Stormous

www.higuchi-inc.co.jp/newsrelease/company/doc/unauthorized_access_incident.pdf // We have reviewed the report issued by HIGUCHI INC. To correct their mistake: the breach did not affect just one branch, but rather 3 different branches across various regions.Your data has not been leaked yet, as you are currently within an 8-day grace period. Before we publish any of your commercial or personal data, be aware that we possess 102 GB of Sage software backups, alongside numerous commercial documents.We await your reply to our messages. Follow the correct path to ensure nothing is leaked. We are waiting for you. ID 30163

Over +10GB GB of data has been accessed and exfiltrated. This includes product designs, historical fashion lines, and technical specifications for garments. Furthermore, we have obtained customer databases from various parts of the world, financial records, commercial contracts, employee data, personal files for all staff members within the network, daily operational documents, and more. ID 30070

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30071

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30072

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30073

(Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the ⁠.ptb⁠ file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations. ID 30074

(Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the ⁠.ptb⁠ file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations. ID 30075

Deep access to Microsoft Dynamics GP containing complete corporate accounting, invoices, vendor details, and commercial transactions.Access to internal legal documents, partnership agreements, and customer contracts (such as CBIF OSMO agreements).Exfiltration of operational spreadsheets, financial reports, and executive documents via corporate ID 30076

We have breached ESHA Research / ESHA Cloud Services and compromised their core product development databases. The exfiltrated data includes highly confidential industry secrets and formulation data Complete intellectual property containing secret product designs, manufacturing blueprints, and recipes (⁠SupplementFormula⁠, ⁠PureFood⁠, ⁠FoodGroup⁠).Deep laboratory data, nutritional testing breakdowns, and allergen classification records (⁠SupplementIngredient⁠, ⁠Analysis⁠, ⁠AllergenGroup⁠, Sensitive registries containing client profiles, user metrics, and market consumer data (⁠Consumer⁠, ⁠Activity⁠). ID 30077

Data description: Pending update ID 30078

During our routine network security audits, our team discovered critical structural vulnerabilities within Palatine School, which granted us full, unrestricted access to their central server (PALDC2020). We had the technical capacity to access every directory, including pupil databases (⁠ StudentData NHS NO ) ⁠, ⁠Pupil Admin - Users -FocusIT⁠) and staff records ⁠Personnel⁠.We want to announce that we have locked down this operation and decided to leak absolutely nothing.This is an institution dedicated to children and special needs education. Unlike corporate thieves or ruthless threat actors, we operate with a strict code of ethics: we do not target children, schools, or healthcare facilities.Instead of destroying them, we have chosen to act as an uninvited security audit. We are using our platform to publicly invite the administration of Palatine School to contact us privately. We will provide them with the full technical details of the critical vulnerabilities we discovered and guide them on how to patch their system for free, ensuring they are protected from other ruthless cyber criminals. ID 30079

FULL DATA DUMP . The compromised data includes highly sensitive internal operations and financial records. Among the leaked files are complete individual Campaign Profit and Loss (PnL) statements, detailed revenue sheets, clawbacks, and general ledger accounts for several linked entities, including Salesworks Pte Ltd Taiwan Branch and Shaves2u HK Limited. Additionally, we have extracted complete directory trees and file structures from the internal network shares and remote desktop sessions, revealing thousands of corporate folders such as JAG Group, SWGP Excel Import, and various financial databases. ID 30008

Full database containing corporate emails (⁠@jaggroup.com⁠), Active Directory domain logins, and clear plain-text passwords.Complete Microsoft Dynamics GP databases, software license keys, financial reports, and system configuration Multiple compressed archives (⁠zBackups.zip⁠, ⁠wetransfer⁠ packages), SQL server connection data, and ⁠IM.mdb⁠ database files.Internal project management sheets (⁠Jag Project.xlsx⁠), user listings, purchasing, and sales import logs. ID 30009

Over 400 GB of data has been accessed and exfiltrated. This includes product designs, historical fashion lines, and technical specifications for garments. Furthermore, we have obtained customer databases from various parts of the world, financial records, commercial contracts, employee data, personal files for all staff members within the network, daily operational documents, and more. ID 30010

