Ransomware Group intelligence

Incransom

Active

Track Incransom with 986 published victims and 7 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 986 Known published victims in this dataset

First discovered 2023-08-09 Earliest victim discovery date

Last discovered 2026-10-15 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 545 victims

Known locations 7 Leak or negotiation infrastructure tracked

Incransom is tracked by Breach House as a ransomware group with 986 published victims.

United States is currently the most targeted country in this dataset.

7 known leak locations are currently associated with this group.

986

Leaked 281 28.5%
Pending 702 71.2%
Deleted 3 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 6	Onion service	Up checked 4h ago	`incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion`
Leak location 7	Onion service	Up checked 4h ago	`incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion`
Leak location 2	Onion service	Down checked 4h ago	`incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion`
Leak location 5	Web location	Down checked 4h ago	`incapt.su`
Leak location 1	Onion service	Down checked 4h ago	`incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion`
Leak location 4	Web location	Down checked 4h ago	`incapt.blog`
Leak location 3	Web location	Down checked 4h ago	`incbackend.top`

Communication / Marketing 173
Healthcare / Pharma 116
Finance / Legal / Insurance 114
Services 81
Manufacturing / Engineering 76
Education 58
Not identified 56
Construction / Real Estate 53
Public Sector 45
IT 40
Retail / E-commerce 32
Transportation / Travel / Logistics 24
NGOs / Associations 24
Energy 22
Hospitality / Food & Beverage / Tourism 17
Agriculture / Food 14
Telecommunications 11
null 2

Typical Attacks (35)

▼

How Incransom typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via INC Ransom, INC Ransomware.

T1588.002 Tool Resource Development

What they do: INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.

What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.
T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: INC Ransom has used compromised valid accounts for access to victim environments.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1190 Exploit Public-Facing Application Initial Access

What they do: INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.

What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1566 Phishing Initial Access

What they do: INC Ransom has used phishing to gain initial access.

What that means: Adversaries may send phishing messages to gain access to victim systems.
T1047 Windows Management Instrumentation Execution

What they do: INC Ransom has used WMIC to deploy ransomware.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.003 Windows Command Shell Execution

What they do: INC Ransom has used `cmd.exe` to launch malicious payloads.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1569.002 Service Execution Execution

What they do: INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1070.004 File Deletion Stealth

What they do: INC Ransom has uninstalled tools from compromised endpoints after use.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1140 Deobfuscate/Decode Files or Information Stealth

What they do: INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.

What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
T1685 Disable or Modify Tools Defense Impairment

What they do: INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1046 Network Service Discovery Discovery

What they do: INC Ransom has used NETSCAN.EXE for internal reconnaissance.

What that means: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
T1049 System Network Connections Discovery Discovery

What they do: INC Ransom has used RDP to test network connections.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1057 Process Discovery Discovery

What they do: INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.

What that means: Adversaries may attempt to get information about running processes on a system.
T1069.002 Domain Groups Discovery

What they do: INC Ransom has enumerated domain groups on targeted hosts.

What that means: Adversaries may attempt to find domain-level groups and permission settings.
T1083 File and Directory Discovery Discovery

What they do: INC Ransomware can receive command line arguments to encrypt specific files and directories.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1087.002 Domain Account Discovery

What they do: INC Ransom has scanned for domain admin accounts in compromised environments.

What that means: Adversaries may attempt to get a listing of domain accounts.
T1120 Peripheral Device Discovery Discovery

What they do: INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.

What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
T1135 Network Share Discovery Discovery

What they do: INC Ransom has used Internet Explorer to view folders on other systems.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1652 Device Driver Discovery Discovery

What they do: INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.

What that means: Adversaries may attempt to enumerate local device drivers on a victim host.
T1680 Local Storage Discovery Discovery

What they do: INC Ransomware can discover and mount hidden drives to encrypt them.

What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: INC Ransom has used RDP to move laterally.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1570 Lateral Tool Transfer Lateral Movement

What they do: INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
T1074 Data Staged Collection

What they do: INC Ransom has staged data on compromised hosts prior to exfiltration.

What that means: Adversaries may stage collected data in a central location or directory prior to Exfiltration.
T1560.001 Archive via Utility Collection

What they do: INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1071 Application Layer Protocol Command and Control

What they do: INC Ransom has used valid accounts over RDP to connect to targeted systems.

What that means: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
T1105 Ingress Tool Transfer Command and Control

What they do: INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.
T1219 Remote Access Tools Command and Control

What they do: INC Ransom has used AnyDesk and PuTTY on compromised systems.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1537 Transfer Data to Cloud Account Exfiltration

What they do: INC Ransom has used Megasync to exfiltrate data to the cloud.

What that means: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
T1486 Data Encrypted for Impact Impact

What they do: INC Ransom has used INC Ransomware to encrypt victim's data.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: INC Ransomware can issue a command to kill a process on compromised hosts.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: INC Ransomware can delete volume shadow copy backups from victim machines.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1491.001 Internal Defacement Impact

What they do: INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
T1657 Financial Theft Impact

What they do: INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (11)

▼

Software Incransom has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

AdFind Advanced IP Scanner

Discovery & enumeration

AdFind Advanced IP Scanner

Exfiltration

BackBlaze MEGA Restic RClone s5cmd

LOLBAS (living-off-the-land binaries)

Finger PsExec

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Victims (986)

