-
Pequod Associates
May 11, 2026
•
[ ransomware, finance ]
Pequod Associates was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Professional Services. Country: United States of America. Website: pequodassociates.com. A global leader in the provision of Marine Claims TPA and Recovery services.
-
SmilePoint Dental Group
April 14, 2026
•
[ ransomware, healthcare ]
SmilePoint Dental Group was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-04-14. Sector: Healthcare. Country: United States of America. Website: www.smilepoint.us. SmilePoint Dental Group is a fast-growing dental organization operating 2628 offices across Texas and New Mexico.The group runs multiple family dental clinics and orthodontics practices in smaller communities under various brands such as Crosby Family Dental, Liberty Family Dental, Jasper Family Dental, SmilePoint Dental, and others.They offer comprehensive services including general dentistry, orthodontics, cosmetic care, implants, and preventive treatments with modern equipment.- Patient database with social security numbers and medical histories- Access to the local EagleSoft database- Financial reportsThe data provided will allow you to deploy the company's database on any PC with full access to SmilePoint's EagleSoft functionality. https://www.smilepoint.us
-
Rivadeneyra Treviño
May 12, 2026
•
[ ransomware, leak ]
Rivadeneyra Trevio was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Other. Country: Mexico. Website: rivtrev.com. Rivadeneyra Trevio provides expert corporate legal advice, specializing in regulatory law, contract law, foreign trade, and intellectual property for national and international clients.
-
NorthWest Handling Systems
April 23, 2026
•
[ ransomware, leak, manufacturing ]
NorthWest Handling Systems was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Transportation. Country: Canada. [warehouse] NorthWest Handling Systems a 55-year-old forklift and warehouse equipment company headquartered in Renton, Washington, with branches across WA, OR, and AK. The dump is the entire corporate file share going back to 1988. 337,000+ files spanning every branch, every department, every era of the company. It includes: Plaintext credit card numbers in an Excel spreadsheet literally titled C.O.D. info (CREDIT CARD INFO).xlsx stored at the root of the file server, unencrypted, for years. Social Security numbers and Taxpayer IDs on W-9 forms and certified payroll documents for government-contract work (USPS, Oregon DHS, public schools). 3+ years of plaintext passwords for Target Corporations vendor portal (TARS), stored in Word documents titled TARGET PASSWORD & SECURITY QUESTIONS. Each password rotation was saved as a new file. Home Depot Maximo DC billing credentials plaintext, in a Word document, enabling fraudulent invoicing against a Fortune 50 company. Albertsons/Safeway Corrigo facility-management portal credentials again, plaintext in a .docx file. 33 GB of customer warehouse CAD files facility layouts, equipment placement, security-zone dimensions, and fire-protection drawings for approximately 50200 companies including Nike, Google, Costco, and Umpqua Bank. 24,669 rows of fixed-asset data in ExportFile.csv the complete equipment inventory, revealing the companys financial structure, depreciation schedules, and capital-investment history. Corporate bank routing and account numbers (ACH authorization forms), employee direct-deposit details, time cards, disciplinary records, accident reports, and decades of invoices.
-
Startec Group of Companies
April 23, 2026
Startec Group of Companies was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Professional Services. Country: Philippines. Startec Group of Companies, a privately held Calgary-based industrial OEM founded in 1976 by Joe Cawthorn. Startec designs, fabricates, installs, and services compression, process, and refrigeration systems for oil-and-gas operators and the energy-transition sector (RNG, hydrogen, CO&sub2; sequestration, flare-gas capture). The company employs ~270 people and exports ~80% of its cleantech output to US customers including Pembina, ARC Resources, SemCAMS, Cenovus, and Shell. The exposed material spans the entire corporate knowledge base: 25 years of payroll (20012026) including a master SIN VERIFICATION.xlsx register, ADP exports, T4/ROE/T2200 forms, banking/EFT direct-deposit data for ~600+ current and former employees 18+ named passport scans plus a Pakistan resume-and-passport applicant pool (~20+) Wildcard TLS private keys for *.startec.ca (20222027 series) and the suspected Active-Directory-integrated internal CA private key The cyber-insurance policy (BZA2151) and the Nov 2025 Statement of Values & Business-Interruption submission to Zurich ~25+ named customer engineering libraries (Pembina, ARC, SemCAMS, Cenovus, Shell Scotford) with process specs, as-built drawings, and sizing calculations Shell Caroline + Shell Saturn dispute-counsel files (~665 MB of privileged litigation material) 12 fiscal years of board packs including in camera sessions, the 2020 Valuation Report, family-trust T3 returns, and succession-planning documents Cawthorn family QuickBooks files (live .QBW full chart of accounts, general ledger, every transaction) 11 Outlook PST mailboxes (several multi-GB named ex-employees' complete email history) Physical-security access codes (CCTV passwords, Telsco alarm chart, all-doors key record)
-
Saharuang
May 12, 2026
•
[ ransomware, manufacturing ]
Saharuang was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Other. Country: Thailand. Website: saharuang.com. Company operates a large-scale sugar mill and refinery in the Saraburi province, producing various types of sugar for both domestic and export markets.