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30011

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30012

Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ ID 30013

Full database containing corporate emails (⁠@jaggroup.com⁠), Active Directory domain logins, and clear plain-text passwords.Complete Microsoft Dynamics GP databases, software license keys, financial reports, and system configuration Multiple compressed archives (⁠zBackups.zip⁠, ⁠wetransfer⁠ packages), SQL server connection data, and ⁠IM.mdb⁠ database files.Internal project management sheets (⁠Jag Project.xlsx⁠), user listings, purchasing, and sales import logs. ID 30074

FULL DATA DUMP . The compromised data includes highly sensitive internal operations and financial records. Among the leaked files are complete individual Campaign Profit and Loss (PnL) statements, detailed revenue sheets, clawbacks, and general ledger accounts for several linked entities, including Salesworks Pte Ltd Taiwan Branch and Shaves2u HK Limited. Additionally, we have extracted complete directory trees and file structures from the internal network shares and remote desktop sessions, revealing thousands of corporate folders such as JAG Group, SWGP Excel Import, and various financial databases. ID 29999

We have successfully breached the internal servers and network infrastructure of MLIT, gaining full unauthorized access to their active Microsoft Dynamics Management Reporter environment and local storage volumes.The compromised data includes highly sensitive internal operations and financial records. Among the leaked files are complete individual Campaign Profit and Loss (PnL) statements, detailed revenue sheets, clawbacks, and general ledger accounts for several linked entities, including Salesworks Pte Ltd Taiwan Branch and Shaves2u HK Limited. Additionally, we have extracted complete directory trees and file structures from the internal network shares and remote desktop sessions, revealing thousands of corporate folders such as JAG Group, SWGP Excel Import, and various financial databases. ID 29835

katholiekamersfoort.nl is the online presence of Katholiek Amersfoort, a Roman Catholic parish in Amersfoort, Netherlands, serving faith communities through catechesis, worship, meetings, and pastoral support. The site publishes parish information, contact details, financial notices, and service schedules for locations including the Centraal Secretariaat in Hoogland. Its content reflects an NGO and association profile centered on religious community life and local parish administration. The domain was listed as a ransomware victim associated with stormous. ID 29700

sa2000.com UPDATE-FULL DATA DUMP refers to a ransomware listing involving SA2000.COM, an IT-sector organization operating in the United States and referenced by reporting as a Canadian target. Public writeups describe the entity as a technology-related company and note that the listing centers on a claimed data-dump incident rather than a confirmed public breach notice. The entry indicates the site was published as part of stormous activity and presented in the context of ransomware pressure. It was listed as a ransomware victim associated with stormous. ID 29701

150 GB of data has been extracted, including: COMPTABILITÉ - FACTURES ACHAT / FACTURES À PAYER / FACTURES MODIFIÉES - Banking Informations SA2000 - PAIEMENTS CLIENTS - CLIENTS / PO CLIENTS - FOURNISSEUR / TRANSPORTEURS - EMPLOYÉS / EMBAUCHE - ACTIONNAIRES - COURRIEL / DOCUMENTS ***.There is still an opportunity to communicate and resolve this situation. We are currently awaiting the company's ! ID 29597

The church website's network (katholiekamersfoort.nl/) has been breached, resulting in the exfiltration of over 10 GB of data. This data pertains to donors, staff, and the personal information of a large number of individuals. The compromised data includes: Databases and Personally Identifiable Information (PII), internal network shares and document, contact lists, board and committee data, as well as system metadata. ID 29573

VSP Security Wholesale is an Australian-owned and independently operated distributor specializing in video security products, established in 1993. The company operates across multiple states including NSW, QLD, VIC, WA, and SA, serving as a trusted supplier of video security product solutions. It partners with world-leading security and IT brands to deliver comprehensive video security offerings. The business was listed as a ransomware victim associated with the threat actor stormous. This listing reflects the company's exposure to cyber threats in the security sector. ID 29332

$900k to Solve the Problem 5TB — While TTT Company was preoccupied with designing luxurious interiors and architectural masterpieces, they completely overlooked the design of a secure network. We have spent enough time within their internal infrastructure to conclude that their security is incredibly fragile. We have successfully exfiltrated all of the company's data and now possess 5 TB of the most sensitive information, including complete blueprints and CAD designs for prestigious clients (Toyota showrooms, gyms, luxury resorts, and government projects). We have accessed every employee's personal drive, including IDs, passports, and private medical records. Furthermore, we hold confidential contracts, tax reports (BCTC), internal financial audits, and detailed security schematics for client buildings. ID 29138