Search, filter and paginate the victim timeline for Incransom. Showing 101–200 of 986.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	https://eclmn.com/ id31010 View details	2026-07-28	United States	IT	pending
A family-run health and residential care organization in Minnesota. They provide adapted housing, professional in-home support, and daily living solutions for adults with physical disabilities and limited mobility ID 31010
Ransomware	Della Casa Group AG id31009 View details	2026-07-28	Switzerland	Construction / Real Estate	pending
041 785 61 31 / 041 785 61 46 / [email protected] 041 785 61 36 / [email protected] 041 785 61 30 / [email protected] 041 785 61 33 / [email protected] 041 785 61 43 / [email protected] 041 785 61 42 / [email protected] *************************************************** (240,391,913,425 bytes) 86,332 Files, / 15,359 Folders Personal / Client Information Accounting / Finance Details of current and future projects Other ID 31009
Ransomware	minigrip.com.mx id31005 View details	2026-07-28	Mexico	Manufacturing / Engineering	pending
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 31005
Ransomware	DUCON id31001 View details	2026-07-28	Colombia	Other	pending
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 31001
Ransomware	greenecountyga.gov id31002 View details	2026-07-28	United States	Public Sector	pending
Greene County, Georgia is a historic and scenic county located in the east-central "Lake Country" region of the state, roughly halfway between Atlanta and Augusta. Established in 1786 as Georgia's 11th county, it is widely known for its combination of rural heritage, historic architecture, and upscale resort living centered around Lake Oconee. ID 31002
Ransomware	foundationstofreedom.org id31003 View details	2026-07-28	United States	NGOs / Associations	pending
Foundations to Freedom is a US-registered 501(c)(3) non-profit organization that provides recovery housing, social adaptation programs, and comprehensive therapeutic support for individuals overcoming alcohol and substance abuse, as well as survivors of domestic violence.The organization is dedicated to offering a safe, structured environment for individuals to rebuild their lives from the ground up and maintain long-term sobriety. It is headquartered in DeLand, Florida, USA ID 31003
Ransomware	takethehop.com id30944 View details	2026-07-27	United States	Retail / E-commerce	pending
The HOP, an American regional public transit system operated by the Hill Country Transit District (HCTD). Founded in the 1960s in the state of Texas (USA) as a voluntary transportation service, the organization has grown over the decades into a major public public-transport network. ID 30944
Ransomware	healthlawadvocates.org id30860 View details	2026-07-26	United States	NGOs / Associations	pending
Health Law Advocates (HLA), an American non-profit, public interest law firm based in Boston, Massachusetts. Founded in 1996, HLA provides free (pro bono) legal representation to low-income residents and vulnerable populations who face barriers to accessing or paying for healthcare. ID 30860
Ransomware	autismuslink.ch id30818 View details	2026-07-24	Switzerland	NGOs / Associations	pending
The Stiftung Autismuslink (Autism Link Foundation), a Switzerland-based competence center dedicated to supporting adolescents and young adults with Autism Spectrum Disorder (ASD). Headquartered in Bern, the organization focuses on helping individuals with autism achieve social and professional integration. ID 30818
Ransomware	cabincreekhealth.com id30816 View details	2026-07-23	United States	Healthcare / Pharma	pending
Cabin Creek Health Systems (CCHS), a non-profit community healthcare organization founded in 1973 by coal miners in West Virginia. It operates as a Federally Qualified Health Center (FQHC), providing comprehensive medical services to rural and urban residents across Kanawha County ID 30816
Ransomware	Ali-Monde id30709 View details	2026-07-20	United States	Other	pending
Ali-Monde is a food production and distribution company that's been around for over 50 years. They've got 5 of their own brands and an impressive lineup of 800+ dry, organic, and gluten-free products. Based just south of Montreal, they distribute food across Quebec, Ontario, New Brunswick, and parts of Western Canada. Ali-Monde is all about giving customers exactly what they want - tasty, diverse food products that meet different dietary needs. ID 30709
Ransomware	v-silicon.com id30651 View details	2026-07-18	China	IT	deleted
威视芯半导体（合肥）有限公司 specializes in advanced audio and video processing technologies for the global smart TV and set-top box market. The company offers a range of products including high-definition smart TV chips and network camera chips, aimed at enhancing smart home, community, and city solutions. Their target clients include manufacturers in the smart display and visual technology sectors. 威视芯 is committed to driving innovation in the audio-visual industry ID 30651
Ransomware	FAST.COM.PH id30652 View details	2026-07-18	Philippines	IT	pending
FAST Logistics Group is a leading provider of end-to-end logistics and supply chain solutions in the Philippines, offering a comprehensive network of transport, warehousing, distribution, and logistics services. With over 50 years of experience, the company serves a diverse range of industries including FMCG, pharmaceuticals, and technology, enabling businesses of all sizes to expand their reach across the archipelago. Their innovative and sustainable solutions are designed to support business growth and ensure dependable operations at every stage of the supply chain. FAST Logistics Group is committed to helping clients navigate logistics challenges and achieve operational efficiency through tailored services and a strong nationwide presence. ID 30652
Ransomware	D.MAG New Material Technology Co., Ltd. Taiwan Giant id30653 View details	2026-07-18	Taiwan, Province of China	Manufacturing / Engineering	pending
D.MAG New Material Technology Co., Ltd. is a key manufacturing subsidiary controlled by Taiwan’s Giant Group (Giant Manufacturing Co., Ltd.). Specializing in aluminum and magnesium alloys, D.MAG operates from Kunshan, Jiangsu Province, China, to develop and supply lightweight, high-performance materials and components for the bicycle, automotive, railway, and aerospace industries ID 30653
Ransomware	vedan corp id30654 View details	2026-07-18	Viet Nam	Agriculture / Food	pending
Vedan Vietnam is a leading manufacturer specializing in a wide range of products including seasoning, starch, MSG, chemicals, and consumer goods. The company is committed to quality and safety, utilizing advanced technology and local agricultural resources to produce high-quality products. Their services also extend to port operations and frozen food offerings, catering to both domestic and international markets. Vedan Vietnam aims to meet the growing demand for natural and non-GMO food products while maintaining a strong focus on corporate social responsibility and environmental protection. ID 30654
Ransomware	pokka.co id30655 View details	2026-07-18	Singapore	Agriculture / Food	pending
Founded in 1977 and headquartered in Central Singapore, Pokka Sg manufactures and markets a wide range of beverages ID 30655
Ransomware	reatile.co.za id30656 View details	2026-07-18	South Africa	Energy	pending
Reatile Group is an innovative, black-owned investment holding company established in 2003, focusing on the energy, petrochemical, and industrial sectors in South Africa. The company aims to leverage growth opportunities within these industrial sectors of the South African economy. Reatile Group is committed to improving the quality of life for disadvantaged communities through its foundation. Their strategic vision emphasizes growth and development in key sectors. ID 30656
Ransomware	V&P Nurseries id30657 View details	2026-07-18	United States	Agriculture / Food	pending
V&P Nurseries is an Arizona-based wholesale grower specializing in drought-tolerant, subtropical, and desert-adapted plants for landscapes across the Southwest. Established in 1978, the company operates production facilities and a tissue culture lab focused on sustainable, water-conservative horticulture. For more information, ID 30657
Ransomware	Kyokuto Kaihatsu Kogyo id30637 View details	2026-07-17	Japan	Manufacturing / Engineering	pending
Kyokuto Kaihatsu Kogyo Co., Ltd. is a leading manufacturer specializing in special purpose vehicles such as dump trucks, tankers, and garbage collection vehicles. The company serves various sectors including construction, logistics, and environmental services, providing innovative solutions to meet diverse client needs. With a strong presence in both domestic and international markets, it aims to support sustainable infrastructure development. The company is committed to enhancing operational efficiency and environmental sustainability through its advanced technologies and services. ID 30637
