Full List

Search

Recent Breaches

• KMLS September 20, 2026 • [ ransomware, manufacturing ] KMLS was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-20. Country: