-
Arkın Group / Arkın Casino, The Arkın Colony, The Arkın Iskele, and Arkın Palm Beach
June 30, 2026
Arkn Group / Arkn Casino, The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Hospitality. Country: Turkey. Website: arkingroup.com. CYBERSECURITY: ARKIN HOTEL GROUP SUFFERS MASSIVE DATA BREACH OVER 1 TB OF GUEST AND CASINO DATA STOLENCybersecurity experts from Cyclops Threat Intelligence have reported a critical incident affecting the Arkn Group hotel chain (www.arkingroup.com), including its premium properties The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach in Northern Cyprus. According to preliminary assessments, the attackers managed to exfiltrate over one terabyte of internal documents, customer databases, and transaction logs, including confidential information from the Arkn Palm Beach Casino.Attack detailsAnalysts have established that the attackers gained initial access through a compromised employee account in the reservations department. Using legitimate remote administration tools, they gradually expanded their privileges, bypassed network segmentation, and exfiltrated a dataset totalling approximately 1.4 TB. Some of the stolen information has already surfaced on underground forums and darknet marketplaces.The stolen data includes: Full guest profiles (passport details, phone numbers, addresses, stay history); Financial details of bookings and payment credentials; The internal CRM system with staff notes on VIP clients; Casino database: player IDs, deposit amounts, visit frequency, records of chip exchange transactions and fund movements; Scanned passports, compliance check forms (KYC/AML), including source-of-funds questionnaires for high rollers.Objective and likely operatorBased on the intrusion characteristics and tactics used, experts link the incident to the threat group CryptoRex (tracked since 2023), which specialises in attacking hospitality and gambling businesses in the Mediterranean region. A combination of financial extortion and data sale to multiple buyers is considered likely. So far, no official ransom demand has been received, but portions of the archives have been put up for auction with a starting price of 8 bitcoins.Potential consequences of the leakThe leakage of confidential guest and especially casino client data entails a cascade of risks that go far beyond reputational damage.1. Personal security of high-net-worth guestsThe VIP casino player database, containing passport details, habits, and financial capabilities, serves as a direct directory for kidnappers, extortionists, and organised crime groups. Affected individuals may face real threats to their physical safety, as well as targeted blackmail (e.g., threats to expose gambling activity to business partners or family members in countries where gambling is stigmatised).2. Financial fraudPayment data from hotel guests and credit/debit cards linked to casino accounts will enable unauthorised transactions. Given the high credit limits of casino patrons, the scale of potential phishing and card fraud is assessed as very significant.3. Compliance nightmare and regulatory finesAlthough the international casino operators in Northern Cyprus do not directly fall under GDPR, many guests are citizens of the EU, the UK, and CIS countries. The breach demonstrates a flagrant failure to meet personal data protection standards. Lawsuits by affected individuals in national courts and scrutiny by international payment systems (Visa, Mastercard) are possible, which could suspend acquiring services.4. Risks to the casino itself and the jurisdiction[6/9/2026 1:09 PM] ChatGPT 5 | Deepseek | Claude: The exposure of internal AML records documenting the origin of funds and possible links to politically exposed persons could spark money-laundering investigations. For Northern Cypruss gambling zone, already under close watch by the FATF, this could lead to tighter international financial monitoring and being placed on grey lists.5. Reputational ruinNo wealthy client will entrust their data to a hotel incapable of protecting basic IT infrastructure. Trust in the Arkn brand, which for decades has built an image of secluded luxury, will be undermined for years. Competitors in the elite leisure market, especially in Dubai, Monaco, and the Maldives, will immediately exploit the situation to poach wary clientele.Analysts recommendationsCyclops Threat Intelligence strongly advises all individuals who have ever stayed at Arkn hotels or visited Arkn Palm Beach Casino to: Immediately block and reissue any bank cards used; Monitor credit reports for new applications; Enable additional authentication factors on email and financial services; Be highly critical of any incoming calls or messages demanding identity confirmation or fund transfers these could be targeted attacks using contextual details from the leaked staff notes.The Arkn Group press office has not yet responded to official inquiries. The companys website remains operational, but online booking sections are temporarily unavailable. Northern Cyprus authorities stated that they are aware of the incident and have begun consultations with EU experts under a cyber-resilience programme.Report prepared by the Thomson Reuters cybersecurity desk based on the Cyclops Threat Intelligence analytical brief.
-
Loyalist College
August 4, 2026
•
[ ransomware, leak, education ]
Loyalist College was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Education. Country: Canada. Website: loyalistcollege.com. The management of this institution was repeatedly warned about the disclosure of hundreds of personal data. Each of you who is faced with the consequences of the leak can be absolutely sure that the management of Loyalist College absolutely does not care about its students, employees and partners.
-------------------------
Loyalist is Ontario's Destination College, empowering students, faculty, staff, and partners through experiential, industry cluster-based education, training and applied research programs. The College provides job-ready graduates for, and knowledge transfer to, industry and the community.
