-
ukbjja.org
September 24, 2026
•
[ ransomware, leak ]
ukbjja.org was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-24. Country: United Kingdom of Great Britain and Northern Ireland. Website: ukbjja.org. full data
-
welgenone.com
September 24, 2026
•
[ ransomware, healthcare, technology ]
welgenone.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Healthcare. Country: United States of America. Website: welgenone.com. Welgen One is a mobile wellness service provider based in Georgia, USA, offering personalized wellness care and dispensary access across Atlanta. The company focuses on delivering innovative healthcare solutions, including remote patient monitoring and onsite wellness programs, to enhance overall well-being. Targeting individuals seeking convenient and comprehensive health services, Welgen One aims to revolutionize the healthcare experience by prioritizing patient-centered care. With a commitment to accessibility and customization, they utilize advanced technology and data to optimize health outcomes
-
bnlawmacau.com www.bn-ip.com
September 24, 2026
•
[ ransomware, leak ]
bnlawmacau.com www.bn-ip.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Country: Macau. full data all country
-
NEAD Pro
September 24, 2026
•
[ ransomware, finance, legal ]
NEAD Pro was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-24. NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services.What it is: a network share belonging to two Italian professional firms located at Via Roma 20, Gorizia (Friuli-Venezia Giulia):NEAD SRL (NORTH EAST ADVISORS S.R.L.) - an accounting firm, dottore commercialista, P.IVA 01114220310, REA GO-72906;NEAD PRO - PROFESSIONISTI RIUNITI - a law firm, P.IVA 01157140318.Volume: ~575,000 files / ~253 GB. The root contains a single branch Nuova directory\NEAD\ (plus an empty Documenti folder and a scatter of PDF scans at the root level).Structure and contents:Branch Volume ContentsNEAD PRO SITE - Documenti 231,137 files / 193.5 GB Law firm: 03.PRATICHE (46,620 files: CIVILE 9,665, PENALE 537, SOVRAINDEBITAMENTO 1,208), 04. INCARICHI (85,321: FALLIMENTI 22,492, ESECUZIONI 28,509, ADS 14,547, TRUST, CURATELE), SEGRETERIA with CREDENZIALI VARIE.xlsx (~40 firm accounts: SPID, PEC, banks, 2 cards with full PAN+CVC, safe code), bank scans (BANCOMAT PIN, BCC agreements)NEAD SRL SITE - Documenti 101,125 / 55.3 GB Accounting firm: 03.CLIENTI - 199 active + 184 former client folders (730, CU, F24, contracts), 44 private SOGEI Entratel .P12 keys (signing clients' tax returns), ISA/IRAP tax filings 20192020, client master data, Account.xlsxPRIMA NOTA - Documenti 1,885 / 871 MB Cash books 20192026 (21 xlsx): CASSA / CONTO CORRENTE / POS / CARTA / SISTERPOWERBI - Documenti 548 / 627 MB 37 financial BI models .pbix (BI_ISIDE, BI_NEAD, ATHENA, PNAI)ARCHIVIO 921 / 2.6 GB MPS bank statements 20202024, NEAD SRL account closure, firm mail archivePOSTA SARDAMAR / PANEGIOCHI / ISIDE / ADMIN SRL ~165+ / ~174 MB Client and firm mail: IVECO Capital leasing, accertamento Agenzia Entrate, Capitaneria di Porto, verbali poliziaES. IMM. 112-2024 10 files Real-estate enforcement proceedings (Tribunale di Gorizia): bank statements and CIE (ID cards) of auction participantsNEAD root ~85 PDF / 127 MB Scanned bank statements, F24 forms, IPZS envelope with the PIN/PUK of a CIE cardMost sensitive data: client dossiers with tax codes (codici fiscali), court case files (civil/criminal/bankruptcy), medical documents (Art. 9 GDPR), the firm's credential database with full PAN+CVC of two cards and the safe code, 52 Entratel electronic signature keys, ~100 SEPA mandates with IBANs and signatures, client PST archives (7.5 GB), a client's Huawei phone backup (Facebook/Gmail/Telegram databases), passports of foreign shareholders. More
-
efada.sa
September 24, 2026
efada.sa was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Saudi Arabia. Website: efada.sa. efada.sa...
-
Indroj Medical Group Inc.
