-
nbd3pl.com
April 29, 2026
•
[ ransomware, leak ]
nbd3pl.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Transportation. Country: United States of America. Website: nbd3pl.com. North Bay Distribution has been in the warehousing, order fulfillment, and shipping industry for more than 30 years. They are a full service outsourcing logistics service provider. They are based in northern California's City of Vacaville. The proximity of their facility provides streamlined deliveries from the Port of Oakland for goods manufactured and arriving from the Pacific Rim
-
https://www.fulcrumre.com/
April 11, 2026
•
[ ransomware, finance, leak ]
https://www.fulcrumre.com/ was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-11. Sector: Professional Services. Country: United States of America. Website: fulcrumre.com. 2tb data all company data
-
boxtopia.co.uk
April 29, 2026
•
[ ransomware, retail, manufacturing ]
boxtopia.co.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: boxtopia.co.uk. +44 1476576090 . Boxtopia is the UK's leading supplier of custom cardboard boxes and printed boxes, specializing in short runs for small businesses with no minimum order. Stolen: 166gb 280k files
-
osoftec.com
April 29, 2026
•
[ ransomware, technology, leak ]
osoftec.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Germany. Website: osoftec.com. +91 9717385459 . Optimization Software Technologies, LLP. is an advanced technology solutions development company that focuses on improving operational efficiency and profitability for its clients Stolen: 222gb 113k files
-
rotak.it
April 29, 2026
•
[ ransomware, technology, healthcare ]
rotak.it was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Italy. Website: rotak.it. Rotak (specifically in the context of Rotak Instruments) focuses on the distribution of specialized medical and analytical instrumentation, with related entities in industrial engineering and automation Stolen: 22.5gb 20k files
-
rainforestclean.com
April 29, 2026
•
[ ransomware, retail, leak ]
rainforestclean.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United States of America. Website: rainforestclean.com. Rainforest Carwash and Oil Change, along with its owner, enjoys giving back to our local community. Hopefully you are inspired to help after seeing the ways in which we try to help others. Stolen: 259gb 77k files
-
airdriephysio.com
April 29, 2026
airdriephysio.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Healthcare. Country: United Kingdom of Great Britain and Northern Ireland. Website: airdriephysio.com. Airdrie Physiotherapy & Massage is a multi-disciplinary clinic located in Airdrie, Alberta, offering a range of services including physiotherapy, massage therapy, acupuncture, and laser therapy Stolen: 54gb 116k files
-
primeproperties.com.au
April 29, 2026
•
[ ransomware, retail ]
primeproperties.com.au was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: Australia. Website: primeproperties.com.au. Prime Properties (NSW) P/L is a privately owned company based in Sydney, Australia, established in 1982, specializing in property investment, building management, and management consultancy services Stolen: 100gb 81k files
-
anvilarts.org.uk
April 29, 2026
•
[ ransomware, leak, retail ]
anvilarts.org.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: anvilarts.org.uk. Anvil Arts is the largest performing arts organization in Hampshire, operating as an independent charitable trust. It manages three venues in Basingstoke, including The Anvil and The Haymarket, providing a diverse range of performances and cultural events. Stolen: 480gb 299k files
-
dmschweiz.ch
April 29, 2026
•
[ ransomware, technology ]
dmschweiz.ch was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: Switzerland. Website: dmschweiz.ch. Sie haben im Katalog unsere Angebote von installierten und betriebsbereiten Gerten. Die Installationen knnen nach Ihren Wnschen angepasst werden. DM Standard-Installation ist optimiert und ohne Herstellerwerbung. Stolen: 120gb 100k files
-
stllc.org
April 21, 2026
•
[ ransomware, healthcare ]
stllc.org was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-21. Sector: Other. Country: United States of America. Website: stllc.org. Welcome to St. Luke Lutheran Community St. Luke Lutheran Community is a not-for-profit, continuing...
-
instapack.es
April 28, 2026
•
[ ransomware, retail ]
instapack.es was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Professional Services. Country: Spain. Website: instapack.es. Instapack is a professional courier service with over 30 years of experience, offering immediate del...
-
pricon.com.ph
April 17, 2026
•
[ ransomware, manufacturing, technology ]
pricon.com.ph was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Professional Services. Country: Philippines. Website: pricon.com.ph. Pricon Microelectronics, Inc. (PMI) is an Original Equipment Manufacturer (OEM) and a subsidiary of...
-
planetsport.ma
April 13, 2026
planetsport.ma was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-13. Sector: Retail & E-Commerce. Country: Morocco. Website: planetsport.ma. Planet Sport is your go-to online store for sports gear in Morocco. They help athletes and fitness f...
-
defcon5italy.com
March 25, 2026
defcon5italy.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-03-25. Sector: Technology. Country: Italy. Website: defcon5italy.com. DEFCON, the U.S. acronym for DEFense CONdition, tells of the highest degree of protection and effica...
-
Bayou Title, Inc.
