-
Legis
September 23, 2026
•
[ ransomware, technology, finance ]
Legis was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More
-
vestfrostsolutions.com
August 31, 2026
•
[ ransomware, manufacturing, retail ]
vestfrostsolutions.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-31. Sector: Other. Country: Norway. Website: vestfrostsolutions.com. Vestfrostsolutions.com The company sells reliability and precision back bar coolers for Red Bull, ...
-
Tomix / Grupo JOPER
September 23, 2026
•
[ ransomware, manufacturing ]
Tomix / Grupo JOPER was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Manufacturing. Country: Portugal. Website: tomix.com.pt. Tomix Indstria de Equipamentos Agrcolas e Industriais, Lda. is a Portuguese manufacturer of crop-protection equipment, best known for agricultural sprayers, atomizers, dusters and related machinery. Founded in 1924 near Torres Vedras by Francisco Xavier Damio, it grew into a market leader in Portugal for plant-treatment equipment, including rotomoulded tanks and high-pressure washers. Since 1997 Tomix has been majority-owned by JOPER Indstria de Equipamentos Agrcolas, S.A., and today it operates as part of the family-run JOPER Group alongside JOPER and Ribatejo. Together they supply complementary agricultural machinery for transport, soil tillage and crop treatment across Iberia and export markets https://tomix.com.pt/
-
goldstarfinancial.com
September 23, 2026
•
[ ransomware, finance ]
goldstarfinancial.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Financial Services. Country: United States of America. Website: goldstarfinancial.com. [AI generated] N/A
I don't have reliable, verified information about a specific company operating at "goldstarfinancial.com." There are multiple businesses that have used similar "Gold Star Financial" naming conventions in different jurisdictions (this is a fairly generic name used by mortgage brokers, lending companies, and financial services firms in various countries), so I cannot confidently confirm which specific entity this domain refers to, its current operational status, ownership, or verified business details without risking inaccurate attribution.
If you can provide additional context (such as the specific country, registration details, or services advertised on the site), I can help assess it more accurately. Alternatively, if this is for threat intelligence purposes, I'd recommend verifying details through domain registration records (WHOIS), business registries, or regulatory filings relevant to
-
Abtach Ltd.
September 23, 2026
•
[ ransomware, technology, financial ]
Abtach Ltd. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-23. Abtach Ltd. was renamed Intersys Ltd.a Pakistani company engaged in fraud targeting the US. The companys employees charged fees for services that did not actually exist.
The companys founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace.
We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain evidence of Azneem Bilwanis illegal activities.
Will be published soon... | Severity: HIGH | Size: 1.5 TB | Status: selling | $100,000
-
OnTrac
September 23, 2026
OnTrac was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Transportation. Country: United States of America. OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. It positions itself as a direct alternative to FedEx and UPS, offering coast-to-coast coverage, 7-day-a-week operations, and competitive rates to reach over 75% of the U.S. population.
We hold your full employee database, 197k records of employee PII:
employeeNumber,xrefCode,firstName,middleName,lastName,loginId,employeeId,hireDate,originalHireDate,startDate,terminated,roles,legalEntity,legalEntityAddress,homePhone,mobilePhone,businessPhone,businessMobile,pager,personalFax,personalEmail,businessEmail,facebook,linkedin,addressPrimary1,addressPrimary2,addressMailing1,addressMailing2,userApproved,nativeAuth,culture
We demand an amount of 1 million, otherwise your data WILL be publicly posted.
Instructions will be emailed to you shortly.
If you do not receive them, contact me on session, or email me.
Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358
Email: xdlmfao@morke.ru, kajsdsalkufsaoiuairw7@outlook.com
(I prefer session.)
If you do not cooperate, your partners and employees will be targeted.
Emails were sent to: webcustomerservice@ontrac.com, customerservice@ontrac.com, softwaresupport@ontrac.com, softwaresupport@ontrac.com, apisupport@ontrac.com, RSaiz@OnTrac.com, scorral@ontrac.com, SMcCandless@OnTrac.com [Sector: Retail, Transportation]
-
eTeam
September 24, 2026
•
[ ransomware, leak, technology ]
eTeam was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Revenue: Revenue: $229 million
eTeam Inc. is a privately held global workforce solutions and business transformation company. Founded in 1999 by Ben Thakur, the company is certified as a Minority Business Enterprise (MBE). It has grown from a boutique IT staffing agency into a massive global network, managing thousands of internal employees and contract workers across continents. We successfully exfiltrated all employee records (15K), including full names, email addresses, home addresses, DOBs, SSNs, phone numbers, contracts, managers, hire dates, salaries and more. We engaged with eTeam privately some time back, and now we are going public with the announcement as eTeam was negligent of the incident that took place then. We're giving you one more chance. Speak soon or leak soon!
-
Solucioning S.A.
September 24, 2026
•
[ ransomware, leak, energy ]
Solucioning S.A. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Argentina. This is a small company of 4-5 people, yet it has big clients in the oil production sector.
