-
tokyocivil.co.jp
June 15, 2026
tokyocivil.co.jp was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Professional Services. Country: Japan. Website: tokyocivil.co.jp. Established in 2020, the company specializes in public infrastructure and civil engineering projects, serving primarily the Tokyo metropolitan area and
-
hughstirling.co.uk
May 5, 2026
•
[ ransomware, technology ]
hughstirling.co.uk was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Professional Services. Country: Germany. Website: hughstirling.co.uk. Headquartered in Goslar, Lower Saxony, the firm has been operating since 1975 and has expanded its presence through additional offices
-
glendale.edu
June 15, 2026
•
[ ransomware, education, leak ]
glendale.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: glendale.edu. Over 62 gigabytes of Glendale Community College data (304,000+ files) was compromised across PeopleSoft Campus Solutions (GCC, integrations, financial aid, and admission processing), including 150,000+ student records with names, dates of birth, and @student.glendale.edu emails, login and enrollment mapping files, new student enrollment CSVs, immunization compliance logs, admission checklist reports, financial aid batch exports, and transcript PDFs spanning September 2020 through June 2026. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
-
moody.edu
June 15, 2026
•
[ ransomware, education, technology ]
moody.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: moody.edu. Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
-
icc.edu
June 15, 2026
icc.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: icc.edu. Over 28 gigabytes of Illinois Central College data (122,000+ files) was compromised across PeopleSoft Campus Solutions and Human Resources (ICC, SURS pension reporting, Workday costing, and ICCB curriculum systems), including 9,200+ employee payslip PDFs, 500+ SURS payroll files with Social Security numbers, direct deposit records with bank account and routing numbers, student financial aid and grade roster exports, enrollment CSVs with @icc.edu accounts, and Workday salary allocation data spanning 2021 through June 2026. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
-
smithassociatescpa.com
June 15, 2026
•
[ ransomware, finance, hack ]
smithassociatescpa.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Professional Services. Country: United States of America. Website: smithassociatescpa.com. smithassociatescpa.com
Smith and Associates is a Certified Public Accounting Firm based in Maine, offering a comprehensive range of services including accounting, auditing, tax planning, and management advisory services. The firm caters to a diverse clientele, including individuals, corporations, partnerships, and non-profits in Maine and New Hampshire. They provide specialized support for business start-ups and QuickBooks, along with professional consulting in various areas of tax and accounting practices. Established in 1987, Smith and Associates is committed to being personable, knowledgeable, and responsive to their clients' needs.
-
Kedah
June 16, 2026
•
[ ransomware, government ]
Kedah was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-16. Country: Malaysia. The Kedah State Government operates an official corporate portal that provides information and services to the public, businesses, and tourists. It offers various services including online transactions, customer satisfaction surveys, and updates on government policies. The portal also features sections dedicated to tourism, education, and corporate financing, aiming to enhance the quality of life for residents and visitors. Its intended clients include citizens of Kedah, local businesses, and tourists seeking information about the state - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
-
Q Link Wireless
June 16, 2026
•
[ ransomware, technology ]
Q Link Wireless was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Technology. Country: United States of America. Website: www.qlinkwireless.com.
-
Misericórdia de Santo Tirso
June 16, 2026
•
[ ransomware, healthcare ]
Misericrdia de Santo Tirso was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Healthcare. Country: Portugal. Website: www.iscmst.pt.
-
ECOVACS
June 1, 2026
•
[ ransomware, retail, technology ]
ECOVACS was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-06-01. Sector: Retail & E-Commerce. Country: China. Website: www.ecovacs.com. ECOVACS is a highly successful Chinese robotics company founded in 1998 in Suzhou. It has grown into a global leader in smart home cleaning solutions, with its products sold in over 145 countries and trusted by tens of millions of users worldwide.The company is best known for its award-winning DEEBOT robot vacuums, WINBOT window cleaners, GOAT robotic lawn mowers, and other intelligent cleaning devices powered by advanced AI and navigation technologies.Driven by the vision Robotics for All, ECOVACS continues to innovate and expand rapidly, making premium home robotics accessible and effective for everyday consumers.About 2 TB of stolen data. https://www.***.com/
-
SPORTON International Inc.
