-
Brancoptica
September 21, 2026
•
[ ransomware, retail, healthcare ]
Brancoptica was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: Portugal. Website: brancoptica.pt. brancoptica.pt Brancptica, Lda is a family-owned optical retail chain founded in 1961 in Cartaxo, Portugal (Ribatejo region) by Jos Francisco Branco de Oliveira, originally as "Oculista do Cartaxo." Now led by the founder's son Rui Oliveira, the company operates 20+ stores across three districts Santarm, Lisbon, and Leiria under the banner of the international Opticalia alliance (part of EssilorLuxottica). Beyond selling eyewear (Ray-Ban, Gucci, and designer brands), it provides professional optometry and orthoptics services with a team of 20+ qualified specialists, and runs its own e-commerce store on Shopify. The company employs roughly 3151 people with estimated revenue in the 210 million range. It is a rare example of a family optical chain that has survived and grown amid the mass decline of independent opticians in Portugal, winning the pticaPro 2024 Social Responsibility Award.
-
PuroClean
September 21, 2026
•
[ ransomware, leak ]
PuroClean was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: United States of America. Website: puroclean.com. puroclean.com purocleanfranchise.com PuroClean is North America's largest privately owned property damage restoration franchise, known as "The Paramedics of Property Damage", with 500+ franchise locations across the U.S., Canada, and Puerto Rico, headquartered in Tamarac, Florida. It provides 24/7 emergency services water damage mitigation, fire and smoke restoration, mold remediation, biohazard cleanup, and reconstruction responding within two hours, and is a preferred provider for 3 of the top 5 U.S. insurance carriers. The brand was launched in 2001 under the legal entity PuroSystems, LLC; in 2015 it was acquired by Mark W. Davis (former co-founder/CEO of Belfor North America) and Frank Torre, who grew the network from 222 to 500+ locations. The franchisor's audited revenue is $31.8 million (FY2025), while system-wide franchise sales exceed $400 million, with an average franchise unit generating ~$942K per year.
-
Trifecta Software
September 21, 2026
Trifecta Software was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Technology. Country: United States of America. Website: trifectasoftware.com. trifectasoftware.com zoominfo.com/c/trifecta-software/464122642 Trifecta Software is a small Costa Rican software development company based in San Jos, founded in 2011 by Joseph Phillips, a Costa Rican engineer and entrepreneur. The company provides custom software development for U.S. clients (mostly under NDA), plus CRM implementation based on open-source vTiger (branded CostaRicaCRM), and operates within a family of related businesses including a digital marketing agency (Mercadeo Asertivo) and an e-invoicing SaaS (Facturero.com). Its founder previously co-founded a health-tech startup that was acquired by Huli Health in 2018. The team is small around 6 people with revenue estimated between $250K and $1.5 million annually. In November 2025, the company registered a new legal entity in Panama, and in 2026 repositioned itself with an "AI-first" custom software branding.
-
Markisol
September 21, 2026
•
[ ransomware, manufacturing ]
Markisol was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Sweden. Website: markisol.se. markisol.se zoominfo.com/c/markisol-ab/357807356 Markisol Group is a Swedish family-owned manufacturer of window blinds (roller, venetian, pleated, roman, and panel) headquartered in Ronneby, Sweden, founded in the late 1960s by Bo Persson, who started making blinds at age 6 alongside his father and built the company into one of the world's leading blind producers. The company has been a supplier to IKEA since 1983 and is fully vertically integrated it designs and builds its own patented assembly machines (up to 400 blinds per hour), produces its own components, and weaves and prints its own fabrics at its textile plant in Narva, Estonia (in the historic Krenholm factory).
-
Agrocampo
September 21, 2026
Agrocampo was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Agriculture and Food Production. Country: Colombia. Website: agrocampo.com.co. agrocampo.com.co zoominfo.com/c/agrocampo/433785602 Agrocampo S.A.S. is Colombia's first and only veterinary hypermarket, founded in 1979 by veterinarian Alfonso Villa and headquartered in Bogot, serving as the country's leading distributor of veterinary drugs and agricultural supplies for over 45 years. The company operates one flagship hypermarket in Bogot plus a 24/7 distribution center of ~8,000 m in Cota, delivering 15,000+ products to ~980 municipalities (99% of Colombia's territory) through e-commerce, call center, and a network of partner veterinary stores it deliberately does not compete with. It generates around COP 164 billion (~USD 40 million) in annual revenue with a team of ~270300 employees, and also operates in Panama, Guatemala, and Costa Rica.
