-
International Customer Care Services
March 29, 2026
•
[ ransomware, technology ]
International Customer Care Services was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-03-29. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: iccs.global.
-
Keller Williams Real Estate - Exton
May 11, 2026
•
[ ransomware, leak, retail ]
Keller Williams Real Estate - Exton was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Retail & E-Commerce. Country: United States of America. Website: www.kwphillysuburbs.com.
-
Advanced Software Products Group
May 11, 2026
Advanced Software Products Group was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Technology. Country: United States of America. Website: www.aspg.com. ASPG Inc. specializes in enterprise and mainframe software solutions that focus on secure access, data protection, and system management. Their product offerings include comprehensive cryptography tools, access management solutions, and systems administration utilities tailored for various industries such as education, government, healthcare, and finance. Since 1986, ASPG has been dedicated to providing the IT community with cutting-edge software and support services.
-
lalsgroup.com
May 10, 2026
•
[ ransomware, leak, retail ]
lalsgroup.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-10. Sector: Other. Country: United Arab Emirates. Website: lalsgroup.com. Lals Group is a large UAE-based family business group operating in retail, FMCG, distribution, home goods, and lifestyle brands across the GCC region. Founded in 1979, the company manages well-known brands and retail chains including Homes r Us, Daiso Japan, Carters, Mom Store, and others. Lals Group operates across the UAE, Qatar, Bahrain, Oman, Kuwait, and Saudi Arabia, with activities spanning retail stores, shopping malls, and logistics services.
--
400 gb
-
Ayuntamiento de Valdemoro
May 4, 2026
Ayuntamiento de Valdemoro was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-05-04. Sector: Government & Defense. Country: Spain. Website: valdemoro.es. Ayuntamiento de Valdemoro is the municipal government of Valdemoro, a town in the Madrid region of Spain. The site valdemoro.es is its official portal for residents, local news, and access to administrative services. The council plans and delivers local public services such as urban maintenance, social and cultural programmes, education and sports facilities where it is responsible, and citizen support. It passes local regulations within national and regional law, manages municipal assets, and interacts with higher tiers of government on regional and national programmes. In short, it is the local authority that governs and runs day-to-day public administration for the municipality.
-
Arwini
May 11, 2026
Arwini was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-05-11. Country: Germany. Arbeitsgemeinschaft Wirtschaftlichkeitsprfung Niedersachsen e.V. (ARWINI) is a registered association in Lower Saxony, Germany, whose public role is to host the joint Wirtschaftlichkeitsprfung setup for statutory health insurance under SGB V. It brings together the KVN (the regional association of panel physicians) and the health insurers in a shared inspection / audit structure for contractual outpatient care. Day-to-day work covers procedures, consultations with physicians where relevant, and formal processes linked to efficiency and appropriateness of care and billing. The brand ARWINI is the short name used in official documents and online; arwini.de is the domain commonly associated with that name. Operationally the body sits in the social health sector rather than ordinary consumer or tech markets.
-
AppDirect
May 11, 2026
•
[ ransomware, technology ]
AppDirect was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Technology. Country: Canada. Website: www.appdirect.com.
-
arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP
May 11, 2026
arc-reins.com + fidelityunited.ae UPDATE-FULL DATA DUMP was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Financial Services. Country: United Arab Emirates. Website: fidelityunited.ae. We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets.
-
HostBooks (HOT!)
May 9, 2026
HostBooks (HOT!) was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Professional Services. Country: United States of America. Website: hostbooks.com. An accounting software provider.
-
Palo
May 9, 2026
Palo was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Technology. Country: United States of America. Website: palo.us. Architecture and Planning.
-
Ben F. Barcus and associates pllc
May 9, 2026
•
[ ransomware, finance ]
Ben F. Barcus and associates pllc was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-09. Sector: Professional Services. Country: United States of America. Website: usattorneys.com. A law firm from Tacoma, WA.
-
Integrated Process Engineers & Constructors.
May 8, 2026
•
[ ransomware, leak, manufacturing ]
Integrated Process Engineers & Constructors. was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Manufacturing. Country: United States of America. Website: ipec-inc.com. Specializes in custom modular process systems, offering a wide range of products including bioreactors, filtration systems, and utility stations.
-
Fargo Moorhead West Fargo Chamber
May 8, 2026
•
[ ransomware, technology ]
Fargo Moorhead West Fargo Chamber was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Professional Services. Country: United States of America. Website: fmwfchamber.com. A business services provider.
-
Casino Gaming Commission
May 8, 2026
•
[ ransomware, government, leak ]
Casino Gaming Commission was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-08. Sector: Government & Defense. Country: Jamaica. Website: cgc.gov.jm. Official Casino Gaming Commission of Jamaica.
