-
Ayuntamiento de Valdemoro
May 4, 2026
Ayuntamiento de Valdemoro was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-05-04. Sector: Government & Defense. Country: Spain. Website: valdemoro.es. Ayuntamiento de Valdemoro is the municipal government of Valdemoro, a town in the Madrid region of Spain. The site valdemoro.es is its official portal for residents, local news, and access to administrative services. The council plans and delivers local public services such as urban maintenance, social and cultural programmes, education and sports facilities where it is responsible, and citizen support. It passes local regulations within national and regional law, manages municipal assets, and interacts with higher tiers of government on regional and national programmes. In short, it is the local authority that governs and runs day-to-day public administration for the municipality.
-
Arwini
May 11, 2026
Arwini was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-05-11. Country: Germany. Arbeitsgemeinschaft Wirtschaftlichkeitsprfung Niedersachsen e.V. (ARWINI) is a registered association in Lower Saxony, Germany, whose public role is to host the joint Wirtschaftlichkeitsprfung setup for statutory health insurance under SGB V. It brings together the KVN (the regional association of panel physicians) and the health insurers in a shared inspection / audit structure for contractual outpatient care. Day-to-day work covers procedures, consultations with physicians where relevant, and formal processes linked to efficiency and appropriateness of care and billing. The brand ARWINI is the short name used in official documents and online; arwini.de is the domain commonly associated with that name. Operationally the body sits in the social health sector rather than ordinary consumer or tech markets.
-
AppDirect
May 11, 2026
•
[ ransomware, technology ]
AppDirect was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Technology. Country: Canada. Website: www.appdirect.com.
-
arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP
May 11, 2026
arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Financial Services. Country: United Arab Emirates. Website: fidelityunited.ae. We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets.
-
HostBooks (HOT!)
May 9, 2026
HostBooks (HOT!) was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Professional Services. Country: United States of America. Website: hostbooks.com. An accounting software provider.
-
Palo
May 9, 2026
Palo was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Technology. Country: United States of America. Website: palo.us. Architecture and Planning.
-
Ben F. Barcus and associates pllc
May 9, 2026
•
[ ransomware, finance ]
Ben F. Barcus and associates pllc was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Professional Services. Country: United States of America. Website: usattorneys.com. A law firm from Tacoma, WA.
-
Integrated Process Engineers & Constructors.
May 8, 2026
•
[ ransomware, leak, manufacturing ]
Integrated Process Engineers & Constructors. was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Manufacturing. Country: United States of America. Website: ipec-inc.com. Specializes in custom modular process systems, offering a wide range of products including bioreactors, filtration systems, and utility stations.
-
Fargo Moorhead West Fargo Chamber
May 8, 2026
•
[ ransomware, technology ]
Fargo Moorhead West Fargo Chamber was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Professional Services. Country: United States of America. Website: fmwfchamber.com. A business services provider.
-
Casino Gaming Commission
May 8, 2026
•
[ ransomware, government, leak ]
Casino Gaming Commission was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Government & Defense. Country: Jamaica. Website: cgc.gov.jm. Official Casino Gaming Commission of Jamaica.
-
Bideawee
May 11, 2026
Bideawee was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Retail & E-Commerce. Country: United States of America. Website: bideawee.org. Bideawee is a no-kill animal rescue and shelter located in NYC, Wantagh, and Westhampton. The organization offers a variety of services including adoptions, medical care, pet therapy, and fostering opportunities. Bideawee aims to strengthen the human-animal bond through compassionate care for both pets and their owners. Its targeted clients include individuals and families seeking to adopt or foster pets, as well as volunteers looking to support animal welfare.
-
rbh aerospace inc
May 11, 2026
•
[ ransomware, manufacturing, espionage ]
rbh aerospace inc was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Manufacturing. Country: United States of America. Website: rbhaerospace.com. RBH Aerospace, Inc.
-is a manufacturing company located in Long Beach, California, specializing in the production of aerospace components. Established in January 2005, the company focuses on providing high-quality parts for both commercial and military aircraft. Their product offerings include aircraft frames, fuselages, wings, and various metal alloy components such as steel, aluminum, and titanium.
2708 Seaboard Lane, Long Beach, CA 90805
http://www.rbhaerospace.com/
Leaked data 240 GB:
Corporate information, including electronic correspondence with counterparties, contracts including NDAs, transactions and payments related to them, STP (STEP) files, part drawings (including those for F-15, F-22), manuals and instructions.
-
Pequod Associates
May 11, 2026
•
[ ransomware, finance ]
Pequod Associates was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Professional Services. Country: United States of America. Website: pequodassociates.com. A global leader in the provision of Marine Claims TPA and Recovery services.
-
SmilePoint Dental Group
April 14, 2026
•
[ ransomware, healthcare ]
SmilePoint Dental Group was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-04-14. Sector: Healthcare. Country: United States of America. Website: www.smilepoint.us. SmilePoint Dental Group is a fast-growing dental organization operating 2628 offices across Texas and New Mexico.The group runs multiple family dental clinics and orthodontics practices in smaller communities under various brands such as Crosby Family Dental, Liberty Family Dental, Jasper Family Dental, SmilePoint Dental, and others.They offer comprehensive services including general dentistry, orthodontics, cosmetic care, implants, and preventive treatments with modern equipment.- Patient database with social security numbers and medical histories- Access to the local EagleSoft database- Financial reportsThe data provided will allow you to deploy the company's database on any PC with full access to SmilePoint's EagleSoft functionality. https://www.smilepoint.us
-
Rivadeneyra Treviño
May 12, 2026
•
[ ransomware, leak ]
Rivadeneyra Trevio was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Other. Country: Mexico. Website: rivtrev.com. Rivadeneyra Trevio provides expert corporate legal advice, specializing in regulatory law, contract law, foreign trade, and intellectual property for national and international clients.
-
NorthWest Handling Systems
April 23, 2026
•
[ ransomware, leak, manufacturing ]
NorthWest Handling Systems was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Transportation. Country: Canada. [warehouse] NorthWest Handling Systems a 55-year-old forklift and warehouse equipment company headquartered in Renton, Washington, with branches across WA, OR, and AK. The dump is the entire corporate file share going back to 1988. 337,000+ files spanning every branch, every department, every era of the company. It includes: Plaintext credit card numbers in an Excel spreadsheet literally titled C.O.D. info (CREDIT CARD INFO).xlsx stored at the root of the file server, unencrypted, for years. Social Security numbers and Taxpayer IDs on W-9 forms and certified payroll documents for government-contract work (USPS, Oregon DHS, public schools). 3+ years of plaintext passwords for Target Corporations vendor portal (TARS), stored in Word documents titled TARGET PASSWORD & SECURITY QUESTIONS. Each password rotation was saved as a new file. Home Depot Maximo DC billing credentials plaintext, in a Word document, enabling fraudulent invoicing against a Fortune 50 company. Albertsons/Safeway Corrigo facility-management portal credentials again, plaintext in a .docx file. 33 GB of customer warehouse CAD files facility layouts, equipment placement, security-zone dimensions, and fire-protection drawings for approximately 50200 companies including Nike, Google, Costco, and Umpqua Bank. 24,669 rows of fixed-asset data in ExportFile.csv the complete equipment inventory, revealing the companys financial structure, depreciation schedules, and capital-investment history. Corporate bank routing and account numbers (ACH authorization forms), employee direct-deposit details, time cards, disciplinary records, accident reports, and decades of invoices.
-
Startec Group of Companies
April 23, 2026
Startec Group of Companies was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Professional Services. Country: Philippines. Startec Group of Companies, a privately held Calgary-based industrial OEM founded in 1976 by Joe Cawthorn. Startec designs, fabricates, installs, and services compression, process, and refrigeration systems for oil-and-gas operators and the energy-transition sector (RNG, hydrogen, CO&sub2; sequestration, flare-gas capture). The company employs ~270 people and exports ~80% of its cleantech output to US customers including Pembina, ARC Resources, SemCAMS, Cenovus, and Shell. The exposed material spans the entire corporate knowledge base: 25 years of payroll (20012026) including a master SIN VERIFICATION.xlsx register, ADP exports, T4/ROE/T2200 forms, banking/EFT direct-deposit data for ~600+ current and former employees 18+ named passport scans plus a Pakistan resume-and-passport applicant pool (~20+) Wildcard TLS private keys for *.startec.ca (20222027 series) and the suspected Active-Directory-integrated internal CA private key The cyber-insurance policy (BZA2151) and the Nov 2025 Statement of Values & Business-Interruption submission to Zurich ~25+ named customer engineering libraries (Pembina, ARC, SemCAMS, Cenovus, Shell Scotford) with process specs, as-built drawings, and sizing calculations Shell Caroline + Shell Saturn dispute-counsel files (~665 MB of privileged litigation material) 12 fiscal years of board packs including in camera sessions, the 2020 Valuation Report, family-trust T3 returns, and succession-planning documents Cawthorn family QuickBooks files (live .QBW full chart of accounts, general ledger, every transaction) 11 Outlook PST mailboxes (several multi-GB named ex-employees' complete email history) Physical-security access codes (CCTV passwords, Telsco alarm chart, all-doors key record)
-
Saharuang
May 12, 2026
•
[ ransomware, manufacturing ]
Saharuang was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Other. Country: Thailand. Website: saharuang.com. Company operates a large-scale sugar mill and refinery in the Saraburi province, producing various types of sugar for both domestic and export markets.
-
NaRaYa
May 12, 2026
•
[ ransomware, retail ]
NaRaYa was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Retail & E-Commerce. Country: Thailand. Website: naraya.com. NaRaYa is a famous Thai brand recognized worldwide for its distinctive fabric bags and accessories. Founded in 1989, it has grown into one of Asia's most influential brands, specializing in high-quality, handcrafted products that showcase Thai crafts
-
Avanti Windows & Doors
May 12, 2026
Avanti Windows & Doors was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Manufacturing. Country: United States of America. Avanti Windows & Doors a vinyl window manufacturer headquartered in El Mirage, Arizona, with regional offices across Nevada, Texas, California, and Florida.
The exposed material includes:
Plaintext SQL Server SA (system administrator) credentials the master key to the FeneVision ERP database containing every customer order, every price, every financial record the company has ever processed.
Employee SSNs, W-4s, I-9s, and E-Verify data the complete identity package for the entire workforce, from new-hire packets through payroll records spanning 20142016+.
1099-MISC/INT forms SSNs/EINs and payment amounts for 50200+ contractors and vendors across two tax years.
Direct deposit authorizations bank account and routing numbers for employees who enrolled in ACH payroll.
24+ months of Chase bank statements and 28 months of AMEX corporate card statements full account numbers, transaction details, and spending patterns.
The complete proprietary pricing algorithm source code for the FastAPI backend that determines window pricing for every builder contract, plus 41+ builder Master Service Agreements with exact pricing terms.
CPA-reviewed financial statements, partnership returns, K-1s, and budget forecasts the companys full financial anatomy, from cost structure to profit allocation.
OSHA 300 logs, workers compensation audit files, and UHC health insurance invoices employee medical and injury data, names of injured workers, treatment details.
Attorney-client privileged ADOSH settlement correspondence OSHA settlement negotiations between outside counsel and the CEO.
~80 Windows roaming profiles employee desktops, documents, AppData, Outlook .ost/.pst files, browser caches, and cached credentials.