Unfortunately, the company neglected data security, allowing us to gain access to all their confidential files - projects, documents, blueprints, and so on.
The company has been ignoring us for five days now, and we will soon publish their files. This is a warning. We do not wish to harm anyone, but we are prepared to inflict maximum damage.
Victim website: https://www.solucioning.com/ | Severity: HIGH | Size: 463 GB | Status: selling | $100,000
-
Final statement re PSA
September 24, 2026
•
[ hack, ransomware, automotive ]
Final statement re PSA was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-09-24. Good afternoon, We have no further comments to make regarding our PSA statement we released the other day. Our organisation is highly confident we have achieved our goal and our intentions we repeatedly made clear to journalists and in our public statements. There is 5 days remaining still. We have no comment yet regarding what we will do if the victim entity does not comply with our kind request . Nonetheless, we got what we wanted and we have a business to run and operate as usual. We will not be responding to any press inquiries about this and we will not be sharing updates about other datasets we have that we did not yet disclose to the public. We reiterate and want to assiduously emphasise we are NOT extorting the victim in question, this is NOT financially motivated and this is NOT a ransom. Thank you for your time and attention to this matter. This is now old news. Regards, SH | Updated: 24 Sep 2026
-
HEC Group
September 24, 2026
HEC Group was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Taiwan. Website: hec-group.com.tw. On August 30, HEC Group issued an official statement addressed to shareholders of TPE:3032 and other stakeholders, announcing that the company had been the target of a cyberattack. In its statement, the company claimed that the breach was detected immediately, that high-tech countermeasures were deployed, and that no corporate documentation was lost. The incident was characterized as a minimal, random occurrence. The reality, however, is starkly different. Our operation against the company began weeks prior to that publication. Due to a systemic failure to implement basic security principles, we gained nearly total control over the infrastructure supporting the development and commercial operations of the entire corporate group. We conducted a methodical and comprehensive review of the documentation, exfiltrating a vast amount of data. We remained undetected for as long as necessary to secure everything we sought. Only after completing our objectives did we initiate the data encryption process, the company's technical staff did not even detect our presence until many hours later. At the time of their official announcement, HEC Group's leadership knew the statement was entirely false. Its sole purpose was to manipulate stock market trading. Instead of contacting us to mitigate the damage, management chose to deceive the exchange. When we finally managed to contact the company's leadership and offered them a chance to make their official statement more truthful in exchange for the deletion of the taken documents, they showed no interest. If the leadership of HEC Group has decided to pursue a path of selfdestruction, we will not stand in their way. To prove that HEC Groups statement was a fabrication and that our claims are accurate, we will now publish a portion of the exfiltrated data. This initial release will consist of over 360,000 files, drawn from a total volume measuring in terabytes. This data will provide stock exchange regulators and partner companies with exhaustive evidence of the actual events. The remaining documents will not be released publicly at this time, as we have devised a more strategic use for them. While the countdown timer below this publication runs, the companies affiliated with HEC Group, their shareholders, and regulatory authorities have time to prepare. HEC Group has one final opportunity to accept our proposal and avoid the consequences.
-
Elite Industech Co., Ltd
September 23, 2026
•
[ ransomware, manufacturing, technology ]
Elite Industech Co., Ltd was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Manufacturing. Country: Thailand. Website: pjemetal.com. Elite Industech Co., Ltd. (established in 2003) is a certified Class-A waste treatment plant based in Kaohsiung, Taiwan. The company operates within the circular economy sector, specializing in the eco-friendly processing of electronic waste (E-waste) and the recycling of rare and precious metals
-
BMGP Groupe
September 23, 2026
BMGP Groupe was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Other. Country: France. Website: polyresine.com. BMGP Groupe (Polyresine) is an established French manufacturer specializing in the formulation, production, and distribution of synthetic resins and high-performance technical polymers. Founded in 1972, the company serves a wide range of industrial sectors, providing tailored chemical formulations for applications such as industrial flooring, waterproofing, encapsulation, and specialized coatings. They are known for engineering reliable, durable chemical solutions to meet complex industrial specifications.
-
Arizona Vascular Medical Equipment, Inc
September 23, 2026
•
[ ransomware, healthcare ]
Arizona Vascular Medical Equipment, Inc was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Healthcare. Country: United States of America. Website: arizonavascular.com. Arizona Vascular Medical Equipment, Inc. is a trusted provider of specialized medical devices, focusing primarily on compression therapy solutions and vascular care equipment. Headquartered in Mesa, Arizona, the company is dedicated to improving patient mobility and quality of life by delivering high-quality medical products and personalized customer service across the United States.
-
amb-pvc.com
August 18, 2026
•
[ ransomware, manufacturing ]
amb-pvc.com was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Manufacturing. Country: France. Website: amb-pvc.com. AMB (Ateliers de Menuiseries Bidet), also known as Atelier de Menuiseries Bidet, is a French manufacturer specializing in PVC and aluminium joinery products. The company is based in Bourguenolles, Normandy, France. Its website is amb-pvc.com.
