Recent Breaches
-
May 29, 2026 • Shoreline Sightseeing was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Hospitality. Country: United States of America. Website: shorelinesightseeing.com. Shoreline Sightseeing offers guided boat tours and water taxi services in Chicago, focusing on architecture and skyline views. Their popular tours include the Architecture River Tour, Skyline Lake Cruise, and Fireworks Tour, showcasing over 40 landmarks. The company caters to tourists looking for unique perspectives of the city and offers packages like the Chicago CityPASS for additional savings on attractions. Established in 1939, Shoreline operates the largest and most diverse fleet of cruise boats in Chicago
-
May 28, 2026 • VODAFONE was listed as a victim on the leak site of the lapsus$ ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Technology. Country: Germany. Website: vodafone.com. Full Infrastructure, Source Code, GitHub Tree & Internal Network Maps
-
May 29, 2026 • Daegu University AI Department was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Education. Country: South Korea. Website: daegu.ac.kr. Daegu University offers a range of educational services including online employment solutions, academic information systems, and various courses for students and faculty. The university focuses on providing resources for job preparation, including strategies for public and private sector employment, as well as civil service exam preparation. It aims to support students, prospective students, and faculty members in their academic and professional development. The institution is committed to fostering a collaborative and innovative learning environment - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
-
May 29, 2026 • www.labexpress.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: United States of America. Website: www.labexpress.com. LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive crosscompany records. This data will be made publicly available in the near future. Active Directory Overview - 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs). - Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2). - A single AD domain serves both Labexpress and Garonit Pharma. Notable account: cn: Troy Austin sAMAccountName: Taustin memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS The same person appears in Exchange mailboxes as taustin@garonitpharma.com. Weak Passwords and BruteForce Indicators - Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30. - Computer accounts FRONTDESK$, DEV$, LABEL$ more than 3,000 failures each. - Cleartext password found on FILE01\passwords.txt: Admin: LabExpress2024! - The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT. - Password for user Protect: Password123! - Outdated password templates in the SBSUsers OU are still in use. Mail Servers and Exchange - LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007. - Full mailbox export performed using the builtin Export-Mailbox cmdlet no special exploit required. Contents of the Obtained Data (200 GB) We have data from drive E:\, including: 1. Financial & Accounting - QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND). - Folder: E:\Garonit Documents\Clients 2022\ hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf). - Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ detailed accounts payable records for 50+ vendors. 2. Quality & Production - Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx). - Complete batch records for 20232026 (folders Batch Records\2023, 2024, 2025, 2026). - Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse. 3. ANDA & Regulatory Documentation - Folder 00 Oral Rinse ANDA-Old One complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA. - Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf. 4. Vendor & Customer Records - Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ dossiers on each supplier (contracts, invoices, assessments). - Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ customer purchase orders and sales quotations. 5. Human Resources (HR) - Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ employment contracts, W9 forms, tax deductions, resignation letters. - Passport scans, Green Card copies, health insurance records for many employees. - Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf. 6. Internal Communications & Scans - Directory C224E BIZHUB SCANNER DUMPS containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.). - Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS. - Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents). 7. Tax & Banking Documentation - Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank. - Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf. Shared Infrastructure Observed Facts - The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma. - Crosscompany records reside in the same folders (e.g., Garonit Documents and LABEXPRESSDATA coexist on the same drive). - User Troy Austin has an AD account (Taustin) and also uses the email address taustin@garonitpharma.com. - Purchase orders, invoices, COA/COC files refer to both companies interchangeably. - At the IT level, there is no separation between the two legal entities. The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future.
-
May 30, 2026 • ecci-srl.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: Italy. Website: ecci-srl.com. Empresa dedicada al rubro de construccin de proyectos inmobiliarios, particularmente la Ciudad Nueva Santa Cruz. El ...
-
May 30, 2026 • DentaQuest, LLC. was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Healthcare. Country: United States of America. Website: dentaquest.com. The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Size: 234GB+ (compressed) | Updated: 30 May 2026 | SHA256: db3088225c36be26ce2b458fa7a190176d071441e2e0830c0d82143e6323a3e1
-
May 29, 2026 • Apex Maritime Co., Inc. was listed as a victim on the leak site of the titan ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Transportation. Country: South Korea. Website: k-apex.kln.com. [AI generated] Apex Maritime Co., Inc. is a freight forwarding and logistics company headquartered in the Philippines. It provides international freight forwarding, customs brokerage, cargo consolidation, and supply chain management services. The company operates across air and ocean freight sectors, serving importers and exporters. It is part of the broader Apex Group, with a global network of offices supporting trade routes across Asia, Europe, and the Americas.