-
lantisnet.com
August 4, 2026
lantisnet.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Technology. Country: United States of America. Website: lantisnet.com. Lantis Enterprises, Inc. is an American consulting and management organization historically rooted in rural healthcare, skilled nursing, and senior living operations. Headquartered in Spearfish, South Dakota, the firm has expanded its focus to cross-industry advisory services
-
FixIT Tek
August 5, 2026
•
[ ransomware, hack, technology ]
FixIT Tek was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-08-05. Sector: Technology. Country: United States of America. Website: fixittek.com. Providing the best possible IT services to businesses of all sizes in Central Florida and Surrounding Areas. ##### FixIT Tek's Syncro MSP panel has been hacked and stolen big data of many clients from their network. #####
-
PT All Cosmos Biotek
August 5, 2026
•
[ ransomware, healthcare, technology ]
PT All Cosmos Biotek was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-08-05. Sector: Healthcare. Country: Indonesia. Website: allcosmos.com. Sector: Agricultural Biotechnology & Fertilizer | Revenue: US$ 5,000,000
-
PontoBR Sistemas
August 5, 2026
•
[ ransomware, technology, government ]
PontoBR Sistemas was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-08-05. Sector: Technology. Country: Brazil. Website: pontobrsistemas.com.br. Founded in 2008 in Brazil, PontoBR Sistemas is an IT firm specializing in advanced call center technologies, including its proprietary Discador Tabulare,as well as public examination management systems. The company provides tailored software solutions and IT infrastructure services, having received recognitionfrom the Brazilian federal innovation agency, FINEP.-SQL Data https://pontobrsistemas.com.br/
-
Mile Bluff Medical Center
June 8, 2026
Mile Bluff Medical Center was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-06-08. Sector: Healthcare. Country: United States of America. Website: www.milebluff.com. About Mile Bluff Medical Center Located in Mauston, Wisconsin, Mile Bluff Medical center has been in operation since 1912. Its services include acute emergency care, as well as long term nursing and rehabilitation A "Mile Bluff Medical Center" company suffered a cyberattack leading to the theft of over 550 GB of sensitive data. Exposed files include a full SQL database backup, employee records, confidential company financial information, bank records, patients' personal documents, Social Security numbers, medical records, medical histories, and surgical records. As a result, the personal data of more than 25,000 patients and staff members was leaked. Download here: http://7iphetz64a7iihcpwr3nirjioghyt6lrku62gu4z7f3zo7rcz5qrgvad.onion/
-
Reid Electric Service, Inc
August 4, 2026
•
[ ransomware, energy, leak ]
Reid Electric Service, Inc was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Energy & Utilities. Country: United States of America. Website: reidelectricservice.com. About Reid Electric Service, Inc At Reid Electric Service, Inc. we realize the safety, and reliability of your electrical system is important to you. We take pride in exceeding your expectations to perform work on your electrical system on time, safely and on budget. Reid Electric Service, Inc has suffered a cyberattack on its service systems, resulting in the theft of approximately 50 GB of sensitive data. The breached information includes employees' personal data and detailed architectural plans of clients' buildings.
-
Keysight
August 4, 2026
•
[ ransomware, technology ]
Keysight was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Technology. Country: United States of America. Website: keysight.com. [AI generated] Keysight Technologies is an American electronic test and measurement company headquartered in Santa Rosa, California. It designs and manufactures instruments, software, and services used to design, emulate, and test electronic equipment. Its solutions support industries including aerospace, defense, communications, semiconductors, and automotive. Formerly part of Agilent Technologies, Keysight became an independent public company in 2014.
-
TSC Logistics
August 4, 2026
TSC Logistics was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Transportation. Country: Philippines. Website: www.tsclogistics.com. About TSC Logistics TSC Logistics specializes in providing advanced transportation solutions that prioritize speed and cost-effectiveness for their clients. A cyberattack has resulted in the exfiltration of nearly 600 gigabytes of highly sensitive data, exposing a vast trove of internal records. The compromised material includes personal employee documents, confidential company financial records, invoices, taxpayer statements, and extensive client information. More than 10,000 PDF files have been leaked, containing unredacted Social Security numbers, drivers licenses, payroll records, and other protected identifiers, raising the spectre of widespread identity theft and regulatory scrutiny.
-
Stadler Rail
July 28, 2026
•
[ ransomware, manufacturing, technology ]
Stadler Rail was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-28. Sector: Transportation. Country: Switzerland. Website: stadlerrail.com. [AI generated] Stadler Rail is a Swiss manufacturer of railway vehicles headquartered in Bussnang, Switzerland. Founded in 1942, the company designs and produces a wide range of trains including regional and intercity trains, trams, metros, and rack railways. It operates globally, supplying rail operators across Europe, the Americas, and beyond, and is recognized for its FLIRT and KISS train families.
-
The Miller Group
August 4, 2026
The Miller Group was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-04. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.miller-group.com. About The Miller Group The Miller Group refers to The Miller Group - Multiplex Division, a retail display manufacturer with operations spanning Dupo, Illinois and Richmond, Virginia As a result of the cyberattack, the company lost control of 500 GB of confidential data, including: employees Social Security numbers, email addresses, home addresses, and ZIP codesplain Excel spreadsheets; financial documents in PDF formatbudgets, transactions, and internal reports; complete project drawingsworking diagrams and perspective sketches.
