Full List

Search

Recent Breaches

• The Liberty Group August 24, 2026 • [ ransomware, retail, financial ] The Liberty Group was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-24. Country: United States of America. Website: libertygrp.com. About The Liberty Group Companys offerings include local, long distance, and international moving, lab relocation services, and logistics solutions. They cater to a diverse range of clients, providing professional and comprehensive assistance to both residential and commercial customers. Investigators are working to identify the perpetrators and assess the full scope of the damage. A company has suffered a major cyberattack resulting in the theft of approximately 27,000 internal files. The leaked documents include financial records, internal working materials, and personal data of employees. Attackers encrypted the company's systems following the breach, severely disrupting operations
• lagegepesca.it August 24, 2026 • [ ransomware, retail ] lagegepesca.it was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Agriculture and Food Production. Country: Italy. Website: lagegepesca.it. Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small
• FBC August 24, 2026 FBC was listed as a victim on the leak site of the Deadlock ransomware group; the attack is estimated to have taken place on 2026-08-24. Country: South Africa. Website: furnbed.co.za. Furniture Bargaining Council in South Africa. This is the tariff council for the furniture, mattress and upholstery industry.The platform serves employers and employees in the industry in regions such as Gauteng, North West, Mpumalanga, Limpopo and the Free State to handle legal and administrative processes.
• SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA August 24, 2026 • [ ransomware, leak, finance ] SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA was listed as a victim on the leak site of the Deadlock ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Professional Services. Country: United States of America. Website: slgjustice.com. Family law firm, established 1995 by Victor A. Shaheen (2025 - the General Assembly of Virginia honored him with a resolution; google it, it is touching). Now run by his three sons. 48 employees across four offices: Richmond, Midlothian, Virginia Beach, Newport News. What do they do? They close 150+ real estate transactions EVERY MONTH for some of the largest corporate relocation programs in America. When a Fortune-500 moves an employee to Virginia, this firm holds that employee's Social Security Number, bank wiring details, home address, family identities, and sometimes their medical clearance. They hold everyone's future in a shared folder. We now hold the folder. WHAT WE TOOK 36,788 files 27GB 21,789 fully read 67,000+ SSN patterns (their own dedup says 6,017 real people we will let their customers decide which number to believe) EVIDENCE SERIES PREVIEW (from their actual files) - S1 DEEDS WITH SOCIAL SECURITY NUMBERS File: "5053815 - Unsigned Deed.docx" (verbatim from their server): "***-**-XXXX B H Social Security Number ***-**-XXXX J H Social Security Number 10356 Ashburn Road, North Chesterfield, VA 23235" File: "Kelley 5042085 - DEED.docx": "PURCHASER(S): N S SELLER'S NAME: S E. K SS#: ***-**-XXXX ...including the withholding of twenty percent (20%) of the sales proceeds." FIRPTA: foreign sellers. IRS will want this list. We have it. Thousands of these. Every deed folder = a name, a number, an address, a transaction. Their client roster IS the leak. - S3 INSIDE THEIR BANKING & THEIR NETWORK File: "shared_Accounting/Banking/Other Banking/Shaheen DDA Statements SunTrust DDA" (email from SunTrustOnlineCourier to their own staff headers verbatim): Received: from barracuda.shaheenlaw.com ([10.0.0.6]) by ricdcex1.shaheenlaw.com ... X-ASG-Debug-ID: 1291233029-... for ; Wed, 1 Dec 2010 Why we publish an email HEADER: their internal map is in it. Barracuda at 10.0.0.6. Exchange "ricdcex1". Domain SHAHEENWORLD. We did not forget how to enter. Neither will the next group, when we sell the map. 150 banking statement attachments ride along in this folder. - S5 THE CLIENT LIST, WRITTEN IN FOLDERNAMES They named folders after their customers. Verbatim paths: shared_PENDING_SALE/HENNY/Closed Files/ Wisniewski-Markel, Suzanne_5027384_12263 Eagle ... Merza, Jamal & Adrienne_5027826_811 Woodberry ... Name, file number, STREET ADDRESS in the path itself. Marketing lists sell for money. This one is annotated with purchase history. Relocation buyers are premium leads. - S2 MEDICAL - S4 LITIGATION Held. 120 medical files exist (their own audit counted them). Litigation: we confirm their December escrow dispute is public (Porchlight Homes v. Almeida & Shaheen, Henrico google it, BizSense covered it). Virginia residents: 18.2-186.6. Illinois relocations: BIPA. Opposing counsel and journalists: samples on request. Media & researchers: samples on request, we answer fast We keep our word to everyone who pays. We keep it also to everyone who does not.