Ransomware	asa-international.com id30628 View details	2026-07-16	Netherlands	Finance / Legal / Insurance	pending
ASA International is a major international microfinance institution operating across South Asia, Southeast Asia, and Africa. The company's shares are traded on the London Stock Exchange under the ticker symbol ASAI ID 30628
Ransomware	https://www.statebankofnauvoo.com/ id30603 View details	2026-07-16	United States	Finance / Legal / Insurance	pending
State Bank of Nauvoo offers a range of banking services including deposit accounts, loans, and online banking solutions ID 30603
Ransomware	Golden Glasko & Associates id30558 View details	2026-07-14	United States	Finance / Legal / Insurance	pending
Golden Glasko Haddy and Associates, P.A. is a law firm based in Miami specializing in estate law, probate, guardianship, and trust issues. With over 70 years of combined experience, they provide services including estate planning, probate litigation, and trust administration. The firm aims to offer personalized legal strategies and tenacious advocacy to support clients throughout South Florida. They also offer free initial consultations to prospective clients seeking legal guidance. ID 30558
Ransomware	VantagePoint Management & Autoclear id30555 View details	2026-07-14	United States	Finance / Legal / Insurance	pending
VantagePoint Capital Partners is a global venture investor established in 1996, focusing on energy innovation and efficiency. With over $4 billion under management, the company supports start-up to scale-up companies by providing capital, strategic resources, and partnership alliances. Headquartered in Silicon Valley, VantagePoint also has offices in Beijing, China, and maintains strategic partnerships worldwide. Their diverse portfolio includes a range of entrepreneurs and companies in the energy sector. ID 30555
Ransomware	Aesthetic Surgical Images id30352 View details	2026-07-07	United States	Healthcare / Pharma	pending
Aesthetic Surgical Images, a plastic surgery practice based in Omaha, NE, has been serving patients since 1968 and is known for its commitment to quality and integrity. The practice's medical records are managed by Morgan Records Management, which ensures compliance with state and federal laws regarding record retention and confidentiality. Patients can request their medical records through the practice's website, with a focus on providing a secure and efficient experience. Aesthetic Surgical Images aims to educate patients about their records and the importance of proper management. ID 30352
Ransomware	tecnocurva.com.br id30305 View details	2026-07-07	Brazil	IT	pending
Company operating in the automotive sector. Heavy and agricultural segment. Forming of tubes and welded assemblies. Tecnocurva manufactures curved, welded, and stamped tubular assemblies, structural and exhaust pipes, and stamped parts with high technical standards and a total focus on performance. ID 30305
Ransomware	samberger24.de id30306 View details	2026-07-07	Germany	Retail / E-commerce	pending
Samberger is a long-established medical supply store and sports and analysis center in Munich, offering orthopedic aids, shoe insoles and health products. ID 30306
Ransomware	oakparkmi.gov id30237 View details	2026-07-03	United States	Public Sector	pending
Oak Park, Michigan, is a vibrant, diverse inner-ring suburb of Metro Detroit located in Oakland County. Incorporated as a city in 1945, it spans 5.5 square miles and is home to roughly 30,000 residents. The city is currently experiencing a renaissance, transforming areas like the 11 Mile Road corridor into bustling hubs with breweries, restaurants, and new community spaces. ID 30237
Ransomware	tambasa.com id30229 View details	2026-07-02	Brazil	Other	pending
Tambasa Atacadistas is one of the largest wholesale distributors in Brazil, operating primarily in the B2B marketplace. Founded in 1949, the company supplies retail stores, supermarkets, and construction shops across the entire national territory. ID 30229
Ransomware	tricountyhs.org id30230 View details	2026-07-02	United States	Healthcare / Pharma	pending
Flowers Early Learning (formerly known as Tri-County Head Start) is a non-profit 501(c)(3) organization providing free, high-quality early childhood education and family support services across Berrien, Cass, and Van Buren counties in Southwest Michigan. Funded by a federal grant through the Office of Head Start, the organization serves eligible families with children from birth to age five, as well as expectant mothers. ID 30230
Ransomware	acworth-ga.gov id30231 View details	2026-07-02	United States	Public Sector	pending
Acworth is located in the foothills of the North Georgia mountains and is nestled along the banks of Lake Acworth and Lake Allatoona, hence its nickname “The Lake City.” The city boasts a rich history, a charming downtown, abundant outdoor recreational activities, a vibrant restaurant scene, and an active festival and events calendar. Acworth is one of the best, family-friendly destinations in the Atlanta region. ID 30231
Ransomware	carvalima.com.br id30232 View details	2026-07-02	Brazil	Retail / E-commerce	pending
Carvalima Transportes is a specialized freight transportation company with over 35 years of experience, headquartered in Cuiabá, MT. The company operates in multiple regions, including Mato Grosso, Mato Grosso do Sul, Rondônia, Acre, and parts of Pará, as well as providing reverse logistics services across several states in Brazil. Their services include fractional cargo transport, dedicated cargo, e-commerce logistics, and air freight. ID 30232
Ransomware	ezortea.com.br id30233 View details	2026-07-02	Brazil	Retail / E-commerce	pending
Estrutural Zortea is a Brazilian company founded in 1995, specializing in the design, fabrication, and assembly of large-scale metal structures. ISO 9001-2015 certified, they provide industrial, logistics, and port solutions throughout the country. Specialties include: roofing for grain warehouses and industrial sheds, hoppers, silos, metal towers, and buildings. ID 30233
Ransomware	hamilton-eye.com id30234 View details	2026-07-02	United States	Healthcare / Pharma	pending
Hamilton Eye Institute is a comprehensive vision care practice operating out of two Pennsylvania locations: Allentown and Easton. They provide routine eye exams, medical/surgical eye treatments, and an in-house MediSpa. ID 30234
Ransomware	Colorado Rehabilitation and Occupational Medicine id30219 View details	2026-07-02	United States	Healthcare / Pharma	pending
Colorado Rehabilitation & Occupational Medicine (CROM) is a leading Denver-area physiatry practice specializing in non-surgical treatments for musculoskeletal and neurological conditions. Founded in 1992, CROM operates multiple clinics across the Front Range, focusing on helping patients recover from sports, work, and auto injuries without narcotics or surgery. ID 30219
Ransomware	https://www.roundshield.com/ id30164 View details	2026-07-01	United Kingdom	Finance / Legal / Insurance	pending
400gb ID 30164
Ransomware	horizoneye.com id29998 View details	2026-07-01	United States	IT	pending
Horizon Eye Care operates as a group of independent optometric clinics and medical practices across North America. Depending on your specific location, they offer comprehensive eye examinations, surgical procedures (like LASIK and cataracts), contact lens fittings, and a wide variety of designer eyeglasses. ID 29998
Ransomware	https://sza.it/ id30132 View details	2026-06-30	Italy	IT	pending
client, contracts, personal, NDA and other ID 30132
Ransomware	GDN AR(Dorinka) id30089 View details	2026-06-29	Argentina	Other	leaked
Dorinka S.R.L. is based in Argentina, with the head office in Cidade Autonoma De Buenos Aires. The enterprise operates in the Grocery Stores industry. Dorinka S.R.L. was incorporated on June 29, 2026. There are currently 8,000 (2024) people employed by Dorinka S.R.L.. ID 30089
Ransomware	callhorton.com id30044 View details	2026-06-26	United States	Retail / E-commerce	leaked
Horton Personal Injury Lawyers is the premier law firm at not protecting it's clients confidential data. ID 30044
Ransomware	johndufourlaw.com id30045 View details	2026-06-26	United States	Finance / Legal / Insurance	pending
If you find yourself injured, disabled or deep in debt, the Law Office of John Dufour is ready to help. John brings 25 years of focused experience and favorable outcomes. Our success is built on attentive service and attention to the legal details. ID 30045