-
Mansfield Family Dentistry
July 23, 2026
•
[ ransomware, healthcare ]
Mansfield Family Dentistry was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-23. Sector: Healthcare. Country: United States of America. Website: mansfielddentistry.com. [AI generated] Mansfield Family Dentistry is a dental practice operating in the United States, likely located in Mansfield, Ohio or a similarly named city. The practice provides general and family dentistry services, including routine cleanings, examinations, fillings, and preventive care for patients of all ages. It operates within the healthcare and dental services industry, serving local community members in a private practice setting.
-
Rocky Mount Recyclers
July 20, 2026
•
[ ransomware, financial, manufacturing ]
Rocky Mount Recyclers was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-07-20. Sector: Manufacturing. Country: United States of America. Website: www.rmrnc.com. Due to cyberattack on Rocky Mount Recyclers more than 40Gb of company personal data was stolen. Leakage contains big amount of sensitive data such as personal emlpoyes documents, company's customers data, bank and financial information documents. About 12,000 files are not secured by RMR for now. Download here: http://2zl5qc3mqap7vziqfis65oyjcgdiedigoequxbqsn6uwian7ieozvoqd.onion/
-
Powerweave
July 23, 2026
•
[ ransomware, manufacturing ]
Powerweave was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-23. Sector: Manufacturing. Country: India. Website: powerweave.com.
-
The Family Medicine Clinic
July 24, 2026
The Family Medicine Clinic was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-07-24. Sector: Healthcare. Country: United States of America. Website: www.facebook.com/familymedicineclinicnewiberia. About FMC The Family Medicine Clinic (Louisiana) suffered a serious cyberattack, which resulted in the encryption of a vast data archive and left the company without access to its own online systems. The leak of more then 250Gb FMC medical data encompasses a wide range of document types, including patient registration forms, lab test results, treatment plans, prescription records, and personal insurance information. In addition, employee personnel files were leaked, along with the full names, home addresses, and Social Security numbers of hundreds of customers. Download here: http://x4emye5homuwkrvrfaoql53hc5spbazkvcw3m4pv6jaj5tjqmjizleqd.onion
-
Aptara
July 22, 2026
•
[ ransomware, leak, technology ]
Aptara was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-22. Sector: Professional Services. Country: India. Website: aptaracorp.com. [AI generated] Aptara is a US-based digital content transformation company specializing in publishing, learning, and content solutions. Operating primarily in the publishing and e-learning industries, it provides services such as content conversion, instructional design, digital publishing, and XML/DITA authoring. Founded in 1988 and headquartered in Falls Church, Virginia, Aptara serves clients in education, government, and corporate sectors globally, helping organizations transition traditional content into digital formats.
-
Leviton
July 31, 2026
Leviton was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-07-31. Sector: Manufacturing. Country: United States of America. Website: www.leviton.com. About Leviton Founded in 1906 and headquartered in Melville, New York, Leviton is a privately held global provider of electrical wiring devices, data center connectivity solutions, and lighting energy management systems. A major cyber attack has resulted in the Leviton company losing control over its entire repository of sensitive data, totaling approximately 1.4 terabytes. The massive breach exposed a wide range of highly confidential information, including internal financial records, proprietary project schematics and working documents, as well as the personal data of employees. Additionally, a significant quantity of other unclassified but highly sensitive information was exfiltrated in the breach, painting a stark picture of a total system compromise.
-
Al-Futtaim Group
July 21, 2026
•
[ ransomware, retail, automotive ]
Al-Futtaim Group was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-07-21. Sector: Retail & E-Commerce. Country: United Arab Emirates. Website: alfuttaim.com. [AI generated] Al-Futtaim Group is a diversified conglomerate headquartered in Dubai, United Arab Emirates. Founded in the 1930s, it operates across retail, automotive, real estate, and financial services sectors. The group represents major global brands including IKEA, Toyota, and Marks & Spencer across the Middle East, Africa, and Asia. It is one of the region's most prominent privately held business enterprises.
-
Brainhunter Companies LLC. and Brainhunter Systems Ltd.
August 3, 2026
•
[ ransomware, technology, financial ]
Brainhunter Companies LLC. and Brainhunter Systems Ltd. was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-03. Sector: Professional Services. Country: United States of America. Website: www.brainhunter.com. About Brainhunter Companies LLC. and Brainhunter Systems Ltd. Founded in 1995, Brainhunter is an employment agency providing staffing and recruiting services to engineers, information technology, healthcare, and industrial sectors. Brainhunter also offers workplace management products, solutions and consulting, payroll and compliance services, and more. Brainhunter is headquartered in Toronto, Ontario. As a result of the attack on Brainhunter, more than 160 GB of the company's confidential data was stolen, including banking and financial documents, as well as the personal data of employees and customers. At this time, approximately 320,000 files remain unprotected by Brainhunter Foundation.
