Ransomware Group intelligence

Incransom

Active

Track Incransom with 986 published victims and 7 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 986 Known published victims in this dataset

First discovered 2023-08-09 Earliest victim discovery date

Last discovered 2026-10-15 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 545 victims

Known locations 7 Leak or negotiation infrastructure tracked

Incransom is tracked by Breach House as a ransomware group with 986 published victims.

United States is currently the most targeted country in this dataset.

7 known leak locations are currently associated with this group.

986

Leaked 281 28.5%
Pending 702 71.2%
Deleted 3 0.3%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 6	Onion service	Up checked 4h ago	`incblog6qu4y4mm4zvw5nrmue6qbwtgjsxpw6b7ixzssu36tsajldoad.onion`
Leak location 7	Onion service	Up checked 4h ago	`incbacg6bfwtrlzwdbqc55gsfl763s3twdtwhp27dzuik6s6rwdcityd.onion`
Leak location 2	Onion service	Down checked 4h ago	`incbackrlasjesgpfu5brktfjknbqoahe2hhmqfhasc5fb56mtukn4yd.onion`
Leak location 5	Web location	Down checked 4h ago	`incapt.su`
Leak location 1	Onion service	Down checked 4h ago	`incblog7vmuq7rktic73r4ha4j757m3ptym37tyvifzp2roedyyzzxid.onion`
Leak location 4	Web location	Down checked 4h ago	`incapt.blog`
Leak location 3	Web location	Down checked 4h ago	`incbackend.top`

Communication / Marketing 173
Healthcare / Pharma 116
Finance / Legal / Insurance 114
Services 81
Manufacturing / Engineering 76
Education 58
Not identified 56
Construction / Real Estate 53
Public Sector 45
IT 40
Retail / E-commerce 32
Transportation / Travel / Logistics 24
NGOs / Associations 24
Energy 22
Hospitality / Food & Beverage / Tourism 17
Agriculture / Food 14
Telecommunications 11
null 2

Typical Attacks (35)

▼

How Incransom typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via INC Ransom, INC Ransomware.

T1588.002 Tool Resource Development

What they do: INC Ransom has acquired and used several tools including MegaSync, AnyDesk, esentutl and PsExec.

What that means: Adversaries may buy, steal, or download software tools that can be used during targeting.
T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: INC Ransom has used compromised valid accounts for access to victim environments.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1190 Exploit Public-Facing Application Initial Access

What they do: INC Ransom has exploited known vulnerabilities including CVE-2023-3519 in Citrix NetScaler for initial access.

What that means: Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
T1566 Phishing Initial Access

What they do: INC Ransom has used phishing to gain initial access.

What that means: Adversaries may send phishing messages to gain access to victim systems.
T1047 Windows Management Instrumentation Execution

What they do: INC Ransom has used WMIC to deploy ransomware.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.003 Windows Command Shell Execution

What they do: INC Ransom has used `cmd.exe` to launch malicious payloads.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: INC Ransomware can use the API `DeviceIoControl` to resize the allocated space for and cause the deletion of volume shadow copy snapshots.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1569.002 Service Execution Execution

What they do: INC Ransom has run a file encryption executable via `Service Control Manager/7045;winupd,%SystemRoot%\winupd.exe,user mode service,demand start,LocalSystem`.

What that means: Adversaries may abuse the Windows service control manager to execute malicious commands or payloads.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: INC Ransom has named a PsExec executable winupd to mimic a legitimate Windows update file.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1070.004 File Deletion Stealth

What they do: INC Ransom has uninstalled tools from compromised endpoints after use.

What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
T1140 Deobfuscate/Decode Files or Information Stealth

What they do: INC Ransomware can run `CryptStringToBinaryA` to decrypt base64 content containing its ransom note.

What that means: Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis.
T1685 Disable or Modify Tools Defense Impairment

What they do: INC Ransom can use SystemSettingsAdminFlows.exe, a native Windows utility, to disable Windows Defender.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1046 Network Service Discovery Discovery

What they do: INC Ransom has used NETSCAN.EXE for internal reconnaissance.

What that means: Adversaries may attempt to get a listing of services running on remote hosts and local network infrastructure devices, including those that may be vulnerable to remote software exploitation.
T1049 System Network Connections Discovery Discovery

What they do: INC Ransom has used RDP to test network connections.

What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
T1057 Process Discovery Discovery

What they do: INC Ransomware can use the Microsoft Win32 Restart Manager to kill processes with a specific handle or that are accessing resources it wants to encrypt.

What that means: Adversaries may attempt to get information about running processes on a system.
T1069.002 Domain Groups Discovery

What they do: INC Ransom has enumerated domain groups on targeted hosts.

What that means: Adversaries may attempt to find domain-level groups and permission settings.
T1083 File and Directory Discovery Discovery

What they do: INC Ransomware can receive command line arguments to encrypt specific files and directories.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1087.002 Domain Account Discovery

What they do: INC Ransom has scanned for domain admin accounts in compromised environments.

What that means: Adversaries may attempt to get a listing of domain accounts.
T1120 Peripheral Device Discovery Discovery

What they do: INC Ransomware can identify external USB and hard drives for encryption and printers to print ransom notes.

What that means: Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.
T1135 Network Share Discovery Discovery

What they do: INC Ransom has used Internet Explorer to view folders on other systems.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1652 Device Driver Discovery Discovery

What they do: INC Ransomware can verify the presence of specific drivers on compromised hosts including Microsoft Print to PDF and Microsoft XPS Document Writer.

What that means: Adversaries may attempt to enumerate local device drivers on a victim host.
T1680 Local Storage Discovery Discovery

What they do: INC Ransomware can discover and mount hidden drives to encrypt them.

What that means: Adversaries may enumerate local drives, disks, and/or volumes and their attributes like total or free space and volume serial number.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: INC Ransom has used RDP to move laterally.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1570 Lateral Tool Transfer Lateral Movement

What they do: INC Ransom has used a rapid succession of copy commands to install a file encryption executable across multiple endpoints within compromised infrastructure.

What that means: Adversaries may transfer tools or other files between systems in a compromised environment.
T1074 Data Staged Collection

What they do: INC Ransom has staged data on compromised hosts prior to exfiltration.

What that means: Adversaries may stage collected data in a central location or directory prior to Exfiltration.
T1560.001 Archive via Utility Collection

What they do: INC Ransom has used 7-Zip and WinRAR to archive collected data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1071 Application Layer Protocol Command and Control

What they do: INC Ransom has used valid accounts over RDP to connect to targeted systems.

What that means: Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic.
T1105 Ingress Tool Transfer Command and Control

What they do: INC Ransom has downloaded tools to compromised servers including Advanced IP Scanner.

What that means: Adversaries may transfer tools or other files from an external system into a compromised environment.
T1219 Remote Access Tools Command and Control

What they do: INC Ransom has used AnyDesk and PuTTY on compromised systems.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1537 Transfer Data to Cloud Account Exfiltration

What they do: INC Ransom has used Megasync to exfiltrate data to the cloud.

What that means: Adversaries may exfiltrate data by transferring the data, including through sharing/syncing and creating backups of cloud environments, to another cloud account they control on the same service.
T1486 Data Encrypted for Impact Impact

What they do: INC Ransom has used INC Ransomware to encrypt victim's data.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: INC Ransomware can issue a command to kill a process on compromised hosts.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: INC Ransomware can delete volume shadow copy backups from victim machines.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1491.001 Internal Defacement Impact

What they do: INC Ransomware has the ability to change the background wallpaper image to display the ransom note.