Ransomware	theswansonlawgroup.com id30046 View details	2026-06-26	United States	Finance / Legal / Insurance	leaked
Meet Ben Swanson. The clients confidentiality worst nightmare. ID 30046
Ransomware	Life Bridges id30028 View details	2026-06-25	United States	Healthcare / Pharma	pending
Life Bridges is a non-profit organization dedicated to supporting individuals with intellectual and developmental disabilities, providing a range of services including residential support, healthcare, and community living services. Established in 1973, the organization focuses on promoting independence and dignity for its clients through tailored support and therapeutic services. Their intended clients include individuals with various developmental disabilities, as well as their families, ensuring a holistic approach to care and community involvement. Life Bridges is committed to bridging the gap between abilities and disabilities, fostering an inclusive environment where all individuals can thrive. ID 30028
Ransomware	GSP Crop Science Pvt id30029 View details	2026-06-25	India	Agriculture / Food	pending
GSP Crop Science Limited is a leader in agricultural innovation, specializing in crop science and sustainable farming solutions. The company offers a wide range of products including pesticides, herbicides, fungicides, and plant growth regulators, designed to enhance crop productivity while minimizing environmental impact. Their target clients include farmers and agricultural businesses seeking effective and reliable crop protection solutions. With a strong commitment to research and development, GSP aims to revolutionize agriculture and support farmers in achieving high-quality, healthy crops. ID 30029
Ransomware	belpointeasset.com \ belpointe.com id29978 View details	2026-06-22	United States	Finance / Legal / Insurance	pending
400gb ID 29978
Ransomware	jktornel id30073 View details	2026-06-21	Mexico	Other	pending
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 30073
Ransomware	Newspaper Media Group id30069 View details	2026-06-20	United States	Communication / Marketing	pending
Newspaper Media Group is a local news organization that provides comprehensive coverage of news, sports, entertainment, and community events across various regions, including Central Jersey and South Jersey. They publish multiple newspapers and magazines, ensuring that they reach more households than their competitors in nearly every zip code they cover. Their services are aimed at local communities, delivering news that is often not found elsewhere. With a commitment to connecting readers to the communities they care about, NMG stands out for its focus on local reporting. ID 30069
Ransomware	Horizon Family Medical Group id29973 View details	2026-06-18	United States	Healthcare / Pharma	pending
Horizon Family Medical Group A deep dive into 7 terabytes of internal data: from patient records to QuickBooks financial databases In the modern world, data is the new oil. For a medical organization like Horizon Family Medical Group, it is also the foundation of trust between doctor and patient. We have conducted an independent and complete audit of this organization's data security. The results are catastrophic. We are in possession of the company's entire digital footprint, totaling 7 terabytes, which includes 1TB of file data and 6TB of mission-critical SQL and QuickBooks databases. The management of Horizon Family Medical Group was notified of their complete loss of data control. They chose silence. This blog exists to illuminate what they are desperately trying to hide. We will not be publishing the files. Yet. Instead, we will explain exactly what this data contains, so that every patient, employee, and partner can appreciate the full scale of the threat. The Patient, Dissected. What We Know About You Horizon Family Medical Group prides itself on a wide range of services, from primary care to specialized treatments. This range of services has now become a detailed vulnerability map for every single patient. Our data includes, but is not limited to: Primary Care: Complete visit histories, diagnoses, prescriptions, lab results, and physicians' private notes about your lifestyle, habits, and family status. Women's Health: Detailed information on gynecological exams, pregnancies, abortions, Pap smear results, STD diagnoses, and prescribed treatments. Everything you trusted only to your doctor. Behavioral Health: The most sensitive category. Diagnoses related to depression, anxiety disorders, bipolar disorder, and addiction. Full session notes from psychotherapists. Every antidepressant and antipsychotic prescription. This information can destroy careers, families, and social standing. Allergy and Immunology: Data on all your allergies, including reactions to specific medications. What happens when this information is lost or altered in your official medical file? Ophthalmology & Nutrition: Your eyeglass prescriptions, diagnoses like glaucoma and cataracts, as well as all your attempts to manage weight, documented eating disorders, and private recommendations from nutritionists. This isn't just 'data'. This is your life, cataloged and ready for use. Anatomy of a Business. A Financial Teardown of Horizon Family Medical Group It's a paradox that clinics, while collecting mountains of information, often fail to see the real picture of their own business. We see it. The 6 terabytes of SQL and QuickBooks databases represent the complete financial and operational model of Horizon Family Medical Group. We have analyzed: SQL Databases: These contain complete patient information, doctor schedules, office utilization, patient flow, average revenue per department and per doctor. We know which doctor is profitable and which is a liability. We see every operational metric management uses to make decisions. QuickBooks Databases: This is the financial heart of the company. Every transaction, employee salaries (including hidden executive bonuses), tax reports, debts, loans, and settlements with insurance companies and suppliers. We can see the true profit margin of every service, the customer acquisition cost (CAC), and their lifetime value (LTV). Horizon's management hasn't just lost patient data. They have lost complete control of their business. Any competitor with this information could dismantle their company by poaching their most profitable doctors and patients. Eternal Memory. Why This Data Will Never Disappear. Some believe a data breach is a temporary problem. In this case, it is not. We drew inspiration from the Arctic Code Vault project, where humanity's most critical code is preserved in permafrost for a thousand years. Your 7 terabytes of data are no longer just files on a server. They have been prepared for archival and distributed storage. They will become a digital monument to the negligence of Horizon Family Medical Group. This data cannot be 'deleted'. It will exist forever, as proof that the company's leadership failed to protect what is most sacred—your health and your privacy. To the management of Horizon Family Medical Group, we remind you: the clock is ticking. Your silence only magnifies the damage. Contact us. Your patients and your business deserve it. ID 29973
Ransomware	neuwoges.de id29968 View details	2026-06-18	Germany	Construction / Real Estate	pending
The Neubrandenburger Wohnungsgesellschaft mbH (NEUWOGES), a municipal housing company and subsidiary of the Vier-Tore-Stadt Neubrandenburg in Mecklenburg-Western Pomerania, Germany. It is one of the largest regional housing providers, managing around 12,000 apartments alongside commercial units and care facilities. It’s no secret that the company was subjected to a cyberattack and that data was stolen. But let’s pull back the curtain a bit. At first, the company’s leadership cut costs on proper IT infrastructure, and after the attack they continued to do so—this time at the expense of the security of their clients, employees, vendors, etc. Relying on the supervisory board, they attempted to obtain more information about the compromised data in order to protect themselves. Now you’re learning about this for free. Stay tuned. ID 29968
Ransomware	jasperplastics.info id29934 View details	2026-06-16	United States	Manufacturing / Engineering	pending
Jasper Plastics Solutions specializes in providing turn-key plastic and polyurethane solutions primarily for OEM manufacturers in the RV, Marine, Automotive, and Construction industries. Their product offerings include polyurethane thermal column blocks, fiberglass components, and innovative design boards that are weather-resistant and customizable. With nearly 20 years of experience, they utilize advanced manufacturing techniques, including a new HD Digital Division for large format printing, to create high-quality parts that mimic natural materials. Jasper Plastics is committed to delivering practical and innovative solutions tailored to the specific needs of their clients. Employees: 10 Revenue: $5 Million Industry: Manufacturing Phone Number: (574) 457-2062 ID 29934
