a leading North American fabricator and distributor of architectural glass and aluminum systems. Headquartered in Alpharetta, Georgia, the company operates 40+ fabrication and distribution facilities across the United States and Canada, serving the commercial construction industry. Trulite was founded in 1978 and has undergone significant expansion through acquisitions — including Vitro America, Western States Glass, AGC Fabrication, Super Sky Products, American Insulated Glass, and others. In October 2022, Truelink Capital acquired Trulite from Sun Capital Partners. The company generates estimated annual revenue of $800M–$1.2B and employs 2,000–3,500 people. Incident We have obtained full and unrestricted access to Trulite's internal infrastructure. The total volume of exfiltrated data exceeds 8 terabytes. Data in Our Possession The dataset includes but is not limited to: - Complete corporate databases — ERP system (Microsoft Dynamics AX), CRM, operational databases - Financial records — multi-year Profit & Loss statements by branch, EBITDA schedules, debt covenant compliance calculations, 13-week cash flow forecasts, weekly and monthly financial reporting packages prepared for private equity ownership - M&A documentation — Confidential Information Memorandums (CIM), executed Stock Purchase Agreements, acquisition pipeline documents, due diligence materials, corporate structure charts with ownership percentages - Private equity communications — internal correspondence and reporting between Trulite management and fund ownership (Sun Capital Partners, Truelink Capital) - Board of Directors materials — governance records, board presentations, strategic planning documents - HR and employee data — personnel records, payroll, benefits information - Customer and vendor data — contracts, pricing agreements, project documentation, accounts receivable/payable - IT infrastructure documentation — network architecture, system configurations, credentials - Operational data — production records, logistics, fleet management, facility documentation across all 40+ locations Proof of Access Sample data will be published to confirm the scope and authenticity of the breach. Full data publication will follow if no resolution is reached. Contact The Trulite management team has been contacted directly and provided with instructions to initiate private negotiations. A deadline has been communicated. This is the only public statement at this time. Further updates — including data samples — will follow according to the established timeline. |
||||||
| Ransomware | pushidrosal.id id31201 View details | Indonesia | Other | pending | ||
|
* |
||||||
| Ransomware | lccgroup.com id31202 View details | Philippines | Construction / Real Estate | pending | ||
|
LCC - Liberty Commercial Center, Inc is one of the pioneering retail establishments in the Bicol Region. Based in the dynamic province of Albay, LCC primarily operates supermarkets, department stores, malls, and food establishments. LCC is also engaged in property development. Banking on the cherished Filipino trait of hospitality, LCC's corporate tagline - The company's Best For You empowers its stakeholders and corps of new - generation and seasoned managers to commit themselves to a market stewardship that puts a high premium on rewarding LCC customers for their loyalty and patronage. LCC's growth is rooted in the Filipino spirit of entrepreneurship as an agent of change and progress. Over 75 years of retailing knowhow and quality service continue to touch the lives of its Bicolano consumers and their communities www.lcc.com.ph |
||||||
| Ransomware | https://geleximco.vn/ id31203 View details | Viet Nam | Manufacturing / Engineering | pending | ||
|
200gb data |
||||||
| Ransomware | clintonhealthaccess.org id31200 View details | United States | NGOs / Associations | pending | ||
|
This Clinton foundation sponsors the sterilization of women in Africa and South America. With the help of this foundation, organs harvested criminally by transplant surgeons from people in Third World countries are legalized to improve the quality of life of the rich in capitalist countries, including the United States. We have irrefutable evidence of their secret accounts, including transactions in cryptocurrency, from which transplanted organs were purchased to replace Bill Clinton's wife, Hillary Clinton. |
||||||
| Ransomware | Oleoductos del Valle id31199 View details | Argentina | Energy | pending | ||
|
During the analysis of data obtained from Oldelval, we have compiled information covering key aspects of the company's operations. The materials include: 1.HR documentation: full payroll data, bank account details (CBU), employee health insurance records (OSDE, SWISS MEDICAL), as well as severance calculations and compensation agreements. 2.Financial and regulatory reports filed with CNV and BYMA, including documents related to rating agencies (Moody's) and internal shareholder agreements. 3.Tax declarations and reports submitted to AFIP (Sicore, Ganancias, DDJJ IVA). 4.Documents related to tariff policy and SEN interactions, including WACC and TIR calculations used in tariff reviews. 5.Incident reports and environmental documentation, including reports on spills in Catriel and Medanito, as well as Rosen OSSR technical reports on pipeline conditions. 6.Confidentiality agreements with key partners, including Halliburton, Horizon, YPF, Otasa, McKinsey, and KPMG. 7.Internal whistleblower channel materials (Ley 27.401), including internal complaints and compliance reports. 8.Documents related to dividend payments and banking transactions. 9.Personal data of directors, candidates, and key employees, including ID numbers and CVs. |
||||||
| Ransomware | ecfa.org id31167 View details | United States | NGOs / Associations | pending | ||
|
The Evangelical Council for Financial Accountability (ECFA) is an American accreditation agency founded in 1979 that certifies Christian churches and nonprofits based on financial integrity, board governance, and transparent fundraising. It represents over 2,700 member organizations with billions in collective revenue. |
||||||
| Ransomware | quantinuum.com id31147 View details | United States | IT | pending | ||
|