+40G Full Financial Backups (Quickbooks & Reckon)-Email Archives & Staff Personal Folders-Customer/Client Databases (Installers & Integrators nationwide)-Shipment & Order Tracking for major brands like Hikvision & Axis. ID 29139

FANASA.COM refers to FANASA, a Mexican company based in Nuevo León that operates in high-requirement metal stamping for automotive, appliance, and other industrial segments. Public company profiles also place its operations in Monterrey and describe exports to the United States and Brazil. The company presents itself as established in 1971 and focused on product quality and service for industrial customers. It was listed as a ransomware victim associated with stormous. ID 29071

We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets. ID 29072

The extracted data comprises administrative and financial records, payroll sheets, and client and partner directories, alongside technical and engineering specifications, employee records, and business plans. It also includes architectural designs, official contracts, detailed engineering reports, and construction site maps, as well as risk assessments, internal correspondence, and tax and legal information. ID 29001

$900k to Solve the Problem 5TB — While TTT Company was preoccupied with designing luxurious interiors and architectural masterpieces, they completely overlooked the design of a secure network. We have spent enough time within their internal infrastructure to conclude that their security is incredibly fragile. We have successfully exfiltrated all of the company's data and now possess 5 TB of the most sensitive information, including complete blueprints and CAD designs for prestigious clients (Toyota showrooms, gyms, luxury resorts, and government projects). We have accessed every employee's personal drive, including IDs, passports, and private medical records. Furthermore, we hold confidential contracts, tax reports (BCTC), internal financial audits, and detailed security schematics for client buildings. ID 28826

Financial & Sales Intelligence ، Sales Statistics by Quarter (Q1, Q2, Q3, Q4)، Corporate & Strategic Planning ، SQL ، Project Reports ID 28788

Personally Identifiable Information (PII), ​Electronic Fiscal Documents (CFDI/XML), ​Financial Transaction Records, ​Commercial Invoices & Billing Data, ​Taxpayer Identification Numbers (RFC), ​Client & Vendor Database/​Internal Corporate Documentation ID 28789

endor & Corporate Data ( Name-Email-Numbers/PMS NAME ), Financial Accounting Records , sales Order Reports , Database Systems , SQL Server , Sage 200 Evolutuion SQL, operational Security Data، Full Sage 200 Evolution backups including all transaction history, tax records, and payroll.CRM & Legal Archives Over 151,000 sensitive documents, contracts, and internal communications from the CRM database.Full access to GS1 South Africa SharePoint, including GDSN protocols and partnership data with global entities like Unilever, Nestle, and L'Oreal.Complete PII (Personally Identifiable Information) of administrative staff and executive members, including private emails and mobile numbers. ID 28790

The triumph of the Cuban Revolution, government cultural functions were performed by the Department of Culture, Ministry of Education. In 1961 the National Council for Culture was founded. ID 28777

Ministry of Energy and Mines. Ministry created on December 3, 2012 as an agreement of a meeting of the Council of Ministers of the Republic of Cuba. ID 28778

PT Kereta Api Indonesia is the national railway company in Indonesia, also known as Kereta Api. It is responsible for operating train services throughout the country. ID 28779

Our activities cover the regulatory, technical, medical, marketing, building and administrative management aspects of companies dedicated to the manufacturing and/or marketing of pharmaceutical, cosmetic, dental, biomedical, mass consumption, household health products. ID 28780

Cal-Comp is the largest Electronics Manufacturing Services (EMS) Company in Thailand and Southeast Asia, providing manufacturing services in OEM and ODM across a variety of products for clients that are mostly exported worldwide ID 28781

web.fractal.id/ ID 28782

transak.com/ ID 28783

uatf.edu.bo/ ID 28784

biodimed.com/ ID 28785

Client Data - Medical Reports - Financial Status (Bank reports, taxes, and more) - Annual Accounts - Personal Information - New Projects - Large amounts of patient-related data - Business plans and much more - a total of 700 GB of critical information! ID 28786

Vouch does not protect its customers' data at all and stores it poorly. Many users' data, including KYC information, UK ID cards, email addresses, phone numbers, full names, and more, have been extracted. Approximately 3GB of data was collected. ID 28787

Vouch does not protect its customers' data at all and stores it poorly. Many users' data, including KYC information, UK ID cards, email addresses, phone numbers, full names, and more, have been extracted. Approximately 3GB of data was collected. ID 28788

Details of bank card data for over 50,000 Moroccan individuals from 5 different Moroccan banks for sale: Cardholder's name / Card number / Expiry date / Security code... ** For more details, you can contact support to receive full information. ID 28789

A forum created by the operators of Stormous and many of their affiliates, including members from Lapsus$, GhostSec, RedRaas, and others. This forum offers the latest phishing techniques and social engineering methods used in cutting-edge hacking strategies. ID 28790

Plaintext authentication credentials (usernames/passwords)-(full names, dates of birth, gender)-(addresses, phone numbers, emails)-Employment history and professional skills-CNI-RIB - CDD, CDI, temporary missions - Tax documents - Social security attestations - Training certificates - Work authorization documents and more.... ID 28791

VPN access to the company's internal network is provided. ID 28792

Vision Inks and Resins Limited (previously known as Vision Inks & Resins) is established in May 1999 with Factory at MIDC, Murbad, Maharashtra INDIA... ID 28793

Sincroslab Sas is a company in Colombia, with a head office in Bogota D.C.. It operates in the Miscellaneous Nondurable Goods Merchant Wholesalers industry. ID 28794

Nova Ransomware-DevMan Ransomware-CoinBaseCartel-RADAR Ransomware-Desolator Ransomware-Kryptos Ransomware ID 28795

Customer names, identification numbers, production orders, client records, delivery tracking data, customer information, logos, and more ID 28796

Data of 1,000 registered distributors and sellers employee and customer information - admin login passwords - email addresses, phone numbers, full names - and more... ID 28797

CVs - Bank - VCF - Business accounts - image - SCAN - Passport Details - ID Card -...... ID 28798

CVs - FACTURES - Hwawei.com - AA GROUPE 2025 - RESERVATION 2025 - PERSONNELS - INFOS - STAGIAIRES..... ID 28799

Hy-Vee refuses to pay, and we are proceeding to leak all the data that was extracted. Internal documents, infrastructure diagrams, employee data, training materials.... ID 28800

Full names of hotel guests, Email addresses (internal and external), Customer complaints and feedback content, Booking or reference numbers, Internal hotel communication data... ID 28801

Full reservation databases Booking platform references (including HeyTripGo) Payment Data PDF files containing credit card numbers, expiration dates and CVV codes Scans of physical card images used in transactions Names and billing addresses linked to card... ID 28802

Full customer reservation databases (names, phones, emails, addresses, booking dates) Scanned ID documents (passports, national IDs) Internal emails via OWA Employee and customer email lists RDP credential files ID 28803

Full customer reservation databases (names, phones, emails, addresses, booking dates) Scanned ID documents (passports, national IDs) Internal emails via OWA Employee and customer email lists RDP credential files ID 28804

Full customer reservation databases (names, phones, emails, addresses, booking dates) Scanned ID documents (passports, national IDs) Internal emails via OWA Employee and customer email lists RDP credential files ID 28805

Internal Data - System Data - 73 Partner Data - Customer Data (Email, Name, Phone Number) - Admin Data and Their Roles, etc.... ID 28806

This includes important legal documents such as drafts of non-disclosure agreements (NDA) pertaining to the company and strategic partners like Bosch, detailed financial documents containing analyses of Acuity's financial position ID 28807

VPN access to the company's internal network is provided ID 28808

All of this data is offered for sale (user information: email, phone number, full name, date of birth / payment and booking data / ID cards and passports used in booking processes / full access was obtained to the system and all data was extracted). ID 28809

(Folders/Files) Email/Communication/System/Application Data AYEAPLICACIONES database/Log Data BDATOSFITCLOD, Software/Installation/Program Files AUTOBOU, Personal/Miscellaneous Files AvenaCubana ID 28810

We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets. ID 28326

Administrative/System Files/ADMIN, DOAS,General operational, administrative records, and potential system configuration files /Proprietary Engineering Drawings/IP/Highly specific technical documents, schematics, and design files (Intellectual Property). The (MklUp) indicates marked-up or working drafts.Product Line/System Data /RoofTop Systems Folder, Goodman Models, Goodman 12.5 /Confidential information related to specific product lines,Systematically numbered Bitmap image files (BMP), which function as internal references for parts, components, or quality checks/Goodman LC ID 24612

Project Planning & Execution Documents - AKTUALIS KIVITELI TERVEK (Folder)/ Confidential Contract/Scope/Munkaterelhatarolas Proprietary Technical Specifications Melyepites Safety/Compliance/Standards S&C and more ..... ID 24611