Ransomware	framesiprofessional.com id29935 View details	2026-06-16	United States	IT	pending
Framesi specializes in creating and distributing professional hair products, including styling tools, color dyes, and hair treatments, exclusively for licensed stylists and salons. The company is dedicated to supporting the professional beauty industry by ensuring high-quality formulations that deliver reliable results. Framesi does not sell its products to retail chains or discount beauty outlets, maintaining a focus on professional use. Their offerings include a wide range of color products, care items, and styling solutions tailored for expert hands Employees: 200 Revenue: $25.1 Million Cosmetics, Beauty Supply & Personal Care Products Phone Number: (800) 321-9648 ID 29935
Ransomware	smithassociatescpa.com id29895 View details	2026-06-15	United States	Finance / Legal / Insurance	pending
smithassociatescpa.com Smith and Associates is a Certified Public Accounting Firm based in Maine, offering a comprehensive range of services including accounting, auditing, tax planning, and management advisory services. The firm caters to a diverse clientele, including individuals, corporations, partnerships, and non-profits in Maine and New Hampshire. They provide specialized support for business start-ups and QuickBooks, along with professional consulting in various areas of tax and accounting practices. Established in 1987, Smith and Associates is committed to being personable, knowledgeable, and responsive to their clients' needs. ID 29895
Ransomware	Kewaunee Scientific id29786 View details	2026-06-11	United States	Manufacturing / Engineering	pending
Total data: 504GB Contains: 852,141 Files, 120,670 Folders Documents: Clients KYS & NDA, Financial documentation, Contracts, Drawings, Audit reports, Personal data, Contractors and subcontractors information, Scanned documents and much other important information. Tape: confidential Clients: Pfizer, Rusan Pharma Ltd., Samsung and many other world-famous laboratories. full information will be released in a few weeks ID 29786
Ransomware	Signazon_USA id29787 View details	2026-06-11	United States	Retail / E-commerce	pending
Signazon.com was founded with the mission of providing the company's customers with the very best in printing. It's one thing to print fast and cheap - it's another thing to do that and do it well. The company believes in getting the little details right. From asking the company's customers the right questions to picking out different weights of paper, fine-tuning the company's printers for optimal quality to hand-checking every order several times throughout the production process, no stone is left unturned. And the company works hard every day to make sure that each and every customer gets the highest-quality, personalized products and service. With thousands of customers around the country, ranging from Fortune 500 companies to small business owners and even personal consumers, we've embraced the company's place as leaders at the innovative edge of the industry. We're constantly looking to improve and grow by streamlining the company's website, adding new products, and more. ID 29787
Ransomware	DISCOLABINDU id29800 View details	2026-06-11	France	Other	pending
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 29800
Ransomware	fineconsulting id29785 View details	2026-06-11	Romania	IT	leaked
Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 29785
Ransomware	FIZA id29729 View details	2026-06-10	Czechia	Other	pending
FIZA, a.s. is an established, medium-sized auditing and consulting company with a good capital base enabling its further development. Its roots go back to the very beginning of the 1990s, when it provided its services in the form of its legal predecessor, the association of individuals Ing. Jiří Ficbauer, civilingenjör. – FIZA. The current joint-stock company was established in 2001. We specialize in auditing, economic-organizational and tax consulting. We approach every job and every client carefully and responsibly. We want to become your long-term and trustworthy partner. We will be happy to accommodate you even in the case of one-off cooperation. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 29729
Ransomware	kelmreuter.com id29662 View details	2026-06-06	United States	Other	pending
www.personadental.com Persona Dental offers personalized dental care for families in Sartell, MN, focusing on both general and specialized services such as cosmetic dentistry, dental implants, and solutions for snoring and sleep apnea. The clinic prides itself on creating a comfortable environment and empowering patients to make informed decisions about their dental health. With a friendly and experienced team, they provide comprehensive care under one roof, ensuring convenience for their clients. Persona Dental is dedicated to building confidence and achieving the best smiles for their patients ID 29662
Ransomware	obrieneng.com id29654 View details	2026-06-05	United States	Manufacturing / Engineering	pending
contract nda confidential gov\dot\military\va\sam.gov other ID 29654
Ransomware	Stuga Machinery id29625 View details	2026-06-04	United Kingdom	Manufacturing / Engineering	pending
Stuga Machinery Ltd specializes in designing and manufacturing precision sawing and machining centers for the fenestration industry, serving clients primarily in the UK and Ireland. With over 50 years of experience, the company offers a range of fully automated cutting and prepping centers, as well as refurbishment services for existing machinery. As a subsidiary of Stürtz GmbH, Stuga combines British engineering with international innovation, providing reliable local support and access to global technical resources. Their commitment to customer service includes lifecycle support, genuine parts supply, and tailored service contracts to ensure optimal machine performance ID 29625
Ransomware	pdcbodynits id29623 View details	2026-06-04	Singapore	Other	leaked
Bodynits Group is a leading apparel manufacturer specializing in design and innovation, offering comprehensive manufacturing solutions.Access was gained to accounting and finance, all asset management systems, client databases, employee personal data, non-disclosure agreements, as well as developments and technologies. ID 29623
Ransomware	CUSTOMSIGN id29598 View details	2026-06-04	United States	Manufacturing / Engineering	deleted
About Custom Sign & Engineering Custom Sign & Engineering, Inc. specializes in creating high-quality, custom commercial digital signs and billboards in Evansville, Indiana. The company offers a wide range of products, including LED dimensional letters, monumental signs, and information displays, all designed to meet the specific needs of businesses. The company is committed to providing customer-focused services at competitive prices and with free estimates. It serves clients in three states—Illinois, Indiana, and Kentucky—helping businesses enhance their visibility and brand image through eye-catching signage. Translated with ***.com (free version) ID 29598
Ransomware	Colina Financial Advisors id29585 View details	2026-06-03	Bahamas	Finance / Legal / Insurance	pending
Colina Financial Advisors Limited (CFAL) is a prominent, independent wealth management and investment advisory firm based in Nassau, The Bahamas. Established in 1997, it serves as the investment arm of Colina Holdings Ltd.. The firm provides diverse financial services to both individual and institutional clients. While customers continue to entrust the company with their money, senior executives are actively working to cover up a major data breach involving approximately 500 GB of highly confidential data. The leak includes, but is not limited to: 1. Client Personally Identifiable Information (PII) 2. Client Financial Profiles & Asset Data 3. Proprietary Business Intel & System Data 4. Holistic Estate & Legal Planning 5. Regulatory & Compliance Records Stay tuned for further updates. ID 29585
Ransomware	Oztugotomotiv id29589 View details	2026-06-03	Türkiye	Manufacturing / Engineering	pending