April 29, 2026
•
[ ransomware, finance, leak ]
Bayou Title, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Financial Services. Country: United States of America. Website: bayoutitle.com. [insurance] Bayou Title, Inc. the largest title insurance agent and closing/settlement services provider in Louisiana, with 19 full-service locations statewide.
The exfiltrated data spans 20+ years of operations (20042026) and includes:
70,000100,000+ Social Security numbers paired with names, addresses, and sale proceeds from 1099-S real-estate closing worksheets covering all 19 offices across three tax years (20182020), plus W-2 and 1099-MISC filings.
Complete employee payroll databases 10+ instances of Sage 50 EMPLOYEE.DAT files containing SSNs, bank account numbers, routing numbers, pay rates, tax withholding, and direct deposit details for current and former employees.
103 GB of title abstracts ~34,000+ PDFs documenting ownership chains, liens, and mortgages for properties across Louisiana.
44 GB of GreenFolders DMS transaction packages (2012, 2013, 2019) complete closing file archives containing HUD-1 settlement statements, identity verification documents, SSN cards, and tax records. Filenames contain encoded tags (ssn, hud, soc, tax).
Plaintext credentials for government portals a file literally named Lafayette Assessors lcmenard Password4321.url, plus a PDF containing Orleans Parish system login credentials.
Attorney-client privileged documents wills, attorney engagement letters, and legal opinions prepared by licensed Louisiana attorneys.
-
Costa Solutions, LLC
April 29, 2026
•
[ ransomware, financial, technology ]
Costa Solutions, LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United States of America. Website: costasolutions.com. [warehouse] Costa Solutions, LLC a privately held managed-labor and warehousing company headquartered in San Antonio, Texas, with ~$140M annual revenue and 2001,000 employees.
The file server contained the complete operational, financial, legal, and human resources infrastructure of the company:
3,0008,000+ individuals' personal data current employees, former employees (12 years of records), independent contractors, employee dependents, and job applicants. SSNs on W-2s, W-4s, 1099s, I-9s, background checks. Bank account and routing numbers on 200+ direct deposit forms.
Medical and injury records 150+ employee injury/medical files from 20132026, FMLA medical certifications, drug test results (random, reasonable suspicion, post-incident, promotional), and workers' compensation claims for 23+ named individuals.
CEO's entire file system Josh Wean's Documents folder (5.3 GB) including P&L statements, a 17-subfolder "Confidential" directory, legal correspondence, strategic plans, a C-12 peer advisory group archive, and a $RECYCLE.BIN with 60+ deleted items.
Client contracts and competitive intelligence pricing, SLAs, and contract terms for HEB, CVS, Sysco, Amazon, McLane, Labatt, Valvoline. Competitor pricing intelligence. RFP bid documents with cost models.
Active legal case files litigation records (20212022), HR internal investigation notes (20182021), arbitration files, active investigations marked "DO NOT DELETE" all subject to attorney-client privilege.
Infrastructure secrets an HEB production server TLS certificate, a Cisco AnyConnect VPN installer, and the CEO's Remote Desktop connection file.
Corporate financials multi-year budgets, valuation & sale documents (indicating possible M&A activity), PPP loan forgiveness records, Form 5500 ERISA filings, and annual reporting.
-
Atlas Metal Industries Inc
April 29, 2026
•
[ ransomware, leak, manufacturing ]
Atlas Metal Industries Inc was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: Canada. Website: atlasfoodserv.com. [food, metal] Atlas Metal Industries Inc. a privately held commercial-foodservice-equipment manufacturer headquartered in Miami, Florida.
The dataset is a complete Microsoft Dynamics GP environment: production databases, payroll records, system credentials, Autodesk Vault product-design backups, CNC fabrication programs, and all supporting infrastructure configuration. The exfiltration occurred on or about April 8, 2026; the attack was identified April 22, 2026.
The exposed material includes:
15.8 GB of payroll-records database (PYREC) full Employee Master with SSNs, DOBs, addresses, direct-deposit bank routing numbers, salary, W-4 tax data, garnishments, and check history dating to at least 2018.
30+ SQL Server login accounts with password hashes in a sp_help_revlogin dump named employees, system admins (DYNSA, sa), service accounts, and Active Directory domain accounts.
74 GB of Autodesk Vault Professional backup complete product-design history from 2019 through 2026, covering every product line Atlas Metal manufactures.
Hundreds of CNC fabrication programs laser-cutter and Amada punch-press G-code for the full catalogue of sheet-metal components.
A base64-encoded SQL credential for the TimeClock Plus timekeeping system, stored in plaintext XML.
8 SQL Server databases with full backup chains ATLAS (primary), PYREC (payroll), DYNAMICS (system), TEST (18 GB dev clone), TWO, AMIT, plus system databases (master, msdb, DynamicsGPSecurity).