What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
T1657 Financial Theft Impact

What they do: INC Ransom has stolen and encrypted victim's data in order to extort payment for keeping it private or decrypting it.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (11)

▼

Software Incransom has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Discovery

AdFind Advanced IP Scanner

Discovery & enumeration

AdFind Advanced IP Scanner

Exfiltration

BackBlaze MEGA Restic RClone s5cmd

LOLBAS (living-off-the-land binaries)

Finger PsExec

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Victims (986)

Search, filter and paginate the victim timeline for Incransom. Showing 301–400 of 986.

Type	Target	Discovered	Country	Business Category	Leak status
Ransomware	WE Fitness id26865 View details	2026-02-26	Thailand	NGOs / Associations	leaked
Email [email protected] 02-059-3939 ID 26865
Ransomware	APRO Asian Protection Pte Ltd id26864 View details	2026-02-26	Singapore	Communication / Marketing	leaked
+65 65676388 +60 46560933 [email protected] [email protected] ID 26864
Ransomware	JA AKITA KITA LIFE SERVICE, K.K id26863 View details	2026-02-26	Japan	Other	pending
https://ja-akitakita-ls.jp/ 0186-55-1412 ID 26863
Ransomware	acwapower.com \ https://www.larsentoubro.com/ id26772 View details	2026-02-24	Saudi Arabia	Energy	pending
400gb ID 26772
Ransomware	The City of Cocoa id26760 View details	2026-02-23	United States	Public Sector	pending
The City of Cocoa offers diverse public services aimed at enhancing the quality of life for its community. Their services include water management, economic development programs, and various community engagement initiatives. Intended clients encompass local residents, businesses, and visitors who seek information and support from city departments. The city is also focused on maintaining public safety, health, and environmental stewardship. ID 26760
Ransomware	primepak.com id26759 View details	2026-02-23	United States	Communication / Marketing	leaked
Primepak is your worldwide specialist in packaging. As a leading manufacturer, importer and distributor since 1972, we provide a wide range of solutions for every application in packaging, plastic bags, poly sheets, tubing and films. Employees: 200 Revenue: $54.3 Million Industry: Manufacturing Phone Number: (201) 836-5060 ID 26759
Ransomware	Rainier Clinical Research Center id26734 View details	2026-02-23	United States	Healthcare / Pharma	leaked
Rainier Clinical Research Center is a leading research facility specializing in clinical trials for diabetes, medical devices, and high-volume studies, with over 700 studies completed in 30 years. The center provides a purpose-built 15,000 square-foot research space We will publish all the information next week. ID 26734
Ransomware	TESTCOMPANY id26701 View details	2026-02-21	Barbados	Services	pending
test ID 26701
Ransomware	polymedicure.com id26690 View details	2026-02-20	India	Healthcare / Pharma	leaked
Polymed is a global leader in the medical device industry, offering a wide range of medical devices since 1997. The company specializes in various fields including infusion therapy, critical care, dialysis, cardiology, and oncology ID 26690
Ransomware	aircotedivoire.com id26653 View details	2026-02-19	South Africa	Transportation / Travel / Logistics	leaked
Established in 2012, Air Côte d'Ivoire offers direct and frequent flights. They are based in Abidjan, Ivory Coast. Employees: 1000 Revenue: 40.5 Million Industry: Airlines, Airports & Air Services Phone Number: +225 20251030 ID 26653
Ransomware	Valgo SA id26652 View details	2026-02-19	France	Communication / Marketing	pending
VALGO SAS 72 Rue Aristide Briand, 76650 Petit-Couronne, France valgo.com VALGO is a French company that specializes in environmental services, particularly in the areas of asbestos removal, soil decontamination, and the revitalization of polluted industrial sites. Established in 2004, VALGO has developed a strong reputation for its expertise in managing contaminated sites and providing innovative solutions for environmental remediation. VALGO operates a national network of 17 branches and has an international presence, allowing it to address diverse environmental challenges across different regions. Total data in the leak: 279 GB (225,372 Files, 50,902 Folders) Leaked data: - Clients: Renault Group, Sectra,Evarisk, EPF Reunion,Rousselet and many others famous companies - Data Classification: confidential, Private/Proprietary - Special data: Complete information on projects in countries of operation: contracts, NDAs, correspondence with clients, information about manufacturers of the equipment used and the chemical elements employed, labaratory reserch, hazard information, corporate information, and much more. - Financial data: invoicing and payment records, financial planning documents, accounting, and customer information and VERY IMPORTANT information! ID 26652
Ransomware	Hiwassee Builder Supply id26608 View details	2026-02-17	United States	Communication / Marketing	pending
HIWASSEE BUILDERS SUPPLY is dedicated to delivering a wide range of building products and services with exceptional value and service across East Tennessee and beyond. They offer in-house expertise for project design, estimation, and timely product delivery, catering to both home remodeling and commercial construction needs. With four locations in East Tennessee, they ensure efficient service and support throughout various projects. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 26608
Ransomware	farbank.com (flywatertravel) id26607 View details	2026-02-17	United States	Finance / Legal / Insurance	pending
Far Bank Enterprises is an integrated manufacturer and distributor of fly fishing products and services, including fly fishing rods, reels, waders, lines, leaders, tippet, performance outdoor apparel, and travel to the world's finest fly fishing experiences. Far Bank subsidiaries operate under the brand names Sage, Redington, RIO Products, and Fly Water Travel. Fly Water Travel is a leading provider of guided fly fishing trips and vacations, dedicated to delivering exceptional experiences for passionate anglers. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 26607
Ransomware	ACS Accountancy id26582 View details	2026-02-16	United States	Services	leaked
ACS Accounting (Berkshire) Ltd is a chartered management accounting firm that provides a comprehensive range of accounting and taxation services tailored for small and medium-sized businesses. Their services include bookkeeping, annual accounts, payroll, business planning, and tax compliance. We will publish all the information next week. ID 26582
Ransomware	Ondine Biomedical id26581 View details	2026-02-16	Canada	Healthcare / Pharma	leaked
Ondine Biomedical Inc. is a Canadian headquartered company led by founder and CEO, Carolyn Cross. Ondine has developed a patented, photodisinfection technology platform used in treatment and prevention therapies for a broad-spectrum of pathogens - including multidrug-resistant strains. Photodisinfection, which is not currently approved in the United States We will publish all the information next week. ID 26581
Ransomware	Nang Kuang Pharmaceutical Co., Ltd. id26578 View details	2026-02-15	Taiwan, Province of China	Healthcare / Pharma	pending
Nang Kuang Pharmaceutical Co. Ltd Revenue: 70M$ Nang Kuang Pharmaceutical Co. Ltd, nangkuang.com.tw , Total data in the leak: 430GB Leaked data: - Clients and Parners: Rosetta, PeptiStar Inc, Shiratori Pharmaceutical Co Ltd, Apexcela co. ltd, Somerset Pharma LLC., CureLeads FZ-LLC., Pfizer and other companies worldwide - Data Classification: confidential / Secret - Projects: Eroxon, Cinacalcet, Icatibant, Exparel, bupivacaine and many other medical drugs Data: Agreements, projects, lawsuits from Pfizer, clinical reports from inception to late phase, Personal info (ID scans), emails data, CDA and NDA, Clinical Review, Product Risk Assessment, RGD, RDO, DMF, GMP, CRF And a lot of other VERY IMPORTANT information! Full publication within four weeks! ID 26578
Ransomware	Bitgo id26567 View details	2026-02-14	Italy	Communication / Marketing	leaked
L'esperienza maturata dai suoi professionisti permette alla società BitGo di operare nel campo dell’Information & Communication Technology (ICT), fornendo servizi di assistenza e consulenza sistemistica. ID 26567
Ransomware	Midwestern Oil & Gas id26469 View details	2026-02-12	Nigeria	Energy	pending
Midwestern Oil & Gas Company Limited was incorporated in 1999 and commenced operations in 2001. The Company is owned by a group of Nigerian Investors and Delta State Government. ID 26469
Ransomware	rswater.ae id26468 View details	2026-02-12	Saudi Arabia	Communication / Marketing	pending