June 16, 2026
•
[ ransomware, manufacturing, technology ]
SPORTON International Inc. was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Manufacturing. Country: Taiwan. Website: sporton.com.tw. Founded in 1986 and headquartered in Taiwan, Sporton International is a Taiwan-based company principally engaged in the provision of testing and certification services for wireless communications and mobile communications products.
-
TINYpulse NINTENDO BREACH
June 16, 2026
•
[ ransomware, technology ]
TINYpulse NINTENDO BREACH was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Technology. Country: Japan. Website: nintendo.com. This will be quick. You don't even want to read the private messages as some will be embarrasing. Some people are confused but this breach doesn't affect you unless if you use tinypulse and work for nintendo. There will be more victims coming soon. If you get a email by us. by us we mean are only email on are leak site, then respond or it will get leaked. We will send file trees for confirmation to prove we actually breached your company. It's pretty funny how companies are defending themselves and when the truth comes out now they want to stay quiet. We have no further questions to answer. This is a warning to all companies if you get breached by us, It's best to contact us especially if we show you the file size. This was true negligence and now you will likely face a massive lawsuit, have fun tinypulse and told you this would be quick. uncompressed file size: (856MB) compressed size: (6.89MB) The included data includes: - full name, first name, last name, email (the w9 is only one and multiple invoices) - Private Employee Chats: Direct internal messages and conversations between workers. - Mar 10, 2025 Sure, it's Knowledge Teamwe've needed more content creators for years, but it seems all we can ever get approved are more associates, often temporarily. This helps some, and I know there are vague rumors that maybe we will be able to swap our associates over to NOA employees in the future, but that's not what we needwe need more writers so that we can distribute the primary work among more people. overworking chat: Sep 22, 2025 How happy are you at work? 3 I'm generally extremely content, but the overwhelming number of overlapping high-priority projects and a constant stream of meetings, has left me with little to no available occupancy. This has made it tough to manage everything effectively and still make time for innovation.
-
thecreditpros.com
June 16, 2026
•
[ ransomware, financial, technology ]
thecreditpros.com was listed as a victim on the leak site of the Icarus ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Financial Services. Country: United States of America. Website: thecreditpros.com. TheCreditPros' Salesforce instance was breached and 263MB of data were taken from it, including:
01_input_fullcards.csv - 51,691 lines of full-info credit/debit cards: Id,First_Name__c,Last_Name__c,Middle_Name__c,Email__c,Credit_Card__c,CCV__c,Exp_Month__c,Exp_Year__c,SSN__c,DOB__c,Street_Address__c,City__c,State__c,Zip_Code__c,Mobile_Number__c,IP_Address__c,Transaction_ID__c,Status__c,CreatedDate
02_contacts_ssn.csv - 847,990 lines: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,HomePhone,SSN_hidden_field__c,Birthdate,MailingStreet,MailingCity,MailingState,MailingPostalCode,Status__c,Bank_Account_Number__c,Bank_Name__c,Bank_Account_Type__c,CreatedDate
03_creditcards.csv - 722,403 lines: Id,Card_number__c,card_number_hidden__c,cvv__c,expiration_month__c,expiration_year__c,Active__c,BIN__c,Issuing_Bank__c,Prepaid__c,CreatedDate
04_leads.csv - 3,598 liens: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,Street,City,State,PostalCode,Status,CreatedDate
Pay or leak!
Data stolen: PII, Credit cards
-
Sunass
June 16, 2026
Sunass was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Energy & Utilities. Country: Peru. SUNASS is a public regulatory body established by Law Decree No. 25965, with legal personality and administrative, functional, technical, economic, and financial autonomy. The organization focuses on regulating and overseeing water supply and sanitation services in Peru. Its intended clients include service providers in rural areas and small cities, as well as the general public seeking information and assistance regarding water and sanitation services. SUNASS also engages in educational programs and campaigns to promote water conservation and proper sanitation practices - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
-
Golfview Developmental Center
June 16, 2026
•
[ ransomware, healthcare ]
Golfview Developmental Center was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Healthcare. Country: United States of America. Website: www.golfview.org.