-
Grupo MARSAN
September 21, 2026
•
[ ransomware, manufacturing, automotive ]
Grupo MARSAN was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Mexico. Website: grupomarsan.com. grupomarsan.com zoominfo.com/c/grupo-marsan/460771135 Grupo Marsan is a Spanish Tier 2 automotive supplier founded in 1951 in Vigo, Spain, specializing in industrial surface coatings cataphoresis (e-coating), powder and liquid painting plus metal stamping, assembly, and JIT logistics, with a capacity of 300,000 parts per day. The company operates plants in Spain (Vigo, Zaragoza), Portugal, and Mexico, and also builds and runs dedicated in-house coating lines inside clients' facilities, supported by its own technology center M-Tech. It works under IATF automotive quality standards within supply chains of major OEMs and Tier 1 suppliers. After a liquidity crisis in 2024, the group was recapitalized with private and Galician public funds (~47.5% held by Xesgalicia and Vigo Activo), and Marcos Oubia was appointed CEO. FY2024 revenue exceeded 28 million with ~450 employees, and in 2025 the company acquired KATA Aragn, growing to ~500 employees
-
Progeny
September 21, 2026
•
[ ransomware, technology ]
Progeny was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Technology. Country: Antigua & Barbuda. Website: progenyag.com. progenyag.com zoominfo.com/c/progeny-ag/351504348 Erwin-Keith, Inc. (Progeny Ag Products) is a family-owned seed and grain company founded in 1984 in the Arkansas Delta (Wynne, Arkansas, USA), operating under the Progeny brand since 1997. The company develops and markets its own varieties of soybeans, corn, wheat, and rice, selling across 1011 Southern U.S. states. Its rice brand ProGold is licensed from the University of Arkansas and ProGold L4 and M3 varieties are now included in the university's official 2026 recommended planting list. Beyond seeds, the company runs grain elevators (including a rail facility), a trucking fleet across 9 states, and grain marketing programs (HTA, basis-only, and average pricing contracts). Estimated revenue is around $26 million with roughly 100+ employees (seasonal workforce included), and the business remains led by the founding Erwin and Keith families.
-
ANP Health
September 21, 2026
•
[ ransomware, healthcare ]
ANP Health was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Healthcare. Country: Brazil. Website: anphealthsolutions.com. anphealthsolutions.com ANP Health Services Inc. is a Florida-based recruitment agency specializing in placing foreign-trained nurses into U.S. hospitals, with a strong focus on Latin America (especially Venezuela). Founded in 2019 by Nelson Hurtado, a Venezuelan immigrant and registered nurse, the company provides an end-to-end service: credential validation, NCLEX exam preparation, English training, direct-hire placement with 150+ partner hospitals, and visa sponsorship (EB-3 Green Card for the nurse and family). It has helped over 2,000 nurses from 28 countries, with candidates typically earning $70100K per year plus sign-on bonuses. The company is a Certified Ethical Recruiter (CGFNS Alliance) one of only about 16 accredited firms in the U.S. and employs roughly 3050 people across 9 countries. Estimated revenue is $1050 million annually.
-
Magnetos y Refacciones
September 21, 2026
•
[ ransomware, manufacturing, retail ]
Magnetos y Refacciones was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Mexico. Website: magnetos.com.mx. magnetos.com.mx zoominfo.com/c/magnetos-y-refacciones-sa-de-cv/1288761434 Magnetos y Refacciones, S.A. de C.V. is a Mexican trading and service company founded in 1977 and headquartered in Guadalajara, Jalisco. Its core business is supplying magnet wire, bearings, insulating varnishes, electric motors, and spare parts for motor repair wholesale and retail, serving customers across all 32 Mexican states. Its second key business is a nationwide network of authorized service centers performing warranty and post-warranty repair for Groupe SEB brands (Krups, T-Fal, Rowenta, Moulinex) and Taurus in 810 Mexican cities. The company employs around 129 people and is part of a small group operated by Corporacin Rodaja. It also exports to Central America (mainly El Salvador), with about US$4.2 million in shipments over the last five years. Despite nearly 50 years on the market, it has virtually no digital presence its website is an empty placeholder.
