Full List

Search

Recent Breaches

• Costa Solutions, LLC April 29, 2026 • [ ransomware, financial, technology ] Costa Solutions, LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United States of America. Website: costasolutions.com. [warehouse] Costa Solutions, LLC a privately held managed-labor and warehousing company headquartered in San Antonio, Texas, with ~$140M annual revenue and 2001,000 employees. The file server contained the complete operational, financial, legal, and human resources infrastructure of the company: 3,0008,000+ individuals' personal data current employees, former employees (12 years of records), independent contractors, employee dependents, and job applicants. SSNs on W-2s, W-4s, 1099s, I-9s, background checks. Bank account and routing numbers on 200+ direct deposit forms. Medical and injury records 150+ employee injury/medical files from 20132026, FMLA medical certifications, drug test results (random, reasonable suspicion, post-incident, promotional), and workers' compensation claims for 23+ named individuals. CEO's entire file system Josh Wean's Documents folder (5.3 GB) including P&L statements, a 17-subfolder "Confidential" directory, legal correspondence, strategic plans, a C-12 peer advisory group archive, and a $RECYCLE.BIN with 60+ deleted items. Client contracts and competitive intelligence pricing, SLAs, and contract terms for HEB, CVS, Sysco, Amazon, McLane, Labatt, Valvoline. Competitor pricing intelligence. RFP bid documents with cost models. Active legal case files litigation records (20212022), HR internal investigation notes (20182021), arbitration files, active investigations marked "DO NOT DELETE" all subject to attorney-client privilege. Infrastructure secrets an HEB production server TLS certificate, a Cisco AnyConnect VPN installer, and the CEO's Remote Desktop connection file. Corporate financials multi-year budgets, valuation & sale documents (indicating possible M&A activity), PPP loan forgiveness records, Form 5500 ERISA filings, and annual reporting.
• Atlas Metal Industries Inc April 29, 2026 • [ ransomware, leak, manufacturing ] Atlas Metal Industries Inc was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: Canada. Website: atlasfoodserv.com. [food, metal] Atlas Metal Industries Inc. a privately held commercial-foodservice-equipment manufacturer headquartered in Miami, Florida. The dataset is a complete Microsoft Dynamics GP environment: production databases, payroll records, system credentials, Autodesk Vault product-design backups, CNC fabrication programs, and all supporting infrastructure configuration. The exfiltration occurred on or about April 8, 2026; the attack was identified April 22, 2026. The exposed material includes: 15.8 GB of payroll-records database (PYREC) full Employee Master with SSNs, DOBs, addresses, direct-deposit bank routing numbers, salary, W-4 tax data, garnishments, and check history dating to at least 2018. 30+ SQL Server login accounts with password hashes in a sp_help_revlogin dump named employees, system admins (DYNSA, sa), service accounts, and Active Directory domain accounts. 74 GB of Autodesk Vault Professional backup complete product-design history from 2019 through 2026, covering every product line Atlas Metal manufactures. Hundreds of CNC fabrication programs laser-cutter and Amada punch-press G-code for the full catalogue of sheet-metal components. A base64-encoded SQL credential for the TimeClock Plus timekeeping system, stored in plaintext XML. 8 SQL Server databases with full backup chains ATLAS (primary), PYREC (payroll), DYNAMICS (system), TEST (18 GB dev clone), TWO, AMIT, plus system databases (master, msdb, DynamicsGPSecurity).
• Law Offices of Michael A. Freedman, P.A. (maflaw.com) April 23, 2026 Law Offices of Michael A. Freedman, P.A. (maflaw.com) was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Professional Services. Country: United States of America. Website: maflaw.com. [law] Law Offices of Michael A. Freedman, P.A. (maflaw.com). The exfiltrated corpus is 579 GB used / 143 GB at root level / 196,701 files / 19,231 directories, dated as recently as a year-2026-in-progress client matter. What this means for a plaintiffs' PI firm of ~25 staff: 656 client-matter folders organised across eight yearly parents from June 2019 through 2026-in-progress. Per-client medical records, HIPAA authorisations, police reports, settlement releases, IOLTA distribution sheets, retainer agreements, and treating-provider correspondence. Two staff Outlook archives at 2.1 GB each, plus a 505 MB Outlook backup, plus 27 enumerated .pst files years of attorneyclient privileged correspondence, settlement strategy, opposing-counsel comms. The complete Sage ACT. Pro v18 contact universe the live database plus eight historical ZIP backups going back to 2013 plus a 9.3 MB plaintext export (ACT!-Contacts.txt) that any text editor can open. Estimated 5,00012,000 contacts. The firm's master credential vault in a Word document called Woodywoody78!.docx (the filename is itself the vault password). Plaintext credentials for M&T Bank multi-identity business + commercial accounts (with electronic-payment-approval authority), Bank of America, Paychex, QuickBooks, and the firm's federal EIN. Plus the senior partner's phone-unlock PIN. A staff browser-exported password CSV (32 plaintext credentials) including the M365 tenant, the Slack tenant, hospital portals (MedStar, GBMC, Allstate secure mail), MoveDocs, ChartRequest, MSHC Legal portal plus residual credentials from prior employers SLF Law and Bailey Law, creating cross-firm contamination liability. The Universal Licensing / Freedman Consulting invention-promotion operation a second line of business under the same EIN, with hundreds of inventor folders. Per-inventor unpublished invention disclosures, Internet Presentation of Invention decks, NDAs, Exclusive Patent License Agreement drafts, patent-art renderings, and per-managed-mailbox client-company passwords. A criminal-defense sub-practice (SLF criminal out of Janice's working folder) with retainer agreements and per-client court documents, carrying 6th-Amendment-attorneyclient uplift on the privileged-track scoring. An Axon evidence.com MPIA-released body-worn-camera package (449 MB total; a 448 MB clip from the 2020-12-20 Park Baltimore incident).