September 22, 2026
•
[ ransomware, healthcare ]
Indroj Medical Group Inc. was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: United States of America. Website: npiprofile.com. The Web's Free NPI Registry Search & Provider Reference Site
-
Martin Lawrence Galleries
September 22, 2026
•
[ ransomware, retail ]
Martin Lawrence Galleries was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Retail & E-Commerce. Country: United States of America. Website: martinlawrence.com. Premier gallery of fine art in America
-
Westside GI
September 22, 2026
•
[ ransomware, healthcare ]
Westside GI was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: United States of America. Website: westsidegicenter.com. Ambulatory endoscopy center
-
Armada Credit Bureau
September 24, 2026
•
[ ransomware, finance ]
Armada Credit Bureau was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Financial Services. Country: Uganda. Website: www.armadacrb.co.ug. Armada Credit Bureau Limited is a duly licensed credit reporting and analytics company
-
TapClicks (marketing analytics platform)
September 25, 2026
•
[ ransomware, technology ]
TapClicks (marketing analytics platform) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Technology. Country: United States of America. Marketing analytics / SaaS United States | The complete platform source code (97,000+ commits with full history); The multi-tenant instance management system with production architecture; A customer's full marketing database: 354 advertising platform datasets, client lists, user accounts with password hashes, ad-platform connection credentials | Everything is real, complete and verifiable. | [ACTIVE: deadline 2026-09-28 01:59 UTC]
-
pharma5.ma
September 25, 2026
•
[ ransomware, healthcare, leak ]
pharma5.ma was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: Morocco. Website: pharma5.ma. Pharma5
21, Rue des Asphodles, Marif Extension, 20100 Casablanca, Morocco
05 22 23 62 15
pharma5.ma
Leaked data: 50Gb
Corporate and financial information, data on products and their supply, quality control and certification, drug testing and related issues, employee personal data, counterparties, and much more.
-
corisricambi.it
September 24, 2026
•
[ ransomware, retail, manufacturing ]
corisricambi.it was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Italy. Website: corisricambi.it. Presenti sul territorio da oltre un ventennio, la CO.R.I.S. S.r.l. cresciuta all'interno del...
-
anery.com.br
September 23, 2026
•
[ ransomware, healthcare ]
anery.com.br was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Agriculture and Food Production. Country: Brazil. Website: anery.com.br. Somos a Anery Home Care Temos paixo por cuidar Nossa especialidade cuidar de pessoas, com todo o...
-
taspenlife.com
September 22, 2026
•
[ ransomware, leak, healthcare ]
taspenlife.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: Kazakhstan. Website: taspenlife.com. Taspen Life offers a range of insurance products including health protection, group protection, and...
-
Iberia Compositech Manufacturing
September 25, 2026
•
[ ransomware, manufacturing ]
Iberia Compositech Manufacturing was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Manufacturing. Country: Spain. Website: www.iberiacompositech.com.
-
Majani Insurance Brokers
September 25, 2026
•
[ ransomware, finance ]
Majani Insurance Brokers was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Financial Services. Country: Kenya. Website: majaninsure.com. Majani Insurance Brokers is an independent insurance broker serving both businesses and individuals. It arranges insurance products across areas including general business insurance, motor, medical, life, investment, marine, liability, property and agricultural-related covers
-
Breast Implant Center of Hawaii
September 25, 2026
•
[ ransomware, healthcare ]
Breast Implant Center of Hawaii was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: United States of America. Website: breastimplantcenterofhawaii.com. Breast Implant Center of Hawaii is a plastic surgery and aesthetics clinic serving patients across Hawaii. Based in Kailua-Kona, it offers breast augmentation, implant revision, breast lifts, body contouring.
-
ETS
September 25, 2026
ETS was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Education. [AI generated] N/A
"ETS" is too generic an identifier to reliably describethere are numerous distinct organizations using this name or acronym across different industries and countries (for example, testing and assessment organizations, engineering firms, electronic transaction services, and technology companies), and without additional context I cannot determine which specific entity is being referenced.
-
CENELEC
September 25, 2026
•
[ ransomware, technology, energy ]
CENELEC was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Professional Services. Country: Belgium. [AI generated] CENELEC (European Committee for Electrotechnical Standardization) is a Brussels, Belgium-based standardization organization operating across Europe. It develops voluntary electrotechnical standards to support the single market, covering electrical equipment, energy, and related technologies. Working alongside CEN and ETSI, it collaborates with national committees from European countries. Its industry is standardization and technical regulation within the electrotechnical and electronics sector.
-
UNIRITA
September 25, 2026
UNIRITA was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Technology. Country: Japan. Website: unirita.co.jp. [AI generated] UNIRITA Inc. is a Japanese IT company headquartered in Tokyo, Japan, operating in the information technology and systems software industry. It specializes in IT operations management software, system infrastructure solutions, and IT services, including its well-known product "Senju Family" for job scheduling and system operation management. UNIRITA also provides IT consulting, systems integration, and outsourcing services primarily to enterprise clients in Japan.