-
Hell Helmut GmbH
September 21, 2026
Hell Helmut GmbH was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Austria. Website: fachhandel-hell.at. fachhandel-hell.at Hell Helmut GmbH is a small family-owned B2B wholesale company based in Hall in Tirol, Austria, operating for over 20 years and specialized in sanitary and heating supplies. The company positions itself as a system supplier for underfloor heating, serving professional installers across Tyrol, Vorarlberg, and Salzburg. It sources directly from leading manufacturers primarily IMI Heimeier (thermostatic and balancing valves) and Uponor (underfloor heating and drinking water systems) guaranteeing original quality. Its key differentiator is in-house prefabrication: ready-made manifold stations and water metering stations built exclusively from IMI and Uponor components. The business is 100% owned and personally managed by its founder Helmut Hell, with a lean team of about 56 people. Overall, it is a classic regional specialist wholesaler: small, owner-run, and focused on system-based project supply rather than retail.
-
StMicroelectronics
September 21, 2026
•
[ ransomware, technology, manufacturing ]
StMicroelectronics was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Technology. Country: Italy. Website: st.com. st.com zoominfo.com/c/stmicroelectronics/114508234 Revenue $13.1 Billion STMicroelectronics (ST) is one of the world's largest semiconductor companies and Europe's biggest chipmaker, headquartered in Geneva, Switzerland. Formed in 1987 through the merger of Italian and French state-owned chip companies, it is a fully integrated manufacturer it designs, produces, and sells its own chips. Its core products are microcontrollers (the flagship STM32 family), sensors, analog and power chips, silicon carbide devices for electric vehicles, and chips for data centers and satellites. The company serves over 200,000 customers worldwide including Apple, Tesla, Bosch, Samsung, and SpaceX supplying components for cars, smartphones, industrial equipment, and data centers. It operates 14 manufacturing plants across Europe and Asia, employs about 49,000 people, and invests roughly 17% of its revenue in R&D.
-
Magna Legal Services
September 24, 2026
•
[ ransomware, technology, finance ]
Magna Legal Services was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Country: United States of America. Website: magnals.com. Magna Legal Services is a nationwide provider of comprehensive litigation support and legal services, serving law firms, corporations, insurance companies, and government organizations. Founded in 2007 and headquartered in Philadelphia, Pennsylvania, the company supports clients throughout the entire litigation process. Its services include court reporting, deposition services, medical record retrieval, jury consulting, trial presentation, legal graphics, video production, investigations, service of process, interpreting and translation, and virtual proceedings. Magna combines legal expertise with technology to help attorneys manage complex cases efficiently. The company has expanded its national presence through strategic acquisitions and currently operates across numerous locations throughout the United States.