Öztuğ Otomotiv & Endüstri is a Turkish company established in 1990 in Bursa, specializing in the production of high-precision components for the automotive, industrial, defense, and aerospace sectors. The company offers comprehensive services including design, mold manufacturing, and serial production of plastic, metal, and rubber parts, as well as industrial seals and vibration dampers. Öztuğ Otomotiv utilizes modern equipment (high-tonnage presses, progressive dies) and adheres to international quality standards, including a zero-defect principle and compliance with OEM standards. Financial performance (not publicly disclosed, but the company positions itself as a stable business): As of 2025, the company reports over 35 years of successful operations, more than 300 employees, and three production facilities with a total enclosed area of 12,000 m². Structure and facilities: The company operates three production sites in Hasantığla, Nilüfer (Bursa), and Adapazarı. As of 2025, the workforce comprises over 300 specialists. Production capabilities include plastic injection, metal forming, and rubber molding lines. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 29589
Ransomware	trrac.net id29572 View details	2026-06-02	United States	IT	leaked
150gb ID 29572
Ransomware	Bradley law firm id29540 View details	2026-06-01	United States	Finance / Legal / Insurance	pending
Bradley Law Personal Injury Lawyers is a law firm dedicated to representing clients who have suffered injuries due to accidents, medical malpractice, and other forms of negligence. With over 30 years of experience, they have successfully recovered more than $100 million in settlements and verdicts for their clients across Missouri and Illinois. Their services include free case consultations and a commitment to fight for maximum compensation on behalf of accident victims. The firm is known for its expertise in personal injury law, including vehicle accidents, workplace injuries, and wrongful death cases. ID 29540
Ransomware	Champaign-Urbana Public Health District id29541 View details	2026-06-01	United States	Public Sector	pending
Champaign Urbana Public Health District provides a wide range of health services including dental care, nutrition assistance, mental health support, and food safety inspections. Their programs cater to various demographics, including adolescents, women, infants, and families, focusing on preventive health and education. The district also offers resources for substance abuse treatment, sexual health, and community food initiatives. Their intended clients include residents of Champaign County seeking health services, food assistance, and educational resources. ID 29541
Ransomware	www.labexpress.com id29388 View details	2026-05-30	United States	Healthcare / Pharma	pending
LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive cross‑company records. This data will be made publicly available in the near future. Active Directory Overview - 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs). - Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2). - A single AD domain serves both Labexpress and Garonit Pharma. Notable account: cn: Troy Austin sAMAccountName: Taustin memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS The same person appears in Exchange mailboxes as [email protected]. Weak Passwords and Brute‑Force Indicators - Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30. - Computer accounts FRONTDESK$, DEV$, LABEL$ – more than 3,000 failures each. - Cleartext password found on FILE01\passwords.txt: Admin: LabExpress2024! - The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT. - Password for user Protect: Password123! - Outdated password templates in the “SBSUsers” OU are still in use. Mail Servers and Exchange - LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007. - Full mailbox export performed using the built‑in Export-Mailbox cmdlet – no special exploit required. Contents of the Obtained Data (200 GB) We have data from drive E:\, including: 1. Financial & Accounting - QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND). - Folder: E:\Garonit Documents\Clients 2022\ – hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf). - Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ – detailed accounts payable records for 50+ vendors. 2. Quality & Production - Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx). - Complete batch records for 2023–2026 (folders Batch Records\2023, 2024, 2025, 2026). - Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse. 3. ANDA & Regulatory Documentation - Folder “00 Oral Rinse ANDA-Old One” – complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA. - Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf. 4. Vendor & Customer Records - Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ – dossiers on each supplier (contracts, invoices, assessments). - Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ – customer purchase orders and sales quotations. 5. Human Resources (HR) - Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ – employment contracts, W‑9 forms, tax deductions, resignation letters. - Passport scans, Green Card copies, health insurance records for many employees. - Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf. 6. Internal Communications & Scans - Directory “C224E BIZHUB SCANNER DUMPS” containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.). - Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS. - Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents). 7. Tax & Banking Documentation - Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank. - Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf. Shared Infrastructure – Observed Facts - The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma. - Cross‑company records reside in the same folders (e.g., “Garonit Documents” and “LABEXPRESSDATA” coexist on the same drive). - User Troy Austin has an AD account (Taustin) and also uses the email address [email protected]. - Purchase orders, invoices, COA/COC files refer to both companies interchangeably. - At the IT level, there is no separation between the two legal entities. The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future. ID 29388
Ransomware	belimed.com id29409 View details	2026-05-29	United States	Finance / Legal / Insurance	pending
We are announcing the successful breach of the secure network of Belimed AG, a leading provider of sterilization equipment. Our team has gained full access to the digital assets of their finance department and has exfiltrated the entire dataset. Data Volume: 1.5 Terabytes. In our possession is the complete financial picture of Belimed AG. This isn't just tables or reports; it is the entire nervous system of their business, including: * SAP (SUP) Databases: Full dumps containing all operational and financial information. * Accounting Records: All transactions, entries, and financial operations spanning many years. * Client Contracts and Payments: Detailed information on deals, pricing, and accounts receivable. * Employee Data: Salaries, bonuses, and personal financial information. * Internal Audits and Strategic Planning: Documents revealing their weaknesses, future plans, and trade secrets. * Tax Documentation and Banking Details: All information necessary for a complete understanding of their financial flows. The management of Belimed AG was given the opportunity to resolve this matter privately and without consequence. They chose silence, believing they could ignore us. This was a fatal mistake. By refusing to engage, they have jeopardized not only their own reputation but also the security of their clients, partners, and employees. This is not a threat. It is an announcement of a coming event. Exactly one month from the date of this post, the entire 1.5 TB data archive will be published for public access on this resource. Anyone—competitors, journalists, regulators—will be able to download and scrutinize the inner workings of Belimed AG. To the management of Belimed AG: you have made your choice. Now you will serve as an example to all others. Enjoy the consequences. The clock is ticking. ID 29409
Ransomware	lawants id29453 View details	2026-05-28	Spain	Finance / Legal / Insurance	pending
Lawants provides its clients with lawyers, Tax Advisors and Accountants accustomed to working in the international arena. Our goal is to become the client’s referents in the areas of expertise to address and solve all phases of a project, or issue, with an interdisciplinary and problem-solving-oriented approach. Likewise, we believe that the client must necessarily be an integral part of the Lawants team. We like to work, dialogue, confront each other and make our clients participants in every process that affects them to help them grow in their Business in Spain, the United States and South America. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 29453
Ransomware	Distrigaz Vest S.A. id29486 View details	2026-05-27	Romania	Energy	pending