• Consultores de Seguros August 24, 2026 • [ ransomware, finance ] Consultores de Seguros was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Financial Services. Website: www.consegsa.com.
• Cosmon August 19, 2026 • [ ransomware, technology ] Cosmon was listed as a victim on the leak site of the beast ransomware group; the attack is estimated to have taken place on 2026-08-19. Sector: Technology. Country: United States of America. Website: www.cosmon.com. Cosmon develops agentic artificial intelligence software for mechanical engineering workflows, centered on its Nexus product for CAD, CAE, simulation, and PLM tasks. Its website presents the company as a software provider whose platform automates drawing creation, simulation setup, troubleshooting, design validation, and product lifecycle data tasks while integrating directly with major engineering tools. Although the offering is deeply technical and tailored to engineering environments, the core business shown is the development and delivery of proprietary engineering software rather than providing outsourced engineering services or general consulting. https://cosmon.com https://www.zoominfo.com/c/cosmon/5000578320
• Dentist in New Britain, CT August 25, 2026 • [ ransomware, healthcare, leak ] Dentist in New Britain, CT was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Healthcare. Country: United States of America. Website: dentistinnewbritain.com. About Dentist in New Britain, CT Dentist in New Britain has spent over a decade caring for families across New Britainpairing modern technology with the kind of warmth you don't expect from a dental office. As a result of the attack, the following were compromised: the entire customer database, consisting of just over 8,000 files, as well as a small number of records containing Social Security numbers
• Pump Engineering Company August 25, 2026 • [ ransomware, manufacturing, leak ] Pump Engineering Company was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Manufacturing. Country: United States of America. Website: www.pumpengineering.net. About Pump Engineering Company Pump Engineering Company is a full-service distributor and supplier of industrial pumps, parts, and fluid handling systems, serving Southern California since 1946. During the cyberattack, 120,000 files (115 GB) were stolen, including an extensive customer database, insurance documents, confidential financial documents, and a vast number of project drawings.
• AGROLAND S.A. August 25, 2026 • [ ransomware, manufacturing ] AGROLAND S.A. was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Agriculture and Food Production. Country: Romania. Website: www.agroland.com.
• Davis & Ferber October 8, 2025 • [ ransomware, leak ] Davis & Ferber was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-10-08. Sector: Professional Services. Website: davisferber.com. Davis & Ferber LLP is a personal injury and malpractice law firm based in New York, specializin g in various legal areas including medical malpractice, motor vehicle accidents, nursing home a buse, and family law. We will upload 60gb of corporate data soon. Detailed personal client information (passports, DL s, addresses, SSNs, death/birth certs, phones and so on for almost a thousand people), confiden tial files, court files, hearings, police reports, NDAs, etc.
• STRUCTURED SETTLEMENT CAPITAL LLC August 25, 2026 STRUCTURED SETTLEMENT CAPITAL LLC was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Financial Services. Country: United States of America. Website: www.123lumpsum.com.
• WINTER Ingenieure August 11, 2026 • [ ransomware, manufacturing, leak ] WINTER Ingenieure was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-11. Sector: Manufacturing. Country: Germany. Website: winter-ingenieure.de. WINTER Ingenieure specializes in planning and monitoring the construction of technical building equipment across Germany, focusing on functionality, sustainability, and cost-effectiveness. W ith a team of over 140 employees located in Dsseldorf, Berlin, and Hamburg, they integrate tec hnical components into buildings innovatively. We will upload 340gb of corporate data soon. Employee personal information (German passports, I Ds, addresses, phones contacts), confidential files, projects, lots of specifications and so on .
