UNITE HERE!
incransomThis record tracks a ransomware attack claimed by the incransom group against UNITE HERE!. It collects the publicly disclosed attack details — sector, location and timeline — as published on the operator's leak site and indexed by Breach House.
Window Zero
EXPOSURE GAPWindow Zero is the time the breach stayed in the open before anyone said so — the gap between when the attack was first discovered on the operator's leak site (t1) and when it was publicly disclosed (t2). The wider this window, the longer victims, staff and customers were exposed with no warning.
Attack Summary
UNITE HERE is a labor union in the United States and Canada with roughly 300,000 active members. The union's members work predominantly in the hotel, food service, laundry, warehouse, and casino gaming industries. The union was formed in 2004 by the merger of Union of Needletrades, Industrial, and Textile Employees (UNITE) and Hotel Employees and Restaurant Employees Union (HERE). In 2005, UNITE HERE withdrew from the AFLCIO and joined the Change to Win Federation, along with several other unions, including the Teamsters, Service Employees International Union (SEIU) and the UFCW. In May 2009, union president Bruce Raynor (originally from UNITE) left UNITE HERE, taking with him numerous local unions and between 105,000 and 150,000 members, mostly garment workers and a labor-owned bank, Amalgamated Bank. They formed a new SEIU affiliate called Workers United. On September 17, 2009, UNITE HERE announced that it would re-affiliate with the AFLCIO.
Leak Screenshots
SAMPLEProof-of-breach screenshots the operator posted from the stolen data. Previews are redacted and locked — the originals are available on HaveIBeenRansom.