Al Rawdah Springs is a brand affiliated to Al Rawdah Green Sweet Water L.L.C an Emirati firm with local management specializing in the production and bottling of water in various sizes. ID 26468
Ransomware	lohmann-tapes.com id26462 View details	2026-02-12	Germany	Communication / Marketing	pending
For diverse industry needs, Lohmann is your reliable partner in smart bonding solutions. From industrial adhesive tapes to integrated smart products, from individual manufacturing components to comprehensive process integration - everything is provided from a single source. Employees: 5000 Revenue: $817.4 Million Industry: Chemicals & Related Products Phone Number: +33 232092323 - CFO Julie Pappas >telephoneNumber: +18593345280;ext=1014 >mail: [email protected] - Data volume: 700GB Finance, accounting & controlling: 24,098 files Sales & customer account files: 115,302 files Supply chain, procurement & logistics: 46,500 files Manufacturing operations & equipment: 453,935 files R&D, engineering & laboratory testing: 40,651 files Quality management & regulatory compliance: 88,287 files Health, safety, environment & SHEQ: 62,982 files IT systems, data exports & communications: 134,558 files Corporate administration, legal & general archives: 179,045 files ID 26462
Ransomware	auxhomeservices.com id26454 View details	2026-02-12	United States	Services	pending
Aux Home Services is a trusted provider of plumbing, electrical, heating, and air conditioning services in Birmingham, Alabama, along with Jefferson and Shelby counties. They pride themselves on delivering prompt and reliable service, available 24/7, with skilled technicians who respect and clean up after their work. The company emphasizes upfront pricing and quality craftsmanship, ensuring customer satisfaction. Their diverse range of services includes AC and heating installations, plumbing repairs, and electrical systems management. Employees: 50 Revenue: $6.9 Million Industry: Construction Management Phone Number: (205) 979-0946 ID 26454
Ransomware	atchadwick.net id26453 View details	2026-02-12	United States	Services	leaked
A.T. Chadwick is a mechanical contracting firm that offers services in plumbing, heating, air-conditioning, refrigeration, process piping, and field management. The company was founded in 1966 and is headquartered in Bensalem, Pennsylvania. Employees: 500 Revenue: $159.1 Million Industry: Construction Management Phone Number: (215) 245-5800 ID 26453
Ransomware	excavationtourigny.ca id26452 View details	2026-02-12	Canada	Services	leaked
Excavations Tourigny specializes in excavation, civil engineering, snow removal, and transportation services. The company caters to clients in the construction and infrastructure sectors. They are based in Victoriaville, QC and operate during regular business hours. Excavations Tourigny is dedicated to delivering quality work through their team of skilled professionals. Employees: 60 Revenue: $6.7 Million Industry: Construction Management Phone Number: (819) 330-3000 ID 26452
Ransomware	www.hfplanners.com id26443 View details	2026-02-11	United States	Other	leaked
full data corp ID 26443
Ransomware	moultriesheriff.com id26393 View details	2026-02-10	United States	Other	leaked
Sheriff's Office. 187-GB sensitive data ID 26393
Ransomware	Core Supply id26388 View details	2026-02-10	United States	Communication / Marketing	pending
Core Supply has been taking business from the competition since 2010. We believe in our aggressive approach and our active partnerships with our customers and suppliers. ID 26388
Ransomware	tuftco id26386 View details	2026-02-09	United States	Finance / Legal / Insurance	pending
Tuftco is a world-leading manufacturer of tufting machines and equipment, providing comprehensive solutions for carpet mills from tufting to finished carpet Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 26386
Ransomware	AOT Japan id26219 View details	2026-02-05	Japan	Transportation / Travel / Logistics	pending
AOT Japan Ltd. is a Japanese logistics and freight forwarding company and a member of the international AOT Group. It was officially incorporated in 1986, following its establishment as a liaison and sales office of American Overseas Transport Ltd. Initially focused on ocean shipments from the United States to Japan, the company has since expanded its services worldwide. With over 30 years of experience in the Japanese market, AOT Japan Ltd. is a member of JIFFA and the Tokyo Chamber of Commerce and holds an NVOCC license, enabling it to issue its own House Bills of Lading. The company offers a full range of logistics services, emphasizing high service quality, operational expertise, and a personalized, customer-focused approach. ID 26219
Ransomware	Western New York Energy id26095 View details	2026-02-03	United States	Energy	leaked
Western New York Energy LLC – Major Data Breach Announcement Western New York Energy LLC (wnyenergy.com), a leading regional ethanol producer and renewable energy company based in Medina, New York, has suffered a significant data compromise. Total volume of obtained data: ≈100 GB The leaked archive contains highly sensitive and business-critical materials, including: Confidential internal documents Client and counterparty data Non-Disclosure Agreements (NDAs) Financial records and reports Operational documentation and procedures Investor-related materials and presentations Corporate governance documents Commercial contracts and business agreements Technical drawings, schematics, and engineering files …and a substantial amount of other proprietary and strategically important information that is vital to the company’s operations, partnerships, and competitive position. This dataset provides deep insight into the internal workings, financial structure, client relationships, and strategic planning of one of the Northeast’s key ethanol producers. The information is authentic, recent, and untouched. ID 26095
Ransomware	Blystone & Bailey id26085 View details	2026-02-03	United States	Services	leaked
Blystone & Bailey, CPAs, PC is a Michigan-based CPA firm offering a range of services including audit, tax preparation and planning, payroll, financial planning, bookkeeping, and IT services management. The firm caters to various industries such as real estate, hospitality, oil, gas and energy, professional services, construction, manufacturing, retail, agriculture, franchising, and government and non-profit sectors. We have the entire Blystone & Bailey customer base at our disposal. Mail, financial documents, audits and more. ID 26085
Ransomware	H-Behbehani Brothers WLL id26084 View details	2026-02-03	Bahrain	Retail / E-commerce	leaked
Behbehani Motors Company, established in 1957, represents iconic automotive brands such as Volkswagen and Porsche in Kuwait. The company offers a range of services including car sales, a bodyshop, and a car rental division. This was the first Porsche dealership in the Middle East and only the 9th worldwide. We have 1.3TB of data. Internal mail, accounting, company customer information and we will publish all the information next week. ID 26084
Ransomware	ChokChey Finance id26079 View details	2026-02-02	Cambodia	Finance / Legal / Insurance	leaked
ChokChey Finance PLC is a microfinance institution based in Cambodia, established in 2015 and licensed by the National Bank of Cambodia in 2016. The company offers a variety of financial products including speed loans, agriculture loans, SME loans, and mobile device loans, targeting low to moderate income families ID 26079
Ransomware	www.pucobre.cl id26077 View details	2026-02-02	Chile	Manufacturing / Engineering	leaked
Sociedad Punta del Cobre S.A. is a company based in Chile that operates in the mining sector, specifically focusing on copper production ID 26077
Ransomware	Best Attorneys id26059 View details	2026-02-02	United States	Finance / Legal / Insurance	leaked
Eisenberg Lowrance Lundell Lofgren is dedicated to your success. We are contingency fee lawyers specializing in personal injury, immigration, and criminal defense located in South Jordan Utah. ID 26059
Ransomware	Foamtec International id26048 View details	2026-02-01	United States	Healthcare / Pharma	pending
Foamtec International is a global PU foam Manufacturing partner. We deliver quality, specialty foam products for contamination control, medical and specialty markets ID 26048
Ransomware	Hawk Law Group id26044 View details	2026-02-01	United States	Finance / Legal / Insurance	leaked
At Hawk Law Group, our trial attorneys were born and/or raised in the Augusta area. Collectively, our lawyers have more than 71 years of experience and are widely recognized throughout the Central Savannah River Area (CSRA) due to their tremendous successes in and out of the courtroom. Our lawyers understand the complexities of civil and criminal litigation and realize the importance of our justice system for their clients and families. ID 26044