The company headquarters is located in 1635 Market Street, 8th Floor, Philadelphia, PA 19103, United States. 501-1000 Employees
-
Metalware Corporation
September 21, 2026
Metalware Corporation was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Canada. Website: metalware.ca. metalware.ca zoominfo.com/c/metalware-corp/57640606 Metalware Corporation is a Canadian manufacturer of industrial steel shelving and storage systems, based in Montreal, Quebec, and in business since the early 1950s. The company is best known as the inventor of boltless ("No-Bolt") shelving, patented in 1954 by founders Irving and Ben Levitt a design that became the industry standard for order-picking warehouses. Still family-owned and led by second/third-generation owners (President Mark Levitt), Metalware produces its flagship Interlok No-Bolt line, E-Series widespan shelving, multi-tier/high-bay systems, shelf-supported mezzanines, and modular drawer solutions at its Montreal plant, selling through a network of authorized distributors across North America. Its reference clients include the Government of Canada (Canada Revenue Agency, Department of National Defence), Porsche, and Walmart
-
Guardrisk
September 21, 2026
Guardrisk was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Financial Services. Country: South Africa. Website: guardrisk.co.za. guardrisk.co.za rocketreach.co/guardrisk-insurance-company-ltd-profile_b5a52494f9c62c8e Guardrisk is a South African specialist insurance group, founded in 1993 and widely recognized as the pioneer and market leader of cell captive insurance in Africa a model that allows companies to run their own "branded" insurance business under Guardrisk's licensed infrastructure instead of building a full insurer themselves. Headquartered in Sandton, Johannesburg, the group operates licensed insurers for life, non-life, and microinsurance, plus international cells in Mauritius and Gibraltar, and employs around 530 people. It has been wholly owned since 201314 by Momentum Group (JSE: MTN-listed MTM), which acquired it for R1.6 billion. For the financial year ended 30 June 2025, Guardrisk managed total assets of R68 billion and over 240 active cells, generating net revenue of ~R2 billion and pre-tax trading profit of ~R1 billion
-
Applied Composites
September 24, 2026
•
[ ransomware, manufacturing, technology ]
Applied Composites was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Manufacturing. Country: United States of America. Website: appliedcomposites.com. Applied Composites is a leading U.S. manufacturer specializing in advanced composite components, assemblies, engineering, and tooling for the aerospace, defense, and space industries. The company provides highly engineered composite structures for aircraft, engines, missiles, unmanned aerial vehicles (UAVs), satellites, and launch vehicles. Its vertically integrated capabilities include design, tooling, manufacturing, machining, assembly, testing, and engineering support. Applied Composites operates multiple specialized facilities equipped with autoclaves, CNC machining centers, clean rooms, and advanced testing equipment. The company serves major aerospace and defense organizations and focuses on delivering lightweight, durable, high-performance composite solutions for demanding commercial, military, and space applications.
The company headquarters is located in 25671 Commercentre Drive, Lake Forest, CA 92630, United States. 501-1000 Employees
-
Apollo 21 – Quality Truck, Bus & Trailer Spare Parts South Africa
September 19, 2026
•
[ ransomware, manufacturing, retail ]
Apollo 21 Quality Truck, Bus & Trailer Spare Parts South Africa was listed as a victim on the leak site of the BlackLocks ransomware group; the attack is estimated to have taken place on 2026-09-19. Sector: Transportation. Country: South Africa. Website: apollo21.co.za. Views: 985
-
International Chemical Co.
September 26, 2026
•
[ ransomware, manufacturing, leak ]
International Chemical Co. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-26. Sector: Manufacturing. International Chemical Company (ICC) manufactures specialty metalworking fluids, industrial cleaners, rust preventatives, and custom chemical formulations.
We have extracted the most important files from their main file server and possess data on their sales, formulas, patents, manufacturing, contracts, and partners.
For example, we possess the full formulation and manufacturing instructions for I.C.C.s patented Biodraulic hydraulic oil. And even more than that. It is available for sale to competitors.
Victim website: https://e-icc.com | Severity: HIGH | Size: 90 GB | Status: selling | $50,000
-
cipher.systems
September 26, 2026
•
[ ransomware, technology ]
cipher.systems was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-09-26. Sector: Technology. Country: United States of America. Website: cipher.systems. +1 703-672-0051 , At Cipher Systems, we specialize in delivering enterprise-grade IT solutions designed to help businesses evolve, secure, and scale in a rapidly changing digital world. From future-proof cloud infrastructures to next-gen cybersecurity and AI-powered intelligence, our solutions are engineered for performance and built for growth. With deep expertise in software engineering, IT consulting, and data science, we turn complex challenges into streamlined outcomesensuring that your systems are secure, your data is insightful, and your technology is always a step ahead. Stolen: --
-
ARCA UNLIMITED Architects
September 22, 2026
•
[ ransomware, leak ]
ARCA UNLIMITED Architects was listed as a victim on the leak site of the BlackLocks ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: South Africa. Views: 49
-
Car Service Abschlepp
September 27, 2026
Car Service Abschlepp was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-27. Sector: Transportation. Country: Germany. CSA Car Service Abschlepp- & Bergungsdienst GmbH
Genslerstrae 72, 13055 Berlin
Archived personal and corporate data of employees and customers
Here are the most important documents [Sector: Transportation]