Distrigaz Vest S.A. is an independent gas distribution company established in 2001, renowned for being the exclusive natural gas distributor in Oradea, Romania. The company offers a wide range of services including public gas distribution, network operation, and maintenance of gas infrastructure. Distrigaz Vest utilizes modern, automated equipment aligned with European standards to ensure safety and operational efficiency. In terms of financial performance, for the fiscal year 2024, Distrigaz Vest S.A. reported a turnover of RON 86.53 million and a net profit of RON 9.89 million, reflecting a 60% increase compared to the previous year . The company maintains a stable operational structure with 50 employees as of 2024 . Regarding ownership, Distrigaz Vest S.A. is primarily controlled by S.C. Luxten Lighting Company S.A., which acquired its stake in 2012 by converting debts into shares . The current shareholding structure, established following the dissolution of shareholder RMG Romania S.R.L. in 2016, is as follows : S.C. Luxten Lighting Company S.A. – 75.0101% Xxxxxxxxx Xxxxxxx Xxxxxxx (individual) – 24.3631% Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 29486
Ransomware	PILLER AIMMCO id29506 View details	2026-05-25	United States	Healthcare / Pharma	pending
PILLER AIMMCO is a leading vertically integrated custom plastic injection molding and tool-making company based in Woodland and Washougal, Washington. The company serves as a "one-stop shop" by managing the entire manufacturing lifecycle under one roof—from initial part design and engineering to mold production, automated high-volume manufacturing, and secondary assembly. PILLER AIMMCO holds ISO 9001:2015 certifications across both its tooling and molding operations, enabling it to support rigorous industrial regulations: 1. Medical Devices & Biotech: Fluid management components, orthodontic instruments, and lab devices that meet FDA, biocompatibility, and sterilization metrics. 2. Aerospace & Defense: Specialized tooling, gauges, fixtures, and finished components requiring absolute traceability. 3. Consumer Electronics: Complex enclosures, wearable technology components, and carbon-fiber-filled metal replacements. 4. Industrial & Agriculture: Heavy-duty commodities, nursery containers, large housings, and automotive/heavy trucking aftermarket parts ID 29506
Ransomware	Open Door Health Center id29512 View details	2026-05-25	United States	Healthcare / Pharma	pending
Open Door Health Center of Illinois offers a comprehensive medical home approach to primary health care, focusing on improving community health since 1977. Their services include medical assistance, HIV programs, behavioral health, case management, and community outreach, catering especially to LGBTQI individuals and those living with HIV/AIDS. The center aims to provide affordable and accessible healthcare without discrimination, while also engaging in education and training initiatives. Their intended clients include patients in need of medical care, community members seeking support, and volunteers looking to contribute to health equity. ID 29512
Ransomware	Meirc training and consulting id29354 View details	2026-05-25	United Arab Emirates	Education	leaked
Meirc offer a wide range of training programs across various categories, including accounting, finance, artificial intelligence, project management. They is recognized as a "trusted" training and consulting partner. We accessed the entire MEIRC network and downloaded 1TB of data - accounting - internal mail -planning - budgets - all personal information of all employees of the company In a week everything will be in the public domain. ID 29354
Ransomware	Mecanizados y Montajes Aeronáuticos (mymgroup.es) id29331 View details	2026-05-23	Spain	Manufacturing / Engineering	pending
MyM specializes in the manufacturing of metallic components and subassemblies for aerospace applications, serving major Tier 1 and OEM programs globally. The company is committed to excellence, utilizing advanced technology, infrastructure, and a skilled workforce to ensure high-quality production and timely delivery. MyM is recognized as an innovative SME, actively engaging in research and development within the aerospace and industrial sectors. Their clientele includes prominent companies such as Airbus, Boeing, Embraer, and Leonardo. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 29331
Ransomware	threadinnovations id29320 View details	2026-05-22	Canada	Other	pending
Thread has developed a proprietary technology for the production of cost-effective, efficient, and scalable carbon fiber. This process is based on utilizing the natural molecular structure of asphaltenes found in oil sands bitumen. Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation. ID 29320
Ransomware	Nothing id29272 View details	2026-05-19	Taiwan, Province of China	Other	pending
NOTHING Website: https://nothing.tech/ https://www.zoominfo.com/c/nothing/557232902 WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Technology - Total: 52GB And a lot of other VERY IMPORTANT information! ID 29272
Ransomware	bergen1.net id29220 View details	2026-05-18	United States	Education	leaked
Founded in 1965, Bergen Community College is a comprehensive higher education institute that offers academic degree programs to students. Bergen Community College is located out of Paramus, New Jersey We will publish all the data(1TB) in a week ID 29220
Ransomware	metaval.com.au id29208 View details	2026-05-17	Australia	Manufacturing / Engineering	pending
Metaval Consolidated is an Australian owned and operated manufacturers representative supplying all Australian states and territories. Metaval was established in 1967 to provide an engineering supply service to users in the paper industry. As our company grew and diversified, the range of industries serviced also increased. Today we provide engineered products to all major industries in Australia. We represent some of the worlds leading manufacturers in the supply of industrial equipment to a wide range of industries including water, manufacturing, mining and processing. Since commencing operations we have: Grown to be a leading Melbourne-based manufacturers representative for dozens of well known international brands. Worked and consulted on hundreds of projects from thousands of dollars to million dollar projects. Located in our own industrial premises and warehouse in Bayswater. Work with customers and consultants located in all Australian states and territories. Employees: 50 Revenue: $5 Million Industry: Home Improvement & Hardware Retail Phone Number: (646) 256-4886 ID 29208
Ransomware	defenseisready.com id29177 View details	2026-05-15	United States	Other	leaked
Deandra Grant Law is a Texas criminal defense and DWI firm with a practice exclusively concentrated on DWI, federal and criminal defense. The firm has defended clients across North and Central Texas for more than 30 years, with more than 500 cases tried to verdict. ID 29177
Ransomware	lafj.org id29161 View details	2026-05-15	United States	Finance / Legal / Insurance	pending
Louisiana Association for Justice is a voluntary bar association whose statewide membership is composed mostly of lawyers who have a trial practice. Both defense and plaintiff attorneys belong to the association; however, most LAJ members represent consumer plaintiffs in civil actions. LAJ attorney-members are small business owners, maintaining a practice and supporting an office staff of fewer than 20 people.Customer data, contracts, payment documents, internal company documentation. ID 29161
Ransomware	United Quality Cooperative / www.uqcoop.com id29155 View details	2026-05-15	United States	Agriculture / Food	leaked
United Quality Cooperative provides a range of services including bulk fuel, propane, lubricants, and agricultural products. We have at our disposal internal corporate correspondence, financial documents, personal data of company employees and much more. All stolen information will be published in the public domain in a week, if the company's management does not pay. ID 29155
Ransomware	Silergy Corp id29124 View details	2026-05-13	United States	Manufacturing / Engineering	pending
About Silergy Silergy Corp. specializes in the manufacture and sale of power integrated circuits. Silergy Corp. is headquartered in Hangzhou, Zhejiang, China. ---- More than 450 GB of personal data was leaked, along with a vast amount of financial and private information, including contracts containing non-disclosure clauses, passports, and customer and partner data. ID 29124
Ransomware	rbh aerospace inc id29063 View details	2026-05-11	United States	Manufacturing / Engineering	pending