• Cheval Blanc Randheli April 22, 2026 Cheval Blanc Randheli was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-22. Sector: Hospitality. Country: Maldives. Website: chevalblanc.com. [lvmh] Guest Passport Scans 75,855 Files, 10 Years The single largest data category: 75,855 passport scan images spanning January 2015 through October 2024, organised in daily folders within monthly and yearly directories. These represent an estimated 20,00030,000 unique guests. Each scan contains the full passport bio page: photo, full name, date of birth, nationality, passport number, machine-readable zone (MRZ), and signature. Among the exposed passports: Qatar Royal Family members 9 passport scans including Muhammad Mesned S M Al-Misned, Abdulla, Khalifa, Lolwa, Nasser, Alanoud, Bessy, and Mesned UAE VIP and government officials including H.E. Ahmed Saif Ali Aldhabea Aldarmaki, H.E. Matar Suhail Ali Alyabhouni Aldhaheri, and members of an April 2024 private buyout group who arrived on private jets (tail numbers A6AUH, A6DAH) LVMH head-office executives 7 passport/profile photos including named senior staff from Paris Guest PMS Data 30,00050,000 Profiles Opera PMS exports containing full names, home addresses (street-level), nationalities, VIP classification levels (A/B/C/G), partial credit card data (last-4 digits + expiry + card type), deposit amounts, booking confirmation numbers, stay histories, travel agent details, flight numbers, and guest preferences. Employee Records 1,0002,000 Individuals Ten years of salary records (20172026), medical insurance claims organised by department, ~200 ECARD ID photos, vacation/leave records, Key Management Personnel (KMP) compensation details, and biometric enrollment data from the Gladis facility-access system. Credentials and Infrastructure BitLocker recovery key full disk-encryption key for the Windows server volume Passwords.docx plaintext system password store covering revenue, PMS, and operational systems Extranet passwords booking-portal and vendor credentials 3CX VoIP backup SIP credentials, extension configurations, call routing rules Biometric templates (Gladis enrollment) non-rotateable fingerprint/facial data Corporate-Sensitive Documents Management Contract of Cheval Blanc Randheli the LVMHproperty owner agreement containing fee structures, performance benchmarks, and brand license terms Board investment recommendation for Velidhoo a potential new property with capital allocation and return projections 10 years of budgets and revenue forecasts Audited subsidiary financial statements (I&T / Sitax entities) White Book the property's operational standards manual (proprietary LVMH brand IP) Building Management System data HVAC, power, desalination, and lighting control files for island infrastructure
• Baresque Group April 22, 2026 Baresque Group was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-22. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: baresquegroup.com. [design] Baresque Group a respected commercial-interiors company headquartered in Perth, Australia, with offices in Dallas, Chicago, and Brussels. The exposed material includes: 100+ passport scans, 35 birth certificates, 60+ driver's licences, 50+ TFN declarations the complete identity-theft toolkit for the entire workforce, spanning Australia, the US, and Europe. Plaintext credentials for every critical system Microsoft 365, HR platform (Elmo Talent), remote-access gateway (LogMeIn), phone system (3CX), ERP (Jim2) all in browser-export CSVs and an enterprise-wide Password_Listing.xls that had been sitting on a shared drive since at least 2017. 4 TLS private keys for customer-facing domains enabling impersonation of the company's websites. 343 GB of product R&D SolidWorks CAD files, manufacturing specifications, and product blueprints for Zintra acoustic panels, FUNC furniture, botton+gardiner wallcoverings, and Scribblr surfaces. The complete design library. Two years of board packs, financial reports, and cash-flow models the company's entire strategic and financial position laid bare. Privileged legal documents active subpoena files, sworn affidavit exhibits, Fair Work Australia tribunal filings, and settlement agreements with confidentiality clauses. Workers compensation medical records naming specific employees with diagnoses, treatment plans, and claim amounts.