Ransomware	Beacon Mutual Insurance id26011 View details	2026-01-31	United States	Finance / Legal / Insurance	pending
MAJOR DATA LEAK – Beacon Mutual Insurance Company EXPOSED: 275 GB (296,228,795,086 bytes) of highly sensitive internal data Beacon Mutual Insurance Company (Warwick, RI) – the primary workers' compensation insurer for Rhode Island businesses (also operating in MA & CT) – has suffered a massive data compromise. The leaked archive contains approximately 275 GB of uncompressed/internal files and includes the following categories of highly confidential information: Internal corporate documents and correspondence Complete financial statements and reports (2018–2025) Full employee list with personal details Confidential agreements, NDAs, vendor contracts, and partnership documents Detailed claims data: workers' compensation payouts, injury reports, medical records tied to claims Client / policyholder database: business information, insurance policies, payment history Personally identifiable information (PII) of individuals (employees, claimants, insured workers) – names, SSNs, addresses, dates of birth, contact details, etc. Training materials, internal manuals, compliance & safety documentation Multiple system backups and database dumps …and much more internal operational content ID 26011
Ransomware	PK PINHÃO & KOIFFMAN ATTORNEYS AT LAW id25986 View details	2026-01-30	Brazil	Finance / Legal / Insurance	pending
PK Advogados specializes in providing legal services that facilitate technology and innovation, targeting large and medium-sized companies. Their areas of expertise include family business planning, digital law, and various corporate legal services. The firm emphasizes creative solutions and multidisciplinary approaches, particularly in contracts, regulatory matters, and compliance. They also focus on sectors such as telecommunications, finance, and startups within the realms of blockchain and fintech Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 25986
Ransomware	DIEHL & CELLA ADVOGADOS ASSOCIADOS id25985 View details	2026-01-30	Brazil	Services	pending
Diehl & Cella specializes in providing personalized consulting services focusing on business law and tax issues. They assist companies in managing risks and identifying tailored solutions to enhance business outcomes. PK Advogados specializes in providing legal services that facilitate technology and innovation, targeting large and medium-sized companies. Their areas of expertise include family business planning, digital law, and various corporate legal services. The firm emphasizes creative solutions and multidisciplinary approaches, particularly in contracts, regulatory matters, and compliance. They also focus on sectors such as telecommunications, finance, and startups within the realms of blockchain and fintech Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 25985
Ransomware	distinctive-systems.com id25899 View details	2026-01-29	Australia	Services	pending
Distinctive Systems is a leading provider of management software specifically designed for coach, bus, and tour operators, with over 40 years of industry experience. Their product offerings include Coach Manager for private hire management, a Tour Booking System for passenger reservations, and a Vehicle Maintenance System for workshop management. The company serves clients globally from its offices in the UK, USA, and Australia, supporting over 2,600 systems. Distinctive Systems is known for its comprehensive solutions, expert training, and dedicated customer support ID 25899
Ransomware	JLK Rosenberger id25871 View details	2026-01-28	United States	Finance / Legal / Insurance	leaked
JLK Rosenberger LLP, Certified Public Accountants: A full service accounting and business advisory firm with offices in Irvine and Glendale, California and Dallas, Texas. The firm is recognized as a Top 400 Firm by Inside Public Accounting and one of the largest auditors of insurance entities in the United States as ranked by Aon and AM Best We have 300GB of data. Internal mail, accounting, company customer information and we will publish all the information next week. ID 25871
Ransomware	LGBTQ Center Orange county id25870 View details	2026-01-28	United States	Public Sector	leaked
The LGBTQ Center OC was established as a volunteer organization in 1971 and incorporated in 1975 as a 501(c)(3) non-profit community-based organization. The Center provides services to more than 20,000 individuals annually across a broad spectrum of culture, ethnicity, age, and economic background. We will publish all the information next week. ID 25870
Ransomware	DeRenzis & Associates id25869 View details	2026-01-28	United States	Agriculture / Food	leaked
DeRenzis & Associates, LLP is a specialized accounting firm focusing on agriculture accounting for both dairy and farming sectors. They offer services including financial statement compilation, income tax preparation, estate planning, and breakeven analysis. We will publish all the information next week. ID 25869
Ransomware	anagnosdoor.com id25863 View details	2026-01-27	United States	Communication / Marketing	leaked
Anagnos Door Co. specializes in the sale, installation, maintenance, and servicing of commercial overhead doors and related products. Established in 1989, the company is well qualified to serve clients in the competitive construction market of the Chicago area. With a team of IDEA-certified fire door technicians, Anagnos Door Co. ensures high-quality service and expertise. Their primary clients include businesses in need of commercial and industrial door solutions. Employees: 50 Revenue: $8.6 Million Industry: Home Improvement & Hardware Retail Phone Number: (708) 728-9000 ID 25863
Ransomware	nbccministries.org id25862 View details	2026-01-27	United States	NGOs / Associations	leaked
New Beginnings Church is a company that operates in the Religious Organizations industry. It employs 5to9 people and has under500K of revenue. The company is headquartered in Matthews, North Carolina. Employees: 25 Revenue: $5 Million Industry: Organizations Phone Number: (704) 567-2900 ID 25862
Ransomware	Callagy Law Firm id25861 View details	2026-01-27	United States	Finance / Legal / Insurance	pending
CALLAGY LAW, P.C. 650 From Road, Suite 240 Paramus, NJ 07652 callagylaw.com This law firm specializes in various legal areas, including business litigation, personal injury, family law, and healthcare law. The firm is known for its commitment to providing comprehensive legal representation and has been operational since 1997. Total data in the leak: 355 GB (480,169 Files, 38,388 Folders) Leaked data: - Clients: companies and individuals - Data Classification: confidential, Private/Proprietary - Special data: Corporate email correspondence, external business correspondence, corporate documents,company policies and regulations,customer contracts and NDAs (Non-Disclosure Agreements), court hearing materials and litigation case files (litigation documents),customers' personal data and their medical confidentiality (PII,PHI) and other related information. - Financial data: financial metrics / financial performance data, invoices, payments, and other financial transactions. ID 25861
Ransomware	ttmet.co.th id25860 View details	2026-01-27	Thailand	Manufacturing / Engineering	pending
The company specializes in the import and export of machinery and spare parts used in the production and quality control for automotive manufacturing. They offer both wholesale and retail sales domestically and internationally, along with installation services, equipment inspections, and maintenance. Their intended clients include automotive manufacturers and businesses in need of machinery and parts. The company is committed to providing comprehensive services to ensure operational efficiency in the automotive sector. Employees: 150 Revenue: $30.4 Million Industry: Automobile Dealers - Retail Phone Number: +66 26255880 ID 25860
Ransomware	shawhillprimaryschool.org.uk id25857 View details	2026-01-27	United Kingdom	Education	pending
Shaw Hill Primary School is dedicated to providing a high-quality education in a supportive and nurturing environment. They focus on developing students' knowledge, skills, and personal growth, preparing them to be successful citizens in modern Britain. The school promotes strong relationships with families and the community while prioritizing student safety and well-being. Their comprehensive curriculum incorporates various subjects and extracurricular activities to stimulate and challenge the children Employees: 24 Revenue: $5 Million Industry: Education Phone Number: +44 8000283550 ID 25857
Ransomware	newkirklaw.com id25856 View details	2026-01-27	United States	Finance / Legal / Insurance	pending
