-
Oilquip Inc
August 28, 2026
•
[ ransomware, energy, manufacturing ]
Oilquip Inc was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-28. Sector: Energy & Utilities. Country: United States of America. Oilquip Inc, established in 1960, is a comprehensive fluid power distributor that specializes in hydraulics, pneumatics, oil conditioning, and system integration. The company is dedicated to providing innovative electro-hydraulic and electro-mechanical solutions while exceeding customer expectations. Their services include design and engineering, fluid conditioning, power generation, and repairs and upgrades, catering to a diverse range of clients. Oilquip prides itself on its customer-focused approach, flexibility, and commitment to excellence in all aspects of its operations.
-
apatpa.com
August 17, 2026
apatpa.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-08-17. Country: Mexico. Website: apatpa.com. American Plan Administrators offers smart self-funded healthcare solutions designed to maximize savi...
-
cutlercapital
August 27, 2026
•
[ ransomware, finance ]
cutlercapital was listed as a victim on the leak site of the lynx ransomware group; the attack is estimated to have taken place on 2026-08-27. Sector: Financial Services. Cutler Capital Management, LLC of Worcester, MA is an investment advisory firm registered with the Securities and Exchange Commission, specializing primarily in investing in convertible securities, community banks and real estate investment trusts to provide growth and income to high-net-worth investors, corporations, family offices, endowments and charitable foundations. Cutler currently manages $300 million in assets.
-
BayView Real Estate
August 29, 2026
BayView Real Estate was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Retail & E-Commerce. Country: United States of America. Website: pm.livable.com. Guess your too busy focusing on your clients then changing password and protecting your clients. We breached them through pm.livable.com. You can see screenshots and file tree in the proof section. Also bleepingcomputer we will send you the data so you can confirm it too. Were not bluffing BayView Real Estate guess you guys didn't learn your lesson from the 26 million lawsuit but now you will.
The following data was stolen:
1. Corporate Identity and Admin Profiles
6 Individual Administrator Profiles: Complete web profile exports, account configurations, and visible permission mappings for six active employees:
- Breanna Tiu
- Diana Nguyen
- Elise Hou
- Jeanne David
- Wendy Wu
- Zhen Deng
2. High-Density Financial Database Dumping
- Building Statement Reports: The core database extraction file (Building-nK37xrmRYcoCMHymv-statements-report.pdf
-Sample Distribution Summaries: Multi-property accounting records detailing exactly how utility expenses are balanced and divided across real estate assets (including specialized trackers for 394 Midway Street).
3. Operational Infrastructure & Platform Playbooks
- Internal Corporate Handbooks: Step-by-step business guides detailing how money is processed and collected:
-Bill & Collect: Manuals for handling payments routed directly through Livable's platform.
-Convergent: Frameworks detailing workflows where tenants pay the property group directly.
- Software Integration Guides: Training documentation teaching personnel how to map customer data tables between platforms:
-AppFolio ID and Charges mapping logs
-Yardi system integration guides
Complete Video Tutorial Playbooks: Over 100 MB of internal instructional videos teaching how to navigate the portal, manage profiles, and export tenant lists:
-01 PM Portal Intro
-02 How to Setup a Tenant's Account
-03 How to Access the Tenant's Account
-04 How to Access the Allocation Table
-05 Move Out Processing
-06 Export tenant charges and download CSV files
-PM Portal Training - Portfolio Overview & Building Profile
-PM Portal Training - Resident Profile & Allocation Tables
-PM Portal Training - Utility Recovery Proforma, Add a Building, Export Monthly Tenant Charges
4. Tenant Communication Scripts & Branding Graphics
-Official Digital Graphics: High-resolution templates used by the company for onboarding and platform access:
-Bill & Collect Welcome Email interface maps
-Convergent Welcome Email branding templates
-Resident Portal dashboard graphical layouts
- Physical Outreach Letters:Word and PDF versions of letters sent directly to tenants regarding payments and billing statuses:
-Bill & Collect / Convergent / Net Zero Billing Tenant Welcome Letters
-Delinquency Template notification forms
-Physical Billing Statements and Net Zero Statement layouts
5. Legal Leases & Regional Utility Addenda
-30-Day Notice Templates:Legally binding notification documents used to alter tenant agreements (30 Day Notice_Billing Method Change, Notice of Supplier Change, and Notice of Supplier and Allocation Formula Change).