-
NaRaYa
May 12, 2026
•
[ ransomware, retail ]
NaRaYa was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Retail & E-Commerce. Country: Thailand. Website: naraya.com. NaRaYa is a famous Thai brand recognized worldwide for its distinctive fabric bags and accessories. Founded in 1989, it has grown into one of Asia's most influential brands, specializing in high-quality, handcrafted products that showcase Thai crafts
-
Avanti Windows & Doors
May 12, 2026
Avanti Windows & Doors was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Manufacturing. Country: United States of America. Avanti Windows & Doors a vinyl window manufacturer headquartered in El Mirage, Arizona, with regional offices across Nevada, Texas, California, and Florida.
The exposed material includes:
Plaintext SQL Server SA (system administrator) credentials the master key to the FeneVision ERP database containing every customer order, every price, every financial record the company has ever processed.
Employee SSNs, W-4s, I-9s, and E-Verify data the complete identity package for the entire workforce, from new-hire packets through payroll records spanning 20142016+.
1099-MISC/INT forms SSNs/EINs and payment amounts for 50200+ contractors and vendors across two tax years.
Direct deposit authorizations bank account and routing numbers for employees who enrolled in ACH payroll.
24+ months of Chase bank statements and 28 months of AMEX corporate card statements full account numbers, transaction details, and spending patterns.
The complete proprietary pricing algorithm source code for the FastAPI backend that determines window pricing for every builder contract, plus 41+ builder Master Service Agreements with exact pricing terms.
CPA-reviewed financial statements, partnership returns, K-1s, and budget forecasts the companys full financial anatomy, from cost structure to profit allocation.
OSHA 300 logs, workers compensation audit files, and UHC health insurance invoices employee medical and injury data, names of injured workers, treatment details.
Attorney-client privileged ADOSH settlement correspondence OSHA settlement negotiations between outside counsel and the CEO.
~80 Windows roaming profiles employee desktops, documents, AppData, Outlook .ost/.pst files, browser caches, and cached credentials.
-
Vision 3 Architects
April 24, 2026
•
[ ransomware, leak, technology ]
Vision 3 Architects was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-04-24. Sector: Professional Services. Country: United States of America. Website: vision3architects.com. Vision 3 Architects is a collaborative and responsive design studio specializing in architectur
e and interior design projects. They focus on crafting spaces that reflect each client's vision
and values, ensuring a design environment that fosters creativity and collaboration.
We will upload 31gb of corporate data soon. Detailed employee personal information (passports,
DLs, SSNs and so on), contracts and agreements, client information, projects, NDAs, etc.
-
Manhattan Broadcasting
May 6, 2026
•
[ ransomware, technology, leak ]
Manhattan Broadcasting was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-05-06. Sector: Technology. Country: United States of America. Website: manhattanbroadcasting.com. Manhattan Broadcasting Company is a leading source of local and regional news, sports, weather,
and entertainment in Northeast Kansas, engaging over 100,000 listeners weekly.
We will upload of corporate data soon. Employee personal informatics, contracts, lots of pictur
es and other files.
-
Mediapost Spain
May 12, 2026
•
[ ransomware, technology ]
Mediapost Spain was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Professional Services. Country: Spain. Website: www.mediapost.es.
-
Kaplan Companies
April 7, 2026
•
[ ransomware, financial, leak ]
Kaplan Companies was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-04-07. Sector: Professional Services. Country: United States of America. Website: thinkkaplan.com. Kaplan Companies specializes in providing rental and commercial properties, focusing on new hom
es and maintenance services for current residents. The company aims to cater to individuals and
families seeking quality housing solutions.
We will upload 45gb of corporate data soon. Employee and owners personal information (passports
, DLs, SSNs, and other personal docs), contracts and agreements, client information, financials
, payment details, projects files, drawings and specifications and so on.
-
Taylor Clay Products
October 7, 2025
•
[ ransomware, manufacturing ]
Taylor Clay Products was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-10-07. Sector: Manufacturing. Country: United States of America. Website: taylorclaybrick.com. Taylor Clay Products specializes in premium architectural brick, thin brick, and custom masonry
solutions, catering to architects and builders for over 75 years. The company offers a wide se
lection of colors, textures, and finishes, including custom blends tailored to specific project
s.
We will upload 72gb of corporate data soon. Employee personal information (DL and other persona
l docs), contracts, client information, drawings and specifications.
-
Bestat Pharmaservices Corp.
May 12, 2026
•
[ ransomware, healthcare ]
Bestat Pharmaservices Corp. was listed as a victim on the leak site of the worldleaks ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Healthcare. Country: Taiwan. Website: bestat.com.tw.
-
dentoncalvary.org
March 31, 2026
dentoncalvary.org was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-03-31. Sector: Healthcare. Country: United States of America. Website: dentoncalvary.org. Denton Calvary Academy is a K-12 University-Model school that focuses on fostering a love of learnin...
-
GeTeCe
May 12, 2026
•
[ ransomware, technology, manufacturing ]
GeTeCe was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Technology. Country: Germany. Website: getece.com. getece.com zoominfo.com/c/getece-co-ltd/353619915 GeTeCe is Thailand's trusted ingredients partner since 1978, specializing in premium chemicals, fragrances, flavours, and food ingredients for diverse manufacturing industries. With four decades of expertise, a state-of-the-art blending facility, and strategic global partnerships, they deliver tailored solutions backed by deep market insights and regulatory compliance. Their dedicated technical team and reliable supply chain empower clients to innovate confidently and stay ahead in competitive markets across Southeast Asia
-
Amstel Securities
May 12, 2026
•
[ ransomware, finance ]
Amstel Securities was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Financial Services. Country: Netherlands. Website: amstelsecurities.com. amstelsecurities.com zoominfo.com/c/amstel-securities-llp/353641962 Amstel Securities is a premier independent brokerage firm founded in 1989, connecting Asian and global markets with 35+ years of expertise in fixed income, equities, and derivatives. As a trusted agency and matched-principal broker, they specialize in Southeast Asian domestic currency bonds, high-yield credit, and G7 markets, serving institutional clients with unbiased execution and deep liquidity. Backed by strategic partnerships with BNY Mellon's Pershing for clearing and custody, they deliver secure, efficient solutions for wealth managers, family offices, and accredited investors worldwide
-
Dodson & Horrell
May 12, 2026
Dodson & Horrell was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Agriculture and Food Production. Country: United Kingdom of Great Britain and Northern Ireland. Website: dodsonandhorrell.com. dodsonandhorrell.com zoominfo.com/c/dodson--horrell-ltd/21104188 Dodson Horrell is a world-leading, family-run feed manufacturer established in 1939, specializing in premium nutrition for horses, poultry, and zoo animals. With over 80 years of expertise, their science-backed formulations and dedicated Nutritional Helpline empower owners to care for every animal as an individual. As exclusive feed partners to the British Equestrian Teams and a trusted name across global equestrian communities, they combine heritage, innovation, and unwavering quality
-
Value Exchange International
May 12, 2026
•
[ ransomware, technology, finance ]
Value Exchange International was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Financial Services. Country: Hong Kong. Website: valueexch.com. valueexch.com Value Exchange International Inc. is a trailblazing retail technology leader with over 30 years of expertise, delivering comprehensive digital solutions across Asia, the UK, Australia, and New Zealand. Their 300+ professionals provide 24/7 Managed Operations, Systems Integration, and innovative retail hardware from Electronic Shelf Labels to AI-powered inspection robots powering 20,000+ daily POS transactions and HK$400+ billion in annual retail sales. With a customer-centric approach and cutting-edge technology, VEII empowers retailers to thrive through seamless digital transformation and operational excellence
-
SETCAR
May 12, 2026
SETCAR was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Transportation. Country: Tunisia. Website: setcar.com.tn. setcar.com.tn zoominfo.com/c/setcar/507355731 SETCAR is Tunisia's pioneering private manufacturer of buses, coaches, and minibuses, with over 50 years of excellence since 1976. Partnering with global leaders like Volvo and Iveco, they produce up to 500 vehicles annually, serving public transport, tourism, and institutional clients across Africa and the Middle East. With a 300-strong expert team, advanced production facilities, and dedicated after-sales support, SETCAR delivers innovative, eco-friendly mobility solutions built for reliability and performance
