-
Cropwise (Syngenta Group)
June 2, 2026
Cropwise (Syngenta Group) was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Agriculture and Food Production. Country: Switzerland. We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: https://mega.nz/folder/25hkSLgY#ELjJaFie-TfES9Z_47KFZA company url: https://operations.cropwise.com/ We are ShadowByt3$ a Extortion as a service group. You have been breached and 10.4MB was stolen. It may seem small but it can affect you every way imaginable. Don't believe us the following below was stolen: User Identities and Access Credentials - Account Directory Data: Full names, corporate email addresses, and phone numbers of registered agronomists, regional farm managers, and field staff. - Authentication Metadata: Encrypted password hashes, session tokens, or configured API keys utilized to link automated machinery data feeds to the web dashboard. Precision Agronomy and Farm Metrics - Geospatial Boundaries: High-resolution GIS boundary files detailing the exact shapes, coordinates, and property lines of privately owned or leased commercial fields. - Vegetation and Scouting Analyses: Historical NDVI satellite imagery datasets [CWO: Tools for effective monitoring of your crops' condition syngenta.co.za], past growth tracking matrices, field problem zone flags, and yield prediction models. - Operational Treatment Records: Deep operational histories documenting exact pesticide or fertilizer applications, crop types, seeding timelines, and harvesting schedules. Telematics and Fleet Diagnostics - Machinery Tracking Logs: Real-time and archived GPS location paths generated by connected tractors, combines, or sprayers. These logs map out the specific work shifts, operational speeds, and field locations of individual machine drivers. If you contact us then we won't leak it and show proof that we deleted it. Also we will tell you how to secure your company so you don't get breached again. We are giving you 48 hours (approx 3 days) to contact us which would be by June 4th 2026. If you fail to reach out to us we will maximize damage by giving it to news outlets, swatting victims, and we will email everyone affected and you would be the next headline. All you have to do is pay 1 million in bitcoin or monero and it goes away.
-
Clinica Maitenes
June 2, 2026
•
[ ransomware, healthcare ]
Clinica Maitenes was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Healthcare. Country: Chile. Website: www.clinicamaitenes.cl.
-
Wonjin Plastic Surgery
April 7, 2026
•
[ ransomware, healthcare, leak ]
Wonjin Plastic Surgery was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2026-04-07. Sector: Healthcare. Country: South Korea. Website: www.k-wonjin.co.kr. WJ Wonjin's medical staff work to achieve the optimal effect according to each individual patient's condition and desired result. Our medical services are provided by specialist doctors on-site, and our interpreting coordinators assist throughout the whole process. Safest Anesthesia System by Exclusive Anesthesiologists. We value our patients' safety during their surgery using cutting edge anesthesia system. Fully equipped with specialized medical facilities and system from the very beginning, we value safety for our patients.
-
case.law
October 1, 2025
case.law was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2025-10-01. Sector: Professional Services. Country: Philippines. Website: correction.org. Since incorporation in 1972, CRS has delivered services to a diverse group of clients, primarily in the corrections and detention fields, at the local, regional, state, and national levels. We stole passport data from over 300 customers at CRS.
-
African National Congress
August 28, 2025
•
[ ransomware, government ]
African National Congress was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2025-08-28. Sector: Government & Defense. Country: South Africa. Website: www.anc1912.org.za. The ANC is a national liberation movement. It was formed in 1912 to unite the African people and spearhead the struggle for fundamental political, social and economic change. For ten decades the ANC has led the struggle against racism and oppression, organising mass resistance, mobilising the international community and taking up the armed struggle against apartheid. The ANC achieved a decisive democratic breakthrough in the 1994 elections, where it was given a firm mandate to negotiate a new democratic Constitution for South Africa. The new Constitution was adopted in 1996. The ANC was re-elected in 1999 to national and provincial government with an increased mandate. The policies of the ANC are determined by its membership and its leadership is accountable to the membership. Membership of the ANC is open to all South Africans above the age of 18 years, irrespective of race, colour and creed, who accept its principles, policies and programmes.