• S******* August 24, 2026 • [ ransomware, technology ] S******* was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-08-24. Website: .. An International Public Company
• Knottingham Trent University August 25, 2026 Knottingham Trent University was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: ntu.ac.uk. We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access after stealing the following below High-Risk Sensitive PII - Passport Numbers & Details: Stolen via the raw PDF copies of the applicants' physical passports - Dates of Birth: Specifically exposed on the main data profile screen - Nationalities & Countries of Birth: Confirmed via the legal passport logs and the registration metadata fields. Contact & Location PII - Full Legal Names: Animesh Shukla and Abhinand Unnikrishnan - Personal Email Addresses: Exposed via the portal login view (`amita.shukla@leveragemails.com`). - Mobile Phone Numbers: Explicitly collected on the dashboard contact view (`7080809422`). - Permanent & Correspondence Home Addresses: Complete street-level addresses mapping out exact house numbers, apartment complexes, districts, and postal ZIP codes spanning across Lucknow (226001) and Delhi (110024). Academic & Professional History PII - While non-sensitive on its own, hackers use this deeply personal context to write highly convincing scam letters - Complete Academic History: Stolen via the raw transcript files (`Degree Transcript.pdf` `10TH`, and `12TH` grade completion papers), showing exact grade percentages, modules studied, and prior school names. - Employment & Professional History: Stolen directly out of the `CV.pdf` file, mapping out their previous job titles and career timelines - Professional Reference Names: Stolen via the Letters of Recommendation (`LOR.pdf`), which reveal the names, titles, and institutions of the professors or employers who recommended them. mirror 1: https://anonfilesnew.com/s/FXB5-I_XtWl mirror 2: https://pixeldrain.com/u/XXWv2geH This is a warning to all companies to comply it's that easy and simple. If you don't we will leak you and ruin your reputation and make sure that everyone abuses your companies data.
• A-Plus Software Limited August 25, 2026 • [ ransomware, sqlinjection, technology ] A-Plus Software Limited was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.a-plussoft.com. We Breached A-plus through a sql injection vulnerability and downloaded everything in there backend. We gained access to there system on 08/18/2026 The following data was stolen: 1. Website User Data (`usr.csv`) - This file contains the administrative backend infrastructure for the website, exposing: - 10 internal accounts, including the usernames `admin`, `debuger`, `camby`, `asuka`, `jimmy`, `ricole`, and `green`. - Password hashes (SHA-1 format) revealing that almost all administrative users shared the exact same password. - Internal access metadata 2. Marketing and Public Web Content - The remaining four files contain the text, configuration, and structural layout used to display information to visitors on `a-plussoft.com`: `- products.csv` 13 lines): The master list of software solutions and mobile apps sold by the company (such as SalesAnywhere). `- product_content.csv` (101 lines): The detailed marketing descriptions, features, specifications, and text modules displayed on individual product pages. `- news.csv` (89 lines): The text content of all historical corporate announcements, updates, and press releases published by the company. `- news_cate.csv` (2 lines): The category organization tags used to sort the news section on the website Uncompressed size total records: 211 2,787,292 Bytes, which equals 2.6582 Megabytes (MB). mirror 1: https://anonfilesnew.com/s/XtgbXhRkQQ8 mirror 2: https://pixeldrain.com/u/jUpuUyj9
• Sinar Mas Agribusiness and Food Golden Agri-Resources) August 25, 2026 • [ ransomware, leak, manufacturing ] Sinar Mas Agribusiness and Food Golden Agri-Resources) was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Agriculture and Food Production. Country: Indonesia. Website: www.smart-tbk.com. We Breached This company a few months ago. we stole 375.66MB. mirror 1: https://anonfilesnew.com/s/4t-mBJg9wMy More info is on darkforums.ru about this leak.
• Lockheed Architectural Solutions, Inc. August 25, 2026 • [ ransomware, manufacturing, government ] Lockheed Architectural Solutions, Inc. was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Government & Defense. Country: United States of America. Website: lockheedsolutions.com. Country: Pascoag, RI 02859, United States | Website: lockheedsolutions.com | Revenue: $31.2 Million | Industry: Manufacturing, Construction, Building Materials | Employees: 100-200 | Properties: 1.3 TB (558,462 Files, 97,835 Folders)
• Johnson City Honda August 25, 2026 • [ ransomware, retail, automotive ] Johnson City Honda was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Retail & E-Commerce. Country: United States of America. Website: johnsoncityhonda.com. Country: Tennessee, United States | Website: johnsoncityhonda.com | Revenue: $6,5 Million | Industry: Automobile Dealers | Employees: 11-50 | Properties: 32.9 GB(34,277 Files, 8,896 Folders)
• Tiseo Paving August 25, 2026 Tiseo Paving was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Transportation. Country: United States of America. Website: tiseopaving.com. Country: Texas, US | Website: tiseopaving.com | Revenue: $22.6 Million | Industry: Construction, Commercial & Residential Construction | Employees: 50-100 | Properties: 457 GB (83,932 Files, 10,829 Folders)
• Studio Legale ESE August 25, 2026 • [ ransomware, finance ] Studio Legale ESE was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Professional Services. Country: Italy. Website: studiolegaleese.it. Law Firms , Legal Services