-
May 29, 2026 • SIRILAK SEAFOOD (PW) LTD. was listed as a victim on the leak site of the titan ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Agriculture and Food Production. Country: Sri Lanka.
-
May 26, 2026 • Plexsupply Inc was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-05-26. Sector: Professional Services. Country: United States of America. Website: plexsupply.net. A private wholesale and distribution company offering the highest-quality brand-name products
-
May 30, 2026 • BC3 Tecnologia was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Technology. Country: Brazil. Website: bc3tech.com. BC3.com.br is the website for BC3 Tecnologia, a Brazilian company that develops and sells ERP (Enterprise Resource Planning) software specifically for the corrugated packaging and cartonage industry. Their flagship product is the ERP KRP- Nova Provide tree and samples from stolen data, free 2 files decrypt to the company when its get in touch with support department.
-
May 30, 2026 • Lee Law Offices was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: United States of America. Website: www.leelawoffices.org. Lee Law Offices is a well-established law firm serving clients in North and South Carolina for over 30 years, specializing in personal injury, workers compensation, and social security disability cases. The firm is dedicated to advocating for individuals affected by auto accidents, workplace injuries, and other forms of negligence, ensuring that clients receive the compensation they deserve. With a no-fee guarantee, they focus on representing the best interests of their clients rather than insurance companies or corporations.
-
May 30, 2026 • LTI Services and Larick Towing was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Transportation. Country: United States of America. Website: ltiservices.com. ltiservices.com - laricktowing.com - LTI Services is a leading customization and accessory shop specializing in customizations, repairs, and aftermarket parts for the heavy-duty trucking industry. They work with major truck brands such as Peterbilt, Kenworth, Volvo, International, Freightliner, and Western Star, offering a wide range of services including collision repair, custom fabrication, and electrical repairs. The company prides itself on providing quality parts and accessories while collaborating closely with customers to bring their design visions to life. With a focus on transparency and comprehensive service, LTI Services ensures that clients are informed and confident throughout the project process - Larick Towing Inc. is a family-owned and operated business that has been providing vehicle transportation services since 1978. They offer nationwide vehicle transportation, including pick-up and delivery services for transporters, as well as transport to all ship ports and terminals. Their services cater to both individual clients and auto dealers, facilitating vehicle transport to and from auctions and dealer swaps. The company is known for its customer-focused approach and commitment to quality service - Nova provide free decrypt 2 files as proof, we will leak only DBs, not source code because company may recover from leak) 11 days available to reach us or no recover possible, both sites seized.
-
May 30, 2026 • STAREMPIRE was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-05-30. Country: Vietnam. Website: starempire.com.
-
May 29, 2026 • UEI College was listed as a victim on the leak site of the termite ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Education. Country: United States of America. Website: www.uei.edu. UEI College is a private for-profit career college with locations in the US states of California, Washington, Arizona, Nevada, Texas, New Mexico, and Georgia. It specializes in short-term technical and vocational education to prepare students for entry-level positions in industries such as healthcare, business, and skilled trades.
-
May 29, 2026 • Indiana Mills and Manufacturing was listed as a victim on the leak site of the termite ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Manufacturing. Country: United States of America. Website: www.imminet.com. You have 24 hours to contact us.
-
May 30, 2026 Pragmatic Solutions was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Website: pragmatic.solutions.
-
May 30, 2026 Openmind networks was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: openmindnetworks.com. [AI generated] Openmind Networks is an Irish telecommunications software company specializing in signaling and messaging solutions for mobile network operators. Founded in Dublin, Ireland, the company develops products for SS7, Diameter, and SMS firewall technologies, helping carriers manage and secure signaling traffic. Their solutions address roaming, fraud prevention, and network interoperability, serving telecom operators globally while maintaining headquarters in Ireland.
-
May 30, 2026 • Siveco - was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Technology. Country: France. Website: siveco.com. [AI generated] Siveco is a French software company specializing in computerized maintenance management systems (CMMS) and enterprise asset management (EAM) solutions. Founded in France, the company operates internationally, offering software and services to help organizations manage industrial maintenance, infrastructure, and assets. Its clients span sectors such as energy, transportation, manufacturing, and public utilities across Europe, Africa, and Asia.
-
May 30, 2026 • A Roettgers was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: United States of America. Website: arc-rci.com. Fuel distributor and gas station operator
-
May 30, 2026 • Cedar Street Capital (A part of a Cynvestors Limited Partnership) was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Financial Services. Country: United States of America. Website: cedarstreetcapital.com. A private investment entity associated with Cynthia Stiehl