-
elektroverband-bayern
May 7, 2025
elektroverband-bayern was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2025-05-07. Sector: Energy & Utilities. Country: Germany. Website: www.elektroverband-bayern.de/index.html. The State Guild Association for the Bavarian Electrical Trades is the umbrella organization of 25 Bavarian electrical guilds. It represents the interests of approximately 3,000 craft businesses from the following electrical trades: Electrical engineering trade Information technology trade Electrical machine manufacturing trade The State Guild Association offers its members comprehensive information services in the fields of business administration, technology, law, and management. It focuses on initial and continuing training, promotes the exchange of experience through regular specialist conferences and workshops as well as participation in trade fairs, conducts consistent public relations work, is responsible for negotiating collective bargaining agreements, and supports its member companies in implementing family-friendly personnel policies. Furthermore, the State Guild Association advocates for the interests of its members at the state and federal levels in a variety of ways and develops concepts for joint market activities together with industry, wholesalers, and electricity suppliers. The guiding principles of the Bavarian State Guild Association The member companies of the Bavarian State Guild Association for the Electrical Trades have adopted the following mission statement. The mission statement of the Bavarian electrical trades serves as Guidance and decision-making support for each individual member company Guidelines for the guilds and the state guild association in representing the interests of member companies Policy paper for the dissemination of information to the public The Bavarian electrical trade, with approximately 3,000 companies, around 87,300 employees, and roughly 15 billion in revenue, provides comprehensive information, planning, manufacturing, sales, installation, and maintenance of electrotechnical and electronic devices, systems, and equipment throughout the region. The three electrical trades (electrical engineer, information technology specialist, and electrical machine builder) are practiced extensively and complementarily. They are organized into electrical guilds.
-
IBENA Textilwerke
June 2, 2026
•
[ ransomware, leak, manufacturing ]
IBENA Textilwerke was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Manufacturing. Country: Germany. IBENA HEIMTEX is a family-owned textile manufacturer based in Bocholt, Germany, established in 1826. The company specializes in high-quality home textiles, including cuddly blankets, bed linen, and technical textiles for various industries. Their products cater to both consumers and businesses, with offerings such as fireproof fabrics, digital printing textiles, and car interior fabrics for renowned automotive brands. IBENA is committed to sustainability and quality, ensuring their textiles meet numerous quality standards - Nova Provide tree and samples from stolen data, free 2 files decrypt to the company when its get in touch with support department.
-
Everlite concept
June 2, 2026
•
[ ransomware, manufacturing, technology ]
Everlite concept was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-02. Country: France. Everlite Concept is a French company that specializes in polycarbonate solutions for building envelopes. It is known for its innovative, high-performance systems used in walls, roofing, and faades for buildings like sports complexes and museums - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
-
Cambridge Mobile TelematicsNEW
June 2, 2026
•
[ ransomware, technology, leak ]
Cambridge Mobile TelematicsNEW was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Technology. Country: United States of America. [AI generated] Cambridge Mobile Telematics (CMT) is a US-based technology company headquartered in Cambridge, Massachusetts. It operates in the telematics and insurtech industry, providing mobile sensing and data analytics solutions. CMT specializes in measuring driving behavior using smartphone sensors and AI to help insurers, fleets, and enterprises improve road safety and reduce risk through usage-based insurance and driver safety programs.
-
elections.mia.gov.am from WOLVES OF TURAN
June 2, 2026
elections.mia.gov.am from WOLVES OF TURAN was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Government & Defense. Country: Armenia. Hello, dear visitors of Bashe's blog. Today, we contacted the Turkish Wolves of Turan group and b...
-
Stellar
May 31, 2026
•
[ ransomware, technology, leak ]
Stellar was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-05-31. Country: Turks & Caicos Islands. Website: www.stellar.tc. Stellars mission is to bring resilient connectivity to mobility, enterprise, and governments, by combining the very best of terrestrial (cellular, Wi-Fi, fiber) and satellite networks into one unbreakable solution.Stellar Telecommunications SAS ("Stellar"), was founded in 2021 as a truly European company: headquartered in Bordeaux, France, it also runs critical activities from Luxembourg.- Database- Production Config https://www.stellar.tc/
-
Cold Front Distribution
June 2, 2026
•
[ ransomware, manufacturing ]
Cold Front Distribution was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Transportation. Country: United States of America. Website: https:coldfrontdist.com. Cold Front Distribution is a leading DSD supplier specializing in grocery and foodservice supply chain solutions across a fifteen-state region. Due to their negligence in the area of security, we are providing you with a complete set of confidential documents, specifically the pricing grids of major partners sold through the Cold Front system, discount agreements, information on new product launches, and other confidential partner documents, as well as personal information about employees and the companys financial status...
-
www.transbras.com.gt
June 2, 2026
•
[ ransomware, manufacturing ]
www.transbras.com.gt was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Transportation. Country: Guatemala. Website: www.transbras.com.gt. Founded in 1974, started its activities in Road Transport, eventually expanding its services to several other areas, fir...
-
activ88-interim.com
May 30, 2026
activ88-interim.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: Germany. Website: activ88-interim.com. Activ'Interim 88 was founded in 2008 with the aim of connecting job seekers with the best opportunities available in the...
-
Nova Medical Products
June 2, 2026
•
[ ransomware, healthcare ]
Nova Medical Products was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Healthcare. Country: United States of America. Website: www.novajoy.com.
-
iql-nog.com
May 21, 2026
•
[ ransomware, manufacturing ]
iql-nog.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-05-21. Country: Spain. Website: iql-nog.com. Founded in 1947, the company specializes in the production of oleochemical products, particularly fatty acid esters and specialty chemicals derived
-
trrac.net
May 28, 2026
•
[ ransomware, manufacturing ]
trrac.net was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Transportation. Country: United States of America. Website: trrac.net. 150gb
-
katholiekamersfoort.nl
June 2, 2026
•
[ ransomware, leak, education ]
katholiekamersfoort.nl was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Education. Country: Netherlands. Website: katholiekamersfoort.nl. The church website's network (katholiekamersfoort.nl/) has been breached, resulting in the exfiltration of over 10 GB of data. This data pertains to donors, staff, and the personal information of a large number of individuals. The compromised data includes: Databases and Personally Identifiable Information (PII), internal network shares and document, contact lists, board and committee data, as well as system metadata.
-
Lead Company (Leadership Boulevard)
June 3, 2026
•
[ ransomware, education, leak ]
Lead Company (Leadership Boulevard) was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-06-03. Sector: Professional Services. Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated folders include: - Arya Vidyapith - Aakarsh International Public School - Students High School - Rainbow International Matric Hr. Sec. School - Vignan Private School The following info was stolen: 1. Personally Identifiable Information (PII) of Students - Full Names and Demographics: Complete names of children sorted by gender and admission numbers. - Academic Progression: Exact tracking of student grade levels (e.g., SKG, Class 1, Class 2) and division assignments - Age and Vital Records: Exact dates of birth (DOB) for all enrolled students. - Physical Locations: Full residential addresses, cities/districts (such as Nampally, Telangana), and exact localized postal pincodes 2. Guardian and Parent Contact Registries - Parent Identity: Full names of both fathers and mothers linked directly to their children. - Direct Contact Methods: Active personal mobile numbers for parents, creating a severe vulnerability for automated spam or voice-phishing attacks. - Digital Contact: Parent email addresses intended for formal school updates. - Student Led Events - Teacher Certificates - gac-reports - Assessments 3. Proprietary LEAD School Academic Metrics - ELGA Placement Data: Internal academic tracking metrics, showing specific curriculum tiers like "ELGA Class" (e.g., ELGA02, ELGA06) and "ELGA Division" for individual students. - Classroom Analytics: Operational performance data exfiltrated directly from the nucleus.leadschool.in administrative portal. - Teacher Resources: Lesson plans, training modules, and classroom resources that form the core commercial assets of the LEAD platform.
-
acehospital.in
June 3, 2026
•
[ ransomware, healthcare ]
acehospital.in was listed as a victim on the leak site of the killsec ransomware group; the attack is estimated to have taken place on 2026-06-03. Sector: Healthcare. Country: India. Website: acehospital.in. Price ??? Disclosures 0/1