(Folders/Files) Email/Communication/System/Application Data AYEAPLICACIONES database/Log Data BDATOSFITCLOD ( Software/Installation/Program Files AUTOBΟΥ Personal/Miscellaneous Files AvenaCubana ) ID 24610

All of this data is offered for sale (user information: email, phone number, full name, date of birth / payment and booking data / ID cards and passports used in booking processes / full access was obtained to the system and all data was extracted). ID 24609

VPN access to the company’s internal network is provided ID 23734

VPN access to the company’s internal network is provided ID 23668

VPN access to the company’s internal network is provided ID 23667

Marjane Group is a Moroccan retail group that owns the Marjane hypermarkets and Marjane Market supermarkets. Founded in 1990, Marjane has gradually become the largest retail company in Morocco ID 23666

Stealer-type breach Valid credentials, sensitive access ID 23416

CarNet system breach Internal data accessed ID 23415

Personal data (individual names, photos, etc.), company/business data (company names, services, tools, equipment), backup copies, system archive compressed files, internal documents and project files, and more. ID 23414

Sincroslab Sas is a company in Colombia, with a head office in Bogota D.C.. It operates in the Miscellaneous Nondurable Goods Merchant Wholesalers industry. ID 23413

Vision Inks and Resins Limited ( previously known as Vision Inks & Resins ) is established in May 1999 with Factory at MIDC, Murbad, Maharashtra INDIA having ... ID 23412

VPN access to the company’s internal network is provided. ID 23411

Plaintext authentication credentials (usernames/passwords)-(full names, dates of birth, gender)-(addresses, phone numbers, emails)-Employment history and professional skills-CNI-RIB - Relevé d'Identité Bancair - CDD, CDI, temporary missions - spanning multiple years - Tax documents (Avis d'imposition) - Social security attestations - Training certificates - Work authorization documents and more .... ID 23410

Health information for 600,000 patients has been accessed from the North Country Health (NCH) care ID 21123

Access to Hy-Vee’s environment was obtained through compromised Atlassian accounts, including tools such as Confluence and Jira. Internal documents, infrastructure diagrams, employee data, training materials, and technical information related to several operational systems were extracted. These include: ID 20785

Customer names, identification numbers, production orders, client records, delivery tracking data, customer information, logos, and more ID 20671

Stealer-type breach — enjoy! ID 20631

Stealer-type breach — enjoy! ID 20602

Data of over +40,000 individuals has been accessed. The data includes email addresses, passwords, dates, login URLs, names, and regions ID 20548

Data of 1,000 registered distributors and sellers – employee and customer information – admin login passwords – email addresses, phone numbers, full names – and more... ID 20509

identity.vwgroup.io is a Volkswagen Group identity service used for sign-in and access to the company’s digital services, including the Volkswagen ID portal and related privacy and legal pages. It is part of Volkswagen Group’s online ecosystem, and the group’s communications functions cover corporate image, marketing, advertising, and sponsoring across its brands. Volkswagen Group is headquartered in Germany and operates internationally through brand and service portals tied to its digital customer and business offerings. The entity was listed as a ransomware victim associated with stormous. ID 20367

User account data (partially hidden emails) Authentication tokens (OAuth tokens, JWT tokens) Login links for internal systems (e.g., https://identity.vwgroup.io) Session cookies (JSESSIONID and others) identity and access information (scopes such as email, profile, vin, phone, etc.) Authentication and access control details (redirect_uri, state, nonce) ID 20370

We present a comprehensive leak including full email addresses and password hashes from multiple high-profile French government organizations: Carsat, Finance, Retraite, and IGAS -AAF - AFT - ac-lyoun.fr - cnaf.fr - cnsa.fr....... ID 20202

A large amount of valid banking card data from various sources – customer information from ID cards, passports, and driver's licenses – email addresses, phone numbers, full names – and selfie photos. ID 20163

? ID 20162

IPT – customer data – 2025 bookings – identity cards and more. ID 20161

Full names of hotel guests a Email addresses (internal and external) Customer complaints and feedback content Booking or reference numbers Internal hotel communication data ...... ID 20160

Full names of hotel guests a Email addresses (internal and external) Customer complaints and feedback content Booking or reference numbers Internal hotel communication data ...... ID 20159

? ID 20158