Quantinuum is a quantum computing company that develops advanced quantum computers, software, and cybersecurity solutions to solve complex scientific and industrial challenges. The company provides full-stack quantum technologies for areas such as materials science, drug discovery, encryption, artificial intelligence, and optimization, helping enterprises and researchers accelerate innovation through quantum computing. The leak dates back to pre-IPO. QUANTINUUM deliberately withheld this information from investors. The exact amount of stolen data will be revealed after publishing. |
||||||
| Ransomware | PARTNERED HEALTH GROUP id31063 View details | Australia | Healthcare / Pharma | pending | ||
|
PARTNERED HEALTH GROUP — Australia ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Industry: Healthcare — Primary Care, Occupational Health, Psychology, Telehealth Headquarters: Australia (NSW, QLD, VIC, WA, ACT) Owner: Quadrant Private Equity Clinics: 60+ nationwide Brands: Partnered Health Medical Centres, Jobfit, Baseline Onsite, New View Psychology, NewPsych, Australian EAP, Fuel Your Life, Northcare Physio, TeleWell Website: partneredhealth.com.au PENDING ACQUISITION: Bupa — ~$450,000,000 AUD Announced July 2, 2026 (Australian Financial Review) ACCC and FIRB regulatory approval pending. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ BREACH SUMMARY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Date of access: 23 June 2026 Data exfiltrated: 3.2 TB Total files: 2,298,203 Servers accessed: 21 (9 AD Controllers + 11 Best Practice Medical Servers + 1 Central SQL Server) SQL Databases: ZedMed.mdf, Payroll.mdf, DocPays.mdf, VectraplexECG.mdf, BPM.mdf + 1,104 SQL backups Clinics compromised: 21 locations across 5 states/territories Patient records: 17,727+ named patient files identified Staff HR files: Full employee records including passports, AHPRA registrations, tax declarations Period of data: 1999 — 2026 (27 years) ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ WHAT WE HAVE ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ ▪ Complete patient medical records from 21 GP clinics — consultation notes, referral letters, pathology results, diagnostic imaging reports, prescriptions ▪ Full SQL database dumps — ZedMed (patient management), Payroll (all staff salaries), DocPays (doctor payments), VectraplexECG (cardiac/ECG monitoring data) ▪ 11 complete Best Practice patient database backups — one per clinic — including BPSPatients, BPSDocuments (up to 48 document partitions per clinic) ▪ Staff HR files — employment contracts, passport scans, AHPRA medical registrations, tax file declarations, superannuation details, performance reviews ▪ Bupa corporate data — direct billing agreements, fund tables for all Australian states, patient invoices, corporate program documents (Bronze/Silver/Gold), and active Bupa web portal session cookies ▪ Financial records — QuickBooks databases (2004-2026), Medicare billing, DVA remittances, private health fund claims ▪ Clinical governance — full RACGP accreditation files, patient consent templates, internal clinical audit data ▪ 27 years of accumulated medical data (1999-2026) across ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ TO PARTNERED HEALTH / QUADRANT PRIVATE EQUITY ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Partnered Health was given the opportunity to resolve this matter privately and protect patient data. Instead of acting in the interest of their patients, they spent 22 days in silence, hired lawyers, and obtained a court injunction that has no practical effect outside Australian jurisdiction. Their public statement of July 15 describes the breach as affecting "some" data from "some" clinics. This is misleading. The reality: 3.2 terabytes. 2.3 million files. 21 servers. 27 years of patient medical history. Every clinic server in their network was accessed. Complete SQL database dumps were taken including the central patient management system and payroll for every employee. And critically — the data includes Bupa's own corporate information: billing agreements, fund pricing tables for every Australian state, named patient invoices, and active browser session cookies from Bupa's login, corporate, and web portals. We understand this acquisition matters. $450 million is a significant transaction. A full data publication would create material regulatory complications with the ACCC and FIRB review process. We trust the board and advisors at Quadrant understand what that means. This is not a threat. This is a deadline. ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ DEADLINE: [DATE + 10 DAYS] ━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━ Partnered Health has 10 days to resume negotiations and reach a settlement. If no agreement is reached: Stage 1 — Complete file tree listing (2.3M files) + all HR/staff records published Stage 2 — SQL databases (ZedMed, Payroll, ECG) released for download Stage 3 — Bupa corporate data, fund tables, billing agreements, session data published. ACCC, FIRB, and Bupa executive leadership notified directly. Stage 4 — Full 3.2 TB data dump made available for public download. |
||||||
| Ransomware | sslf.local id31059 View details | United States | Other | pending | ||
|
Samuels & Thornton is a law firm based in New Orleans, specializing in medical malpractice and personal injury cases. They provide personalized legal guidance to individuals, families, and businesses facing legal challenges, ensuring that each client receives dedicated attention from experienced attorneys. Their practice areas include medical malpractice, product liability, auto accident litigation, and more. The firm is committed to delivering proven results and effective representation throughout Louisiana. |
||||||
| Ransomware | harwal.net id31028 View details | United Arab Emirates | Manufacturing / Engineering | pending | ||
|
Harwal.net Harwal Group is the largest plastics recycler in the Middle East, founded in 1938, with an annual processing capacity of over 200,000 tons of plastics and metals. Manufacturing includes construction materials, pre-engineered building systems, industrial packaging, consumer goods, and refrigeration equipment, including commercial chillers and freezers under the Celsius brand. Companies within the group: four main divisions — TSSC, Interplast, Cosmoplast, and Intermetal — unite 28 business units operating in 65 countries worldwide. DATA- 12tb |
||||||