Newkirk Zwagerman, P.L.C. is a law firm based in Des Moines, specializing in employment law and advocating for employees' rights. They provide legal services to individuals facing discrimination, harassment, and retaliation in the workplace, as well as those involved in executive employment disputes and Title IX actions. The firm serves clients in Iowa and Minnesota, offering personalized legal representation to help employees navigate complex employment issues. With a commitment to fairness and accountability, Newkirk Zwagerman, P.L.C. empowers clients to stand up against larger corporate entities and seek justice ID 25856
Ransomware	The Trevino Group, Inc id25838 View details	2026-01-27	United States	Finance / Legal / Insurance	pending
WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Drawings And a lot of other VERY IMPORTANT information! ID 25838
Ransomware	Uniflex Technology Inc id25833 View details	2026-01-26	Taiwan, Province of China	IT	pending
UNIFLEX TECHNOLOGY INC https://www.uniflex.com.tw/ Total data in the leak: 430GB Leaked data: - Clients: Asus, BMW, Mercedes-Benz, ELAN MICROELECTRONICS CORP., Dell, Volkswagen, Wacom, Netronix Inc, Solomon Systech, Innolux and other large clients all over the world! - Data Classification: confidential - Projects: Flexible printed circuit (FPC) boards, surface mount technology (SMT) services, design, manufacturing, assembly of FPC boards. - Data: Agreements, projects, drawings, contracts, technical documentation, reports, research, quality control, technological processes and equipment. And a lot of other VERY IMPORTANT information! Full publication within two weeks! ID 25833
Ransomware	www.shrimphouse.com id25821 View details	2026-01-26	United States	Other	leaked
1tb data ID 25821
Ransomware	goldair.gr id25722 View details	2026-01-23	Greece	Transportation / Travel / Logistics	pending
Goldair Handling Overview Metrics www.goldair-handling.gr This company has 72 hours before we publish 1TB of personal data. Goldair Handling Goldair Handling is a leading provider of ground handling services operating in Greece, Cyprus, Bulgaria, India, and Serbia. The company employs more than 5,000 qualified specialists who have successfully serviced more than 160,000 flights at 36 airports. The company focuses on providing customized services tailored to the needs of its business partners, with a special emphasis on corporate social responsibility and sustainable development. Goldair Handling is committed to innovation and progressive thinking in the aviation industry. Goldair Cargo Greece Headquarters: Tessi Rikya, Aspropyrgos, Greece Phone number: +30 2111804200 Website: www.goldair-cargo.com Revenue: $190.2 million Employees: 201-500 Goldair Cargo, part of the Goldair Group founded in 1987, is a leading international freight forwarding and logistics company based in Greece. The company offers a wide range of high-quality services, including third-party logistics (3PL), road, air, and sea transport, relying on an extensive network of partners. With over 35 years of experience, Goldair Cargo strives to provide reliable and efficient logistics solutions tailored to the needs of its customers. Its focus on sustainable development and corporate social responsibility further strengthens its reputation in the logistics industry. _______________________ ID 25722
Ransomware	tob-bmw.sk id25716 View details	2026-01-23	Slovakia	Communication / Marketing	leaked
Some data from 590 gigabytes T.O.B. is an authorized BMW dealer located in Trenčín, Slovakia, offering a wide range of new and certified pre-owned BMW vehicles. ID 25716
Ransomware	OAB id25712 View details	2026-01-23	Brazil	Finance / Legal / Insurance	pending
The Ordem dos Advogados do Brasil - São Paulo serves as the largest section of the Brazilian Bar Association, tirelessly supporting and defending the legal profession. It provides various services including a legal library, digital certification, and public information on legal fees and judicial assistance. OAB SP hosts numerous events and conferences to foster legal dialogue, innovation, and the protection of the rights of lawyers. Its intended clients include legal professionals across São Paulo, as well as the broader community seeking legal assistance and information. ID 25712
Ransomware	minorsgardencenter.com id25709 View details	2026-01-23	United States	Retail / E-commerce	leaked
Employees: 120 Revenue: $17.3 Million Industry: Retail Phone Number: (414) 354-4830 ID 25709
Ransomware	Elmore Goldsmith Kelley & deHoll id25693 View details	2026-01-22	United States	Communication / Marketing	pending
Elmore Goldsmith Kelley & deHoll is a legal firm specializing in construction law, offering services such as project counsel, construction claims, contract negotiations, risk management, complex litigation, fidelity and surety, and public procurement. They serve clients in the construction industry, providing expert legal support to help them navigate complex issues and protect their interests. The firm prides itself on its industry knowledge and commitment to delivering efficient and effective results. With an award-winning team, they aim to be a trusted legal partner for construction professionals. ID 25693
Ransomware	Sandberg id25620 View details	2026-01-20	United Kingdom	Services	pending
Sandberg is an independent consultancy firm established in 1860, renowned for its expertise in materials testing, inspection, and consultancy services within the construction industry. The company offers a wide range of services including laboratory testing, site inspections, and quality assurance for various materials such as concrete, stone, and metals Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 25620
Ransomware	Southern Alberta Community Living Association id25573 View details	2026-01-18	Canada	Communication / Marketing	pending
SACLA provides individualized services and supports aimed at assisting individuals with disabilities to achieve their personal goals. Established in 1980, the association focuses on building vibrant communities where every person is connected, contributing, and valued. Their services are tailored to the unique needs of each individual, beginning with a comprehensive consultation to determine the best approach for fostering quality of life and aspirations. SACLA also engages in projects like MyCompass and CATALYST to promote empowerment and address issues such as unemployment for marginalized groups. ID 25573
Ransomware	MKC Customs Brokers International Inc. id25572 View details	2026-01-18	United States	Retail / E-commerce	pending
International trading has never been as complicated and demanding as it is today. Every shipment, large or small, requires a customs broker who is an absolutely dependable working partner. That's MKC Customs Brokers! ID 25572
Ransomware	ecsc.org id25557 View details	2026-01-16	United States	Energy	pending
Website www.ecsc.org Revenue $11.2 million Industry Electricity, oil and gas Energy, utilities and waste Organizational structure Similar companies Company analytics About South Carolina Electric Cooperatives Electric Cooperatives of South Carolina, Inc. is a statewide service and trade association representing electric cooperatives throughout the state. It serves 18 consumer-owned electric cooperatives, one wholesale electric cooperative, one transmission cooperative, and one materials cooperative. The association's mission is focused on providing electricity to nearly 2 million South Carolinians through an extensive network of power lines, as well as providing energy efficiency programs and clean energy initiatives. The association advocates for the electrification of rural areas and provides various resources, including educational programs and assistance in purchasing electric vehicles. ID 25557
Ransomware	cirrusaviation id25544 View details	2026-01-16	United States	Transportation / Travel / Logistics	pending
Cirrus Aviation Services is the largest luxury private jet charter service in Las Vegas. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Financial databases, all transactions, all clients And a lot of other VERY IMPORTANT information! ID 25544
Ransomware	https://trustarholdingsllc.com/ https://vistlabs.com/ id25531 View details	2026-01-15	United States	Finance / Legal / Insurance	leaked
All company data, development drawings, confidential files, investor company files, all financial transactions, equipment, violations, 1.4 TB ID 25531
Ransomware	https://acswinc.com/ id25493 View details	2026-01-14	United States	Other	pending
1.5tb ID 25493
Ransomware	https://bellowsmfg.com/company/ id25485 View details	2026-01-13	United States	Other	pending
1.3tb ID 25485
Ransomware	Ju Teng International Holdings Ltd id25484 View details	2026-01-13	Hong Kong	Communication / Marketing	pending