RBH Aerospace, Inc. -is a manufacturing company located in Long Beach, California, specializing in the production of aerospace components. Established in January 2005, the company focuses on providing high-quality parts for both commercial and military aircraft. Their product offerings include aircraft frames, fuselages, wings, and various metal alloy components such as steel, aluminum, and titanium. 2708 Seaboard Lane, Long Beach, CA 90805 http://www.rbhaerospace.com/ Leaked data 240 GB: Corporate information, including electronic correspondence with counterparties, contracts including NDAs, transactions and payments related to them, STP (STEP) files, part drawings (including those for F-15, F-22), manuals and instructions. ID 29063
Ransomware	Bideawee id29064 View details	2026-05-11	United States	Services	pending
Bideawee is a no-kill animal rescue and shelter located in NYC, Wantagh, and Westhampton. The organization offers a variety of services including adoptions, medical care, pet therapy, and fostering opportunities. Bideawee aims to strengthen the human-animal bond through compassionate care for both pets and their owners. Its targeted clients include individuals and families seeking to adopt or foster pets, as well as volunteers looking to support animal welfare. ID 29064
Ransomware	lalsgroup.com id29076 View details	2026-05-11	United Arab Emirates	Retail / E-commerce	leaked
Lals Group is a large UAE-based family business group operating in retail, FMCG, distribution, home goods, and lifestyle brands across the GCC region. Founded in 1979, the company manages well-known brands and retail chains including Homes r Us, Daiso Japan, Carter’s, Mom Store, and others. Lals Group operates across the UAE, Qatar, Bahrain, Oman, Kuwait, and Saudi Arabia, with activities spanning retail stores, shopping malls, and logistics services. -- 400 gb ID 29076
Ransomware	https://sibillacapital.com/ id29003 View details	2026-05-10	United States	Other	leaked
data ID 29003
Ransomware	lopezlawfl.com id29004 View details	2026-05-10	United States	Other	leaked
full data ID 29004
Ransomware	Calsoft Inc id28998 View details	2026-05-09	United States	Finance / Legal / Insurance	pending
Calsoft, the company behind calsoftinc.com, is a US-based technology and product engineering services provider with operations in San Jose, California, and other global locations. Public company profiles describe it as a full-service engineering firm focused on storage, networking, virtualization, cloud, AI/ML, IoT, and telecommunications solutions. Its work centers on helping customers design, develop, and support software and digital products across these domains. In threat-intelligence indexes, calsoftinc.com was listed as a ransomware victim associated with incransom. ID 28998
Ransomware	cmswpc.com id28952 View details	2026-05-08	United States	Healthcare / Pharma	leaked
All patient medical records in their entirety. All data from the medical center, including personal and confidential information, will be stolen. The data will be divided into 7 parts, with each part containing 200–300 GB ID 28952
Ransomware	autorisk.org id28953 View details	2026-05-08	United States	Other	leaked
client data ID 28953
Ransomware	earthsystems.com.au earthsystemseurope.com id28954 View details	2026-05-08	Australia	Other	leaked
full corp data nda client contract project ID 28954
Ransomware	egnyte.com id28955 View details	2026-05-08	United States	Other	leaked
development department EU pl ID 28955
Ransomware	Aerodiagnostics id28911 View details	2026-05-06	United States	Healthcare / Pharma	pending
Aerodiagnostics, LLC is a Massachusetts-based laboratory specializing in advanced diagnostic testing for gastrointestinal disorders, including Small Intestinal Bacterial Overgrowth (SIBO), fructose malabsorption, sucrose intolerance, and lactose intolerance. The company utilizes state-of-the-art technology and non-invasive breath tests to provide accurate results while ensuring a high level of customer service Laek: 50GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 28911
Ransomware	EXPEDITOR id28857 View details	2026-05-05	United States	Transportation / Travel / Logistics	pending
Expeditor Systems specializes in improving patient flow through innovative light signaling systems designed for medical practices and institutions. Their solutions, including the LEAN Patient Flow System and Life Safety Nurse Call Systems, aim to enhance patient experience, increase operational efficiency, and boost revenues. With over 40 years of experience and a client base exceeding 8,000 Laek: 50GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 28857
Ransomware	sanver.com.mx id28862 View details	2026-05-05	Mexico	Construction / Real Estate	pending
Sanver Forte is a leading hardware wholesaler with over 30 years of experience in the northeastern, central, and Bajío regions of Mexico. The company offers a wide range of products and services related to hardware and construction, focusing on meeting the needs and expectations of its clients through timely deliveries and excellent customer service. Their mission is to simplify the distribution of leading brands, ensuring satisfaction and profitability for customers, collaborators, and shareholders. Sanver Forte aims to be the most comprehensive and secure provider of hardware and home preservation products, contributing to the growth of its employees and the community. Employees: 1000 Revenue: $30 Million Industry: Home Improvement & Hardware Retail Phone Number: +52 7898933030 ID 28862
Ransomware	childplace.org id28863 View details	2026-05-05	United States	NGOs / Associations	pending
Childplace Family Services is dedicated to nurturing children and empowering families through a range of services including fostering, adoption, counseling, and community support. The organization aims to serve children and families at risk, particularly those who have experienced abandonment, abuse, or neglect. With a history of over 50 years, Childplace has successfully helped thousands of children find loving homes and provided essential support to families in need. Their mission is rooted in promoting hope and healing within the community, guided by a spirit of Christian love. Employees: 100 Revenue: $7.2 Million Industry: Non-Profit & Charitable Organizations Phone Number: (812) 282-8248 ID 28863
Ransomware	https://www.wilkemgroup.com/ id28890 View details	2026-05-04	Bahamas	Manufacturing / Engineering	pending
wilkemsolutions.com wilkemgroup.com 400gb gov contract etc ID 28890
Ransomware	northshoreenv.com id28332 View details	2026-05-02	United States	Energy	pending
North Shore Environmental Consultants is a progressive environmental company that provides a wide range of environmental management and consulting services to help clients navigate complex environmental and regulatory challenges. With over 20 years of experience, they offer solutions in areas such as remediation, emergency spill response, air quality, and corporate consulting. Their client base spans various industries across western Canada, and they are recognized for their innovative operational programs and commitment to client satisfaction. North Shore is dedicated to fostering a sustainable future while continuously expanding their expertise and services. Employees: 200 Revenue: $23.5 Million Industry: Business Services Phone Number: (780) 467-3354 ID 28332
Ransomware	Arban & Carosi id28423 View details	2026-04-30	United States	Construction / Real Estate	leaked
Arban Carosi: 1TB customer and company data leaked due to negligence. * * Full employee base: Including names, positions, personal and work email addresses, phone numbers. * * Financial Documentation: Contracts, Invoices, Revenue Data * * Customer base: Customer contact details, project details * * Internal correspondence: Service emails and documents disclosing internal processes and company plans. !! In the screenshots, you can see that we have accessed detailed plans of various buildings, including U.S. Army buildings!! We will publish all the data in a week and everyone can use it for their own purposes. ID 28423
Ransomware	Iowa Spring Manufacturing & Sales id28464 View details	2026-04-29	United States	Manufacturing / Engineering	pending
Iowa Spring is a well-established manufacturer specializing in a variety of springs, including those for overhead garage doors, mechanical applications, and agricultural equipment. Founded in 1977 and based in Adel, Iowa, the company has built a strong reputation for quality and reliability in the spring manufacturing industry. 2112 Greene Street P.O. Box 130 Adel, IA 50003, US www.iowaspring.com Leaked data: 49,4Gb Accounting, product development and testing, laboratory defect analysis, supply logistics, contracts, NDA, financial indicators, corporate information, and much more ID 28464

Incransom

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (7)

Top Activity Sectors (18)