• Advanta Genetics LLC April 17, 2026 • [ ransomware, healthcare, finance ] Advanta Genetics LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Healthcare. Country: United States of America. Website: aalabs.com. [health] Advanta Genetics LLC a respected CLIA/CAP-accredited clinical toxicology and molecular diagnostics laborator. The exposed material includes: Tens of thousands of real patient lives including highly sensitive chronic opioid therapy charts flagged by the Texas Medical Board and elderly Medicare audit records. Provider identities and prescribing power SSNs, DEA numbers, and state licenses from 20+ states that can be turned into black-market "script pads". Gold-standard identity theft kits W-2s, I-9s with passport scans, and full employee packages for 50+ staff. 102 complete QuickBooks company files exposing every vendor, payroll run, bank link, and financial secret across the Advanta/RedLeaf/OSPRI empire. High-value trade secrets OSPRI Biopath investment decks, valuation models, FDA pre-submission packets, and the proprietary "The Brain" AI diagnostic architecture. Explosive privileged attorney-client memos on active regulatory battles (Texas Medical Board Remedial Plan #19-153 and a federal NORA subpoena). Active Directory domain controller data (NTDS.dit and SAM hives).
• zsiclife.co.zm April 26, 2026 • [ ransomware, healthcare, finance ] zsiclife.co.zm was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-04-26. Sector: Healthcare. Country: Zambia. Website: zsiclife.co.zm. ZSIC Life Plc is a leading assurance, savings, and wealth management company in Zambia, offering a diverse range of life...
• PROM (Peakside Ros Outlet Management) April 29, 2026 • [ ransomware, leak, retail ] PROM (Peakside Ros Outlet Management) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. PROM (Peakside Ros Outlet Management) is a joint venture established by the investment firm Peakside Capital and the operator Ros Retail to manage outlet centers across Europe. The organization specializes in the strategic development of retail real estate, handling the full lifecycle from brand acquisition to operational marketing. Its primary objective is to maximize asset value and performance by implementing international management standards within the outlet sector.
• Antica Sartoria April 29, 2026 • [ ransomware, retail ] Antica Sartoria was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: Italy. Website: www.anticasartoriapositano.it.
• Edenshaw Developments April 29, 2026 • [ ransomware, leak ] Edenshaw Developments was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.edenshaw.com.
• Metro-ILA Funds April 29, 2026 • [ ransomware, financial ] Metro-ILA Funds was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Financial Services. Country: Germany. Website: www.metro-ila.com.
• Probity Contracting Group April 29, 2026 • [ ransomware, manufacturing ] Probity Contracting Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: Australia. Website: www.probitycg.com.
• Eduporium April 29, 2026 Eduporium was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Education. Country: United States of America. Website: www.eduporium.com.
• Bentley Capital Ventures April 29, 2026 Bentley Capital Ventures was listed as a victim on the leak site of the radar ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Financial Services. Country: United States of America. Website: bentleycapitalventures.com. https://www.linkedin.com/company/bentley-capital-ventures We started Bentley Capital Ventures in 2012 to facilitate small business owners across the country in the process of obtaining capital. We know a simple trip to the local bank doesnt always provide the results many are looking for and as business owners ourselves we know how challenging it can be to obtain capital when you dont fit within the guidelines of the traditional banking world. At Bentley Capital we use the relationships we have built over the last 25 years in both the consumer and commercial banking markets to provide our clients with the very best options available for their specific situation. Whether you have perfect or less than perfect credit our goal will always be to provide you with options that promote growth and properity for your business.
• Karl Chevrolet April 3, 2026 Karl Chevrolet was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-04-03. Sector: Retail & E-Commerce. Country: United States of America. Website: www.karlchevrolet.com. Karl Chevrolet, Inc. operates a Chevrolet car dealership. It offers new and used cars, commercial vehicles, SUVs, trucks, and vans. The company also provides automotive parts and accessories, such as brake pads, oil filters, and others; and services, which include vehicle maintenance, repair, inspection, and other services. It also allows customers to order parts online.
• Iowa Spring Manufacturing & Sales April 29, 2026 • [ ransomware, leak, manufacturing ] Iowa Spring Manufacturing & Sales was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: United States of America. Website: iowaspring.com. Iowa Spring is a well-established manufacturer specializing in a variety of springs, including those for overhead garage doors, mechanical applications, and agricultural equipment. Founded in 1977 and based in Adel, Iowa, the company has built a strong reputation for quality and reliability in the spring manufacturing industry. 2112 Greene Street P.O. Box 130 Adel, IA 50003, US www.iowaspring.com Leaked data: 49,4Gb Accounting, product development and testing, laboratory defect analysis, supply logistics, contracts, NDA, financial indicators, corporate information, and much more
• Color Communications LLC April 27, 2026 • [ ransomware, technology ] Color Communications LLC was listed as a victim on the leak site of the secp0 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Technology. Country: United States of America. Website: ccicolor.com. The exposed dataset includes over 200,000 unique files containing sensitive information on more than 4,500 individuals and over 5,500 organizations...
• N****a April 24, 2026 • [ ransomware, technology ] N****a was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-04-24. Country: United States of America. Website: n****.com.
• H****l April 21, 2026 • [ ransomware, retail ] H****l was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-04-21. Sector: Hospitality. Country: United States of America. Website: t****.com.
• S****p April 16, 2026 • [ ransomware, leak ] S****p was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-04-16. Country: United States of America. Website: s****.com.