Ju Teng International Holdings Ltd Total data in the leak: 200GB Leaked data: - Clients: Dell, Acer, HTC, HP, Panasonic, Siemens, Nintendo, Mercedes-Benz, BMW, Scania, Ford, Geely, Continental, other large clients all over the world! - Data Classification: confidential - Projects: DELL JPPA, HP MI & TGA, AMG CDD & ICD and many other projects. All project information: development, laboratory testing, drawings, subcontractors, suppliers. - Financial data: Company income and expenses, IPD information, financial reports. Contracts with customers and suppliers, NDA contracts. And a lot of other VERY IMPORTANT information! ID 25484
Ransomware	gbmme.com id25474 View details	2026-01-13	United Arab Emirates	Services	leaked
Founded in 1990, based out of Abu Dhabi, United Arab Emirates, Gulf Business Machines (GBM) is a IT solutions provider, fulfilling the IT requirements of local, regional and international organisations in the GCC. We have 200GB of data at our disposal (fiscal data, internal mail,budgets and many other things) ID 25474
Ransomware	stimgroup id25471 View details	2026-01-13	Italy	Communication / Marketing	pending
STIM goes beyond by offering a comprehensive technological service ranging from Project Management activities to a Global Service Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development And a lot of other VERY IMPORTANT information! ID 25471
Ransomware	Rodney's Sign Company id25470 View details	2026-01-13	United States	Communication / Marketing	pending
ASI Raleigh offers a full-service team to support the planning, engineering and implementation of precise execution and superior quality signage projects for North Carolina’s leading brands. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development ID 25470
Ransomware	Fit-Line Global id25467 View details	2026-01-13	United States	Communication / Marketing	pending
Fit-Line Global® is a trusted supplier, designer, research and development resource for SEMI-F57-0301 compliant PFA and PVDF components. They employ efficient manufacturing processes to create products that meet the most demanding applications. Fit-Line Global has been a trusted supplier to the semiconductor industry for more than 25 years. Headquartered in California, Fit-Line Global dedicates itself to providing quality products, with the fastest lead time in the industry, at a fair price. The company exclusively produces ultra-high purity PFA and PVDF components to eliminate the possibility of cross-contamination. ID 25467
Ransomware	Cape Fear Country Club id25466 View details	2026-01-13	United States	Communication / Marketing	leaked
Cape Fear Country Club is a private members-only country club in North Carolina, founded in 1896. It offers an 18-hole golf course designed by Donald Ross, along with tennis, swimming, fitness amenities, dining services, and a wide range of social and family-oriented activities. The club is known for its long-standing traditions, high service standards, and close-knit community environment. ID 25466
Ransomware	Harrison Design id25462 View details	2026-01-12	United States	Construction / Real Estate	pending
Harrison Design is an award-winning design firm specializing in architecture, interior design, and landscape architecture. Their services cater to various sectors including residential, multifamily, sacred, and hospitality projects. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Drawings And a lot of other VERY IMPORTANT information! ID 25462
Ransomware	Rod Danielson id25447 View details	2026-01-12	United States	Finance / Legal / Insurance	pending
Rod Danielson serves as a Chapter 13 Trustee in the Central District of California, Riverside Division. The organization provides public services related to Chapter 13 bankruptcy for debtors, creditors, attorneys, and other interested parties. It offers information on various procedures including appearances at hearings and guidance on case management. The intended clients encompass individuals and entities involved in Chapter 13 bankruptcy proceedings in Riverside. ID 25447
Ransomware	Foshee Architecture id25403 View details	2026-01-10	United States	Construction / Real Estate	pending
Foshee Architecture is a Montgomery, Alabama-based architecture firm specializing in comprehensive design services for a variety of sectors including multi-family housing, healthcare facilities, office spaces, retail, and restaurants. Founded by John H. Foshee, the firm utilizes a personalized design process informed by a rich family history in the construction industry. By collaborating with experts in engineering and other disciplines, they provide tailored architectural solutions that prioritize client objectives and budgets. Their extensive experience positions them to effectively manage complex projects while ensuring high standards of functionality and aesthetic appeal. ID 25403
Ransomware	CompactInd id25401 View details	2026-01-10	United States	Agriculture / Food	pending
Compact Industries, Inc. is a leading contract manufacturer specializing in dry food products, particularly powdered food items and sugar-based drink mixes. Established in 1963, the company offers custom blending and contract packaging services, catering to a diverse range of clients. Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development And a lot of other VERY IMPORTANT information ID 25401
Ransomware	The Carlson Law Firm id25397 View details	2026-01-09	United States	Finance / Legal / Insurance	leaked
Established in 1976, The Carlson Law Firm has built a reputation not only for our formidable presence in courtrooms but for our deep-rooted desire to serve the community. Our foundation rests on the shoulders of our Managing Partner, Craig Carlson. A proud veteran, Craig's values are the compass that has guided our firm's journey, helping us grow from a modest establishment in Killeen, Texas, to a renowned legal powerhouse with 17 locations in Texas, an office in California, and another in Florida. ID 25397
Ransomware	stignatiusijamsville.org id25392 View details	2026-01-09	United States	NGOs / Associations	leaked
St Ignatius of Loyola Catholic Community is a company that operates in the Religious Organizations industry. It employs 10to19 people and has under500K of revenue. The company is headquartered in Ijamsville, Maryland Employees: 20 Revenue: $5 Million Industry: Church Management Phone Number: (301) 695-8845 ID 25392
Ransomware	https://lpollockpr.com/ id25377 View details	2026-01-08	United States	Other	leaked
all data corp / all client data ID 25377
Ransomware	Borough of Moonachie id25272 View details	2026-01-03	United States	Education	pending
On April 11, 1910, Moonachie was finally incorporated as a borough. That same year, the Board of Education and the Moonachie Fire Company were organized. Town life in Moonachie, during these days, was centered around family, farms and the church. Robert L. Craig became the first Mayor. ID 25272
Ransomware	proton-system_Serbia id25270 View details	2026-01-03	Serbia	Communication / Marketing	pending
Website - www.proton.rs https://www.zoominfo.com/c/proton-system/450181945 Despite repeated attempts to convince the organization's management to prevent the leak, we were completely ignored. People who have been affected by the publication of their personal data should understand that www.proton.rs is only interested in making money off you; they do not ensure the safety of their customers and employees. Proton System has two days to continue negotiations, otherwise more than 130 GB of personal data will be made public. ----- About Proton System Proton System is a leading company in the region that specializes in the representation, evaluation, export, and distribution of unique pharmaceutical products across Europe, the Middle East, and North Africa. Founded in 1999, it focuses on providing top-notch services in the distribution, logistics, and marketing of dietary products, medical devices, and medications for family health. The company guarantees efficiency and effectiveness through innovative marketing and a commitment to high-quality standards. Proton System's products feature a unique combination of natural, safe, and effective ingredients, ensuring their effectiveness and safety in the market. ID 25270
Ransomware	Automation One Business Systems Inc id25269 View details	2026-01-03	Canada	Services	pending
Automation One Business Systems Inc is a leading provider of office equipment solutions in Vancouver, specializing in a wide range of printing products including multifunction printers, document scanners, and mailing machines. The company is dedicated to delivering exceptional customer service and has a highly qualified team of technicians to ensure fast and reliable support. With over 40 years of experience, Automation One offers unbiased consulting services to help clients choose the best solutions for their needs. Their extensive inventory and local presence in Vancouver and Burnaby enable them to minimize downtime and maintain efficient operations for businesses. ID 25269