-
Law Offices of Michael A. Freedman, P.A. (maflaw.com)
April 23, 2026
Law Offices of Michael A. Freedman, P.A. (maflaw.com) was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Professional Services. Country: United States of America. Website: maflaw.com. [law] Law Offices of Michael A. Freedman, P.A. (maflaw.com). The exfiltrated corpus is 579 GB used / 143 GB at root level / 196,701 files / 19,231 directories, dated as recently as a year-2026-in-progress client matter.
What this means for a plaintiffs' PI firm of ~25 staff:
656 client-matter folders organised across eight yearly parents from June 2019 through 2026-in-progress. Per-client medical records, HIPAA authorisations, police reports, settlement releases, IOLTA distribution sheets, retainer agreements, and treating-provider correspondence.
Two staff Outlook archives at 2.1 GB each, plus a 505 MB Outlook backup, plus 27 enumerated .pst files years of attorneyclient privileged correspondence, settlement strategy, opposing-counsel comms.
The complete Sage ACT. Pro v18 contact universe the live database plus eight historical ZIP backups going back to 2013 plus a 9.3 MB plaintext export (ACT!-Contacts.txt) that any text editor can open. Estimated 5,00012,000 contacts.
The firm's master credential vault in a Word document called Woodywoody78!.docx (the filename is itself the vault password). Plaintext credentials for M&T Bank multi-identity business + commercial accounts (with electronic-payment-approval authority), Bank of America, Paychex, QuickBooks, and the firm's federal EIN. Plus the senior partner's phone-unlock PIN.
A staff browser-exported password CSV (32 plaintext credentials) including the M365 tenant, the Slack tenant, hospital portals (MedStar, GBMC, Allstate secure mail), MoveDocs, ChartRequest, MSHC Legal portal plus residual credentials from prior employers SLF Law and Bailey Law, creating cross-firm contamination liability.
The Universal Licensing / Freedman Consulting invention-promotion operation a second line of business under the same EIN, with hundreds of inventor folders. Per-inventor unpublished invention disclosures, Internet Presentation of Invention decks, NDAs, Exclusive Patent License Agreement drafts, patent-art renderings, and per-managed-mailbox client-company passwords.
A criminal-defense sub-practice (SLF criminal out of Janice's working folder) with retainer agreements and per-client court documents, carrying 6th-Amendment-attorneyclient uplift on the privileged-track scoring.
An Axon evidence.com MPIA-released body-worn-camera package (449 MB total; a 448 MB clip from the 2020-12-20 Park Baltimore incident).
-
Cheval Blanc Randheli
April 22, 2026
Cheval Blanc Randheli was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-22. Sector: Hospitality. Country: Maldives. Website: chevalblanc.com. [lvmh] Guest Passport Scans 75,855 Files, 10 Years
The single largest data category: 75,855 passport scan images spanning January 2015 through October 2024, organised in daily folders within monthly and yearly directories. These represent an estimated 20,00030,000 unique guests. Each scan contains the full passport bio page: photo, full name, date of birth, nationality, passport number, machine-readable zone (MRZ), and signature.
Among the exposed passports:
Qatar Royal Family members 9 passport scans including Muhammad Mesned S M Al-Misned, Abdulla, Khalifa, Lolwa, Nasser, Alanoud, Bessy, and Mesned
UAE VIP and government officials including H.E. Ahmed Saif Ali Aldhabea Aldarmaki, H.E. Matar Suhail Ali Alyabhouni Aldhaheri, and members of an April 2024 private buyout group who arrived on private jets (tail numbers A6AUH, A6DAH)
LVMH head-office executives 7 passport/profile photos including named senior staff from Paris
Guest PMS Data 30,00050,000 Profiles
Opera PMS exports containing full names, home addresses (street-level), nationalities, VIP classification levels (A/B/C/G), partial credit card data (last-4 digits + expiry + card type), deposit amounts, booking confirmation numbers, stay histories, travel agent details, flight numbers, and guest preferences.
Employee Records 1,0002,000 Individuals
Ten years of salary records (20172026), medical insurance claims organised by department, ~200 ECARD ID photos, vacation/leave records, Key Management Personnel (KMP) compensation details, and biometric enrollment data from the Gladis facility-access system.
Credentials and Infrastructure
BitLocker recovery key full disk-encryption key for the Windows server volume
Passwords.docx plaintext system password store covering revenue, PMS, and operational systems
Extranet passwords booking-portal and vendor credentials
3CX VoIP backup SIP credentials, extension configurations, call routing rules
Biometric templates (Gladis enrollment) non-rotateable fingerprint/facial data
Corporate-Sensitive Documents
Management Contract of Cheval Blanc Randheli the LVMHproperty owner agreement containing fee structures, performance benchmarks, and brand license terms
Board investment recommendation for Velidhoo a potential new property with capital allocation and return projections
10 years of budgets and revenue forecasts
Audited subsidiary financial statements (I&T / Sitax entities)
White Book the property's operational standards manual (proprietary LVMH brand IP)
Building Management System data HVAC, power, desalination, and lighting control files for island infrastructure