-
www.francare.com
August 18, 2026
•
[ ransomware, healthcare, manufacturing ]
www.francare.com was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: France. Website: www.francare.com. FRANCARE Industries is a French international technical-supply, engineering, and maintenance company, headquartered in Paris, France. The company was founded in 1988 and specializes in supplying equipment, technologies, and technical services to industrial and healthcare customers internationally
-
agiliance.fr
August 18, 2026
•
[ ransomware, finance, hack ]
agiliance.fr was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Professional Services. Country: France. Website: agiliance.fr. Agiliance is a French accounting and business advisory group headquartered across the Haute-Sane and Doubs regions. Its website describes Agiliance as the result of bringing together 8 small-to-medium-sized accounting firms, combining their expertise and tools while retaining a local, client-oriented approach.
-
winfashion
August 24, 2026
winfashion was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Retail & E-Commerce. Website: winfashion.com.
WINFASHION TECHNOLOGIES DUMP: DATA LEAK ANALYSIS OF A B2B ERP PLATFORM FOR THE FASHION INDUSTRY
This is a preliminary analysis, processing of sensitive data is currently underway.
Target: WinFashion Technologies (Los Angeles, USA) an international B2B provider of ERP solutions (WF125sR / Fabric ERP V.10) for 250+ fashion brands. Offices in New York, Shanghai, and India. Integrations: Shopify, Acenda, JOOR, NuORDER, CommerceHub, FashionGo. BPO/EDI processing via Inovis/QRS.
DUMP VOLUME: ~205K files / ~13K directories / ~73 Gigabytes
AT-RISK FILES: 125,274 (61.0%)
Critical: 9,350
High: 78,174
Medium: 37,750
PRELIMINARY FINDINGS:
kaktus.bak (5.64 GB) full MSSQL backup of the "Kaktus" client's ERP installation (Customer Master, Style Master, EDI, AR)
6 SSL PFX containers + EDI-VAN client certificate for ECGrid/OpenText
33,307 .shxml files WinSCP SFTP session logs (hosts, paths, sizes)
332 ASP.NET Web.config files potentially hardcoded Shopify / Authorize.Net secrets
171 files with PAN / CreditCard / Cardholder / Payment data Authorize.Net payment processing code
39 files with IBAN / SWIFT / BankAccount data bank account details
259 Invoice Register / Invoice data files Excel payment registers (up to 124 MB)
CLIENT DATA (~40 BRANDS):
STYLEMASTER.xlsx (48 MB) aggregated product catalog export
Vendors.XLS (20 MB) + test customers.XLS (7 MB) Kaktus vendors and customers
40,621 EDI files (.edi / .850 / .856 / .810 / .997 / .852 / .832 / .846) full B2B trade lifecycle (PO, ASN, invoices, price catalogs)
INTELLECTUAL PROPERTY:
8,577 .cs files integration source code (Authorize.Net, Shopify, Acenda, JOOR, NuORDER, DSCO)
5,828 .pbd files PowerBuilder WF125sR ERP core
3,398 .sql files DB schema, triggers, CLR procedures
18 .dbf / .mdf files legacy DBASE / FOXPRO / MSSQL tables without encryption
HR / PII:
INV EMPLOYEE ALLOWANCE YTD.xlsx (76 MB) employee HR data
AR Aging 12.30.25.xls + AR Aging 12.29.25.XLS accounts receivable for Monrow and Kaktus clients
REGULATORY RISKS:
PCI DSS compromise of PAN processing code + Authorize Excel registers
CCPA / CPRA HR-PII (76 MB), California jurisdiction
FTC "total security" claims amidst PFX / DBF / Web.config compromise
SEC (Regulation FD) risk for publicly traded client issuers
GDPR PII of customers / vendors across ~40 brands
The dump represents a cross-tenant B2B SaaS incident involving the disclosure of trade secrets for ~40 fashion brands, the compromise of the Authorize.Net payment infrastructure, and the exposure of the full ERP source code.
-
Grupo Caberj
September 24, 2026
Grupo Caberj was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Manufacturing. Country: Brazil. O Grupo Caberj, que oferece uma ampla gama de seguros, foi hackeado h 10 dias
-
www.jonesthegrocer.com
September 24, 2026
•
[ ransomware, retail ]
www.jonesthegrocer.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Retail & E-Commerce. Country: Australia. Website: www.jonesthegrocer.com. Jones the Grocer is a premium gourmet food retail and cafe brand founded in 1996 in Sydney, Australia, originally launch...
-
airtanzania.co.tz / airtanzania.com
September 24, 2026
•
[ ransomware, leak ]
airtanzania.co.tz / airtanzania.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Transportation. Country: Tanzania, United Republic of. Website: airtanzania.co.tz / airtanzania.com. Air Tanzania Company Limited (ATCL) is the national flag carrier airline of Tanzania, established on March 11, 1977 foll...