Ransomware	Burnham Brown id25229 View details	2025-12-31	United States	Finance / Legal / Insurance	pending
Burnham Brown is a law firm based in Oakland, California that provides legal services in various practice areas including retail and hospitality, real estate, business and commercial, as well as employment law. The firm caters to clients across industries such as transportation, logistics, and manufacturing, helping them navigate legal risks and compliance issues. They offer updates and resources on changes in law and industry-related news to inform their clients. Additionally, Burnham Brown conducts events and discussions to engage with the community and provide insights on evolving legal matters. ID 25229
Ransomware	3GH Informatica Integral id25228 View details	2025-12-31	Spain	IT	pending
3GH specializes in providing technological infrastructure management and data security services to medium and large enterprises. Their offerings include digital signage solutions, logistical technology support, and resident technicians, ensuring optimized processes for their clients. With over 29 years of experience, they have a diverse portfolio of clients across various sectors and maintain a national coverage in Spain. The company is committed to innovation and creating value through a dedicated team of over 100 qualified technicians and a comprehensive management system. ID 25228
Ransomware	OSI Systems, Inc. id25226 View details	2025-12-30	United States	Healthcare / Pharma	pending
OSI Systems, Inc. Total data in the leak: 250GB Leaked data: - Clients: US Government, US Secret Service, IDSS, GLOBAL AEROSPACE INC, Governments of many countries, Casco Automotive Singapore Pte Ltd, Medtronic, Opengear Inc, Sick Sdn Bhd, ST JOSEPH HOSPITAL, SSM HEALTH CARE CORPORATION, UPMC HEALTH SYSTEM and many other large clients all over the world! - Data Classification: Secret - Projects: Raven, Canopy, SPARK, Lighthouse and many other projects. All project information: development, laboratory testing, drawings, subcontractors, suppliers. - Financial data: Company structure. Company income and expenses, shareholders information, such as BlackRock, Inc. and many other investors. Nasdaq data. Contracts with customers and suppliers, NDA contracts. And a lot of other VERY IMPORTANT information! ID 25226
Ransomware	selp id25195 View details	2025-12-29	France	Finance / Legal / Insurance	pending
selp.fr Clients: apple, loreal, google, ikea... WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Source Code And a lot of other VERY IMPORTANT information! ID 25195
Ransomware	omrania id25186 View details	2025-12-29	Saudi Arabia	Finance / Legal / Insurance	pending
Omrania Website:www.omrania.com WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Corporate data - Business Agreements - Projects - Drawings - Total: 4000GB And a lot of other VERY IMPORTANT information! ID 25186
Ransomware	klingele id25185 View details	2025-12-28	Germany	Finance / Legal / Insurance	pending
Klingele Paper & Packaging Website: www.klingele.com WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Technology - Total: 450GB And a lot of other VERY IMPORTANT information! ID 25185
Ransomware	WSI id25068 View details	2025-12-24	France	Education	pending
Wall Street Institute www.wallstreetenglish.com https://www.zoominfo.com/c/wall-street-institute/372818113 If the management of this company does not want a global leak of personal data, we advise you to contact us. ------------------------------ Wall Street English (formerly Wall Street Institute) is an international English language learning academy for children and adults around the world. Wall Street English was established in 1972 in Italy by Italian Luigi Tiziano Peccenini. The company has over 3 million alumni with a current enrolment of 180,000 students. Using a franchise model, they currently operate over 450 centers in 28 countries in North Africa, East Asia, Southeast Asia, Europe, Latin America, and the Middle East. Its international offices are in Hong Kong and in Barcelona, Spain. In 2013, Wall Street Institute launched a company-wide rebranding, changing its name and identity. The company now operates as Wall Street English. The Wall Street English program is designed for all levels of learners. They have 20 different levels of English language courses ranging from beginner to advanced. ID 25068
Ransomware	Talarico id24980 View details	2025-12-21	Italy	Manufacturing / Engineering	pending
Talarico SRL has 30 years of experience in thermohydraulics and technological systems. The company boasts a well-stocked retail sales counter and has completed large industrial installations. Its extensive showroom features the best brands for home bathroom furnishings, with specialized consultants using state-of-the-art software for design. Talarico SRL also designs and builds various types of industrial hydraulic systems and offers free information and quotes. ID 24980
Ransomware	Evercover id24979 View details	2025-12-21	Hungary	Communication / Marketing	pending
Evercover Helmet Cover is a family business founded in 2013 with the vision to manufacture outstanding quality helmet covers at a reasonable price. Now, a couple of years later, we already manufacture helmet covers for customers from over 70 countries all around the world. ID 24979
Ransomware	svlawus.com id24978 View details	2025-12-21	United States	Finance / Legal / Insurance	pending
COMPOSITION OF FIRMS: >svlawus.com Sanchez Vadillo LLP is a full-service boutique law firm established in 1999, dedicated to providing strategic and efficient legal counsel to individuals, businesses, and financial institutions. The firm specializes in various practice areas including business closings, civil litigation, corporate counsel, family law, immigration, and real estate transactions. With a team of 10 attorneys and 30 staff members, they prioritize professionalism and exceptional client solutions. Their commitment to excellence is reflected in numerous awards, including multiple Top Producer recognitions from Old Republic Title Insurance. Employees: 50 Revenue: $6.3 Million Industry: Law Firms & Legal Services Phone Number: (305) 436-1410 >eagrealtyinternational.com EAG Realty International specializes in assisting clients with buying, selling, and leasing real estate properties, including residential and commercial options in the South Florida area and internationally. The company is committed to providing a high degree of service and professionalism, ensuring a smooth and pleasurable experience for its clients. With a team of licensed real estate agents, EAG Realty offers expert guidance in property valuation and market insights. Their clientele includes individual buyers and sellers, as well as international investors seeking property opportunities. Employees: 200 Revenue: $17.7 Million Industry: Real Estate Phone Number: (305) 477-4413 >torresvadillollp.com Employees: 50 Revenue: $5 Million Industry: Law Firms & Legal Services Phone Number: (214) 295-8473 >mytitlelogic.com Employees: 50 Revenue: $5 Million Industry: Consumer Services Phone Number: (727) 823-7778 ID 24978
Ransomware	eagrealtyinternational.com id24957 View details	2025-12-19	United States	Finance / Legal / Insurance	pending
COMPOSITION OF FIRMS: >svlawus.com Sanchez Vadillo LLP is a full-service boutique law firm established in 1999, dedicated to providing strategic and efficient legal counsel to individuals, businesses, and financial institutions. The firm specializes in various practice areas including business closings, civil litigation, corporate counsel, family law, immigration, and real estate transactions. With a team of 10 attorneys and 30 staff members, they prioritize professionalism and exceptional client solutions. Their commitment to excellence is reflected in numerous awards, including multiple Top Producer recognitions from Old Republic Title Insurance. Employees: 50 Revenue: $6.3 Million Industry: Law Firms & Legal Services Phone Number: (305) 436-1410 >eagrealtyinternational.com EAG Realty International specializes in assisting clients with buying, selling, and leasing real estate properties, including residential and commercial options in the South Florida area and internationally. The company is committed to providing a high degree of service and professionalism, ensuring a smooth and pleasurable experience for its clients. With a team of licensed real estate agents, EAG Realty offers expert guidance in property valuation and market insights. Their clientele includes individual buyers and sellers, as well as international investors seeking property opportunities. Employees: 200 Revenue: $17.7 Million Industry: Real Estate Phone Number: (305) 477-4413 >torresvadillollp.com Employees: 50 Revenue: $5 Million Industry: Law Firms & Legal Services Phone Number: (214) 295-8473 >mytitlelogic.com Employees: 50 Revenue: $5 Million Industry: Consumer Services Phone Number: (727) 823-7778 ID 24957