-
Insite Architects
June 16, 2026
Insite Architects was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Professional Services. InSite Architects was founded in 2002 as a firm dedicated to the design and planning for senior
and affordable housing. It is our belief that every project is as individual as the client, pr
ogram, and site.
We will upload 65gb of corporate data soon. Employee personal information (passports, SSNs, DLs
and other personal docs), credit cards information, projects, clients and partners info, etc.
-
Tecfi SpA
June 15, 2026
•
[ ransomware, manufacturing, technology ]
Tecfi SpA was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Professional Services. Country: Italy. Website: tecfi.it. Tecfi is a company specialising in the design, production and sale of fastening systems. Going into more detail, three production lines can be highlighted. Plastic and rubber moulding Sheet metal moulding with blanking Cold stamping and flatbed rolling machines
-
Ralph Lauren
June 16, 2026
•
[ ransomware, leak, retail ]
Ralph Lauren was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Retail & E-Commerce. Country: United States of America. Website: ralphlauren.com. Over 220GB of data containing customer PII, purchase/trasnaction info, future unreleased releases from 2027 and onward, and more was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Size: 163GB+ (compressed) | Updated: 16 June 2026 | SHA256: 17a7af9c00ea38ce822e2f022c0ceb5149535610a15f009b866d616e70cbf7e2
-
Sumitomo Electric Bordnetze
June 16, 2026
Sumitomo Electric Bordnetze was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Manufacturing. Country: Germany. [electric] *** SE (SEBN) a Wolfsburg-headquartered subsidiary of Sumitomo Electric Industries (TSE:5802, ~$31B group revenue), employing approximately 40,000 people across 14 countries. Exfiltrated 1.1 terabytes of data from five manufacturing sites.
SEBN Moldova (103 GB) HR, payroll, personal tax records, competition-council litigation files, home directories
SEBN Ukraine (115 GB) HR/salary, Audi B9 project data, process documentation, including displaced-worker records for Ukrainian IDPs
SEBN Tunisia Fejja (191 GB + 493 GB shared) passport copies, email archives (671 MB PST), quality/FMEA data, finance
SEBN Slovakia (268 GB) the crown jewel: Citibank corporate banking infrastructure including the TESTKEY authentication system, IBAN registries, daily bank statements, SAP salary-payment files, and years of department email archives
The dataset contains 173,000 Excel files, 149,000 PDFs, 2,500 CAD engineering drawings, 2,500 Outlook messages, 1,500 FMEA/PPAP quality files, and 9 Outlook PST archives.
-
Diamond Truck Centres
June 16, 2026
•
[ ransomware, leak, manufacturing ]
Diamond Truck Centres was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Transportation. Country: Canada. [dealership, trucks] *** Western Canada's largest International Trucks dealership group (9 dealer + 13 sub-dealer locations, ~$63M revenue, 250 employees).
The dataset spans 17 years of unbroken operational history (20092026) and represents the full shared-drive contents of the entire company: HR, payroll, accounting, military contracts, and individual employee profiles.
The exposed material includes:
53 customer Pre-Authorized Debit (PAD) forms full bank account numbers, transit numbers, institution numbers, and authorized signatures for commercial customers including the City of Saskatoon.
17 years of employee payroll data wages, SINs (implied), pension contributions, benefits, termination calculations for every employee since 2009.
Biometric data ADP fingerprint timeclock enrollment records for all locations.
Immigration documents for 6+ foreign workers LMIA applications, offers of employment, provincial nominee support docs.
System credentials in plaintext ADP timeclock passwords, manager training logins, safe combination.
Military contract documentation Diamond's Controlled Goods Security Plan (ITAR/CGP), MSVS delivery matrices, military vehicle VINs, CFB Edmonton and RCMP vehicle program data.
289 GB of daily bank deposit scans (20172026) customer cheque images with names, amounts, and account details.
A complete Outlook PST archive (166 MB) years of internal email likely containing credentials and customer data.