-
Bideawee
May 11, 2026
Bideawee was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Retail & E-Commerce. Country: United States of America. Website: bideawee.org. Bideawee is a no-kill animal rescue and shelter located in NYC, Wantagh, and Westhampton. The organization offers a variety of services including adoptions, medical care, pet therapy, and fostering opportunities. Bideawee aims to strengthen the human-animal bond through compassionate care for both pets and their owners. Its targeted clients include individuals and families seeking to adopt or foster pets, as well as volunteers looking to support animal welfare.
-
rbh aerospace inc
May 11, 2026
•
[ ransomware, manufacturing, espionage ]
rbh aerospace inc was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Manufacturing. Country: United States of America. Website: rbhaerospace.com. RBH Aerospace, Inc.
-is a manufacturing company located in Long Beach, California, specializing in the production of aerospace components. Established in January 2005, the company focuses on providing high-quality parts for both commercial and military aircraft. Their product offerings include aircraft frames, fuselages, wings, and various metal alloy components such as steel, aluminum, and titanium.
2708 Seaboard Lane, Long Beach, CA 90805
http://www.rbhaerospace.com/
Leaked data 240 GB:
Corporate information, including electronic correspondence with counterparties, contracts including NDAs, transactions and payments related to them, STP (STEP) files, part drawings (including those for F-15, F-22), manuals and instructions.
-
Pequod Associates
May 11, 2026
•
[ ransomware, finance ]
Pequod Associates was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-11. Sector: Professional Services. Country: United States of America. Website: pequodassociates.com. A global leader in the provision of Marine Claims TPA and Recovery services.
-
SmilePoint Dental Group
April 14, 2026
•
[ ransomware, healthcare ]
SmilePoint Dental Group was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-04-14. Sector: Healthcare. Country: United States of America. Website: www.smilepoint.us. SmilePoint Dental Group is a fast-growing dental organization operating 2628 offices across Texas and New Mexico.The group runs multiple family dental clinics and orthodontics practices in smaller communities under various brands such as Crosby Family Dental, Liberty Family Dental, Jasper Family Dental, SmilePoint Dental, and others.They offer comprehensive services including general dentistry, orthodontics, cosmetic care, implants, and preventive treatments with modern equipment.- Patient database with social security numbers and medical histories- Access to the local EagleSoft database- Financial reportsThe data provided will allow you to deploy the company's database on any PC with full access to SmilePoint's EagleSoft functionality. https://www.smilepoint.us
-
Rivadeneyra Treviño
May 12, 2026
•
[ ransomware, leak ]
Rivadeneyra Trevio was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-05-12. Sector: Other. Country: Mexico. Website: rivtrev.com. Rivadeneyra Trevio provides expert corporate legal advice, specializing in regulatory law, contract law, foreign trade, and intellectual property for national and international clients.
-
NorthWest Handling Systems
April 23, 2026
•
[ ransomware, leak, manufacturing ]
NorthWest Handling Systems was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-23. Sector: Transportation. Country: Canada. [warehouse] NorthWest Handling Systems a 55-year-old forklift and warehouse equipment company headquartered in Renton, Washington, with branches across WA, OR, and AK. The dump is the entire corporate file share going back to 1988. 337,000+ files spanning every branch, every department, every era of the company. It includes: Plaintext credit card numbers in an Excel spreadsheet literally titled C.O.D. info (CREDIT CARD INFO).xlsx stored at the root of the file server, unencrypted, for years. Social Security numbers and Taxpayer IDs on W-9 forms and certified payroll documents for government-contract work (USPS, Oregon DHS, public schools). 3+ years of plaintext passwords for Target Corporations vendor portal (TARS), stored in Word documents titled TARGET PASSWORD & SECURITY QUESTIONS. Each password rotation was saved as a new file. Home Depot Maximo DC billing credentials plaintext, in a Word document, enabling fraudulent invoicing against a Fortune 50 company. Albertsons/Safeway Corrigo facility-management portal credentials again, plaintext in a .docx file. 33 GB of customer warehouse CAD files facility layouts, equipment placement, security-zone dimensions, and fire-protection drawings for approximately 50200 companies including Nike, Google, Costco, and Umpqua Bank. 24,669 rows of fixed-asset data in ExportFile.csv the complete equipment inventory, revealing the companys financial structure, depreciation schedules, and capital-investment history. Corporate bank routing and account numbers (ACH authorization forms), employee direct-deposit details, time cards, disciplinary records, accident reports, and decades of invoices.