Ransomware	glasserstv.com id24944 View details	2025-12-19	Canada	Services	pending
Glasser's TV Service Ltd is a family-owned and operated business with over 40 years of experience, serving clients in Southeastern Saskatchewan and Southwestern Manitoba. They specialize in a wide range of electronics including computers, televisions, home security systems, and gaming consoles, as well as providing expert repair services. The company is dedicated to delivering quality products and reliable service for both home and business needs. Their knowledgeable team aims to ensure customer satisfaction through friendly and efficient assistance. Employees: 10 Revenue: $5 Million Industry: Consumer Services Phone Number: (306) 435-3040 ID 24944
Ransomware	Pacific Rim Mechanical id24904 View details	2025-12-18	United States	Construction / Real Estate	pending
Pacific Rim Mechanical (PRM) is a Southern California-based mechanical contractor (HVAC, Plumbing, Energy Solutions) serving commercial, industrial, healthcare, and biotech sectors since 1987, known for high-quality construction, maintenance, and repair services, focusing on integrity, safety, and long-term client partnerships through expertise and innovation like BIM modeling. Clients: Sony, SpaceX, THERMA LCC, ASML LCC... Laek: 100GB WE HAS COLLECTED SUCH DATA AS: - Confidential documents - Clients Data - NDA - Financial data - Operations - Corporate data - Business Agreements - Development - Drawings And a lot of other VERY IMPORTANT information! ID 24904
Ransomware	deerfield.com (singulargenomics.com) id24875 View details	2025-12-18	United States	Communication / Marketing	pending
Singular Genomics https://www.singulargenomics.com/ The company, known for its next-generation sequencing technologies such as the G4® Sequencing Platform and the upcoming G4X™ Spatial Sequencer, is now focused on further innovation in genomic and spatial multiomics research. Singular Genomics Systems, Inc. is a life science technology company founded in 2016 that develops next-generation sequencing (NGS) and multiomics technologies to empower researchers and clinicians in advancing science and medicine. The company's mission centers on leveraging its proprietary Sequencing Engine platform, which underpins its core product tenets of accuracy, speed, flexibility, and scale. Its commercially available G4 Sequencing Platform is a benchtop genomic sequencer designed for fast and accurate results, while the G4X Spatial Sequencer, an upgrade to the G4 platform, enables high-throughput in situ direct sequencing of RNA, targeted transcriptomics, and proteomics profiling from formalin-fixed, paraffin-embedded (FFPE) tissues. The company is also developing the PX Integrated Solution, a multiomics platform that combines single-cell analysis, spatial analysis, genomics, and proteomics in one instrument. As of February 21, 2025, Singular Genomics was taken private following the closing of an acquisition by Deerfield Management. The company is headquartered in San Diego, California, with additional operations in La Jolla. Target CEO: Drew Spaventa https://www.linkedin.com/in/drew-spaventa-98087213/ Josh Stahl https://www.linkedin.com/in/joshua-stahl-77238627/ Target Owner: James E. Flynn https://www.linkedin.com/in/james-flynn-99304a72/ Deerfield Management Company, L.P. Singular Genomics is currently owned by Deerfield Management Company, L.P., following the completion of its acquisition on February 21, 2025. The transaction involved an affiliate of Deerfield acquiring all outstanding shares of Singular Genomics common stock not already owned by Deerfield for $20.00 per share in cash. As a result, Singular Genomics transitioned from a publicly traded company to a private entity, with the goal of providing greater strategic flexibility. The company's new leadership includes Josh Stahl as Chief Executive Officer and Drew Spaventa, the co-founder, continuing on the board as a special advisor to the CEO. The data affected by this breach includes: Source Codes Biological Data Experemental Data Client Data Personal Data (PII) Staff Data Financial Data Proposal Contracts NDA's Internal Documents Service Agreements Breach size: 20TB Breach review: Singular Genomics Systems, Inc., a U.S.-based life-science technology company developing high-throughput spatial multiomics and next-generation sequencing platforms, experienced a data breach discovered on September 11, 2025. The threat actor involved was identified as INC_RANSOM. The breach is currently under investigation, and the leak size remains unknown. The incident highlights growing concerns about cybersecurity in the genomics sector, where biological data is increasingly processed through digital pipelines vulnerable to cyber threats. https://www.breachsense.com/breaches/singular-genomics-systems-data-breach/ Research Genomes: Bacillus_cereus bcereus clost danio_rerio ecoli epr grch38 metaphlan4_databases mm10 Mycobacterium_tuberculosis phep phix phixil plasmodium_falciparum pse rhodo Rhodobacter_sphaeroides roche ruber sal spc staph synthetic_allen synthetic_allen_hp1 synthetic_allen_hp2 tb This company does not show any interest in solving its problem. She doesn't care about the security of her data and the research of her customers. ID 24875
Ransomware	CVK Hotels & Resorts_Turkey id24873 View details	2025-12-17	Türkiye	Hospitality / Food & Beverage / Tourism	pending
We would like to draw your attention to the fact that even after being notified of the leak, the management of this organization treated it with complete indifference. If you are one of this organization's customers, rest assured that they couldn't care less about your personal data and who will use it and how. ---------------- CVK Hotels & Resorts offers luxury accommodations in the heart of Istanbul, providing guests with a blend of traditional Turkish hospitality and modern comfort. The company operates several hotels, including the CVK Park Bosphorus Hotel, CVK Park Bosphorus Residences, and CVK Taksim Hotel, catering to both leisure and business travelers. Their services include fine dining, spa and fitness facilities, and event spaces, ensuring a comprehensive experience for their clients. With a focus on creating memorable stays, CVK Hotels & Resorts also features a rewards program for guests to earn benefits during their visits. ID 24873
Ransomware	https://avenira.com/ id24845 View details	2025-12-16	Australia	Other	pending
1tb data and nda data ID 24845
Ransomware	Precise Benefits Group LLC id24803 View details	2025-12-16	United States	Communication / Marketing	leaked
Precise Benefits Group LLC operates as an employee benefits consulting and HR solutions provider. The company offers strategic employee benefits programs and services designed to help businesses manage healthcare costs, ensure regulatory compliance, and improve administrative efficiency. ID 24803
Ransomware	cityofsignalhill.org id24775 View details	2025-12-15	United States	Public Sector	pending
Signal Hill, CA offers a range of services and resources to its residents, including city hall renovation updates, a shop local campaign called Open Rewards, and information on upcoming city events. The city also provides resources for job seekers, safe clean water initiatives, and community assistance programs. Residents can access the city's cable channel online, nominate pets for Pet of the Month, and download the Signal Hill Now mobile app for convenient access to city information. Employees: 50 Revenue: $7.1 Million Industry: Government Phone Number: (562) 989-7300 ID 24775
Ransomware	steelworksinc.ca id24774 View details	2025-12-15	Canada	Manufacturing / Engineering	pending
Steel Works Inc. specializes in structural steel fabrication and installation, providing precision-cut and custom-built steel components for industrial and commercial projects. They offer a range of services including overhead crane design and installation, specialized fabrication, and blast and paint services. Their intended clients include startups, product designers, mid-sized manufacturers, and industrial facilities, particularly in the mining sector. With over 30 years of experience, Steel Works Inc. is known for its commitment to quality, safety, and on-time delivery. Employees: 50 Revenue: $8.1 Million Industry: Commercial & Residential Construction Phone Number: (705) 264-4031 ID 24774

Incransom

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (7)

Top Activity Sectors (18)