-Geographic Lease Addenda Collections:Specific legal attachments containing the rules and formulas for utility billing across different municipal districts:
-California Addenda (including localized frameworks for Hayward and Los Angeles)
-National Utility Addenda / US Addenda (including localized parameters for Seattle)
-Exhibit B - Submetered Water regulatory documents
-Lease Addendum Guide instructional packets
Uncompressed size: 216653153 bytes(216.6 MB)
compressed size: 78.0MB
mirror 1: https://pixeldrain.com/u/pc8VfBLf
mirror 2: https://fex.net/s/vydmesb
-
trc-companies
August 29, 2026
•
[ ransomware, leak, technology ]
trc-companies was listed as a victim on the leak site of the iah6477 ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Professional Services. Country: United States of America. Size: 4.2 TiB
-
swagelok
August 29, 2026
swagelok was listed as a victim on the leak site of the iah6477 ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Manufacturing. Country: United States of America. Size: 881.2 GiB
-
MONTCAU
August 29, 2026
•
[ ransomware, education ]
MONTCAU was listed as a victim on the leak site of the majinahanashi ransomware group; the attack is estimated to have taken place on 2026-08-29. PUBLICATION SCHEDULED. [LEAK / 6341 FILES]
-
South Pacific Hotel Limited
August 29, 2026
•
[ ransomware, retail ]
South Pacific Hotel Limited was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Hospitality. Country: Hong Kong. Website: www.southpacifichotel.com.hk/tw/index.html. The hotel has a unique glass curtain wall and an oval building appearance. The building is 28 floors high, with 293 rooms and suites.
-
AUM Construction
August 29, 2026
•
[ ransomware, manufacturing ]
AUM Construction was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Manufacturing. Country: United States of America. Website: www.auminc.us.
-
ITC Properties Group Limited
August 29, 2026
•
[ ransomware, finance, retail ]
ITC Properties Group Limited was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Other. Country: Hong Kong. Website: www.itcproperties.com. ITC Properties is an investment holding company and the Group is principally engaged in development of, selling of and investment in properties in Macau, Hong Kong, the People's Republic of China (the "PRC") and Canada; securities investments and provision of loan financing services.
-
wittmann
August 29, 2026
•
[ ransomware, manufacturing, financial ]
wittmann was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Manufacturing. Country: Mexico. Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation.NDA files
-
CareClinics
August 29, 2026
CareClinics was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Healthcare. Country: Malaysia. Website: www.careclinics.com.my.
-
BLISS 1041
August 29, 2026
•
[ ransomware, retail ]
BLISS 1041 was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Country: Malta. Website: www.bliss1041.com.
-
La Maison Des Travaux
August 29, 2026
•
[ ransomware, retail ]
La Maison Des Travaux was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Retail & E-Commerce. Country: France. Website: www.lamaisondestravaux.com.
-
The Frame Group
August 29, 2026
•
[ ransomware, retail ]
The Frame Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Retail & E-Commerce. Country: Australia. Website: www.framegroup.com.au.
-
Neumaticos Corral S.A.
August 29, 2026
•
[ ransomware, manufacturing ]
Neumaticos Corral S.A. was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Manufacturing. Country: Argentina. Website: www.neumaticoscorral.com.ar.
-
Uniguacu
August 29, 2026
•
[ ransomware, education, financial ]
Uniguacu was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Other. Country: Brazil. Website: uniguacu.com.br. full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! [Size: 151.0 MB | Sector: Education]
-
LAPoco Architects
August 29, 2026
•
[ ransomware, manufacturing ]
LAPoco Architects was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Professional Services. Country: United States of America. Website: www.laparchitects.com.
-
Bandit Industries
August 29, 2026
Bandit Industries was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Other. Country: United States of America. Website: www.banditchippers.com.
-
Neogen Corporation
August 29, 2026
•
[ ransomware, leak, manufacturing ]
Neogen Corporation was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Agriculture and Food Production. Country: United States of America. Website: neogen.com. This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 30 Aug 2026 | Warning: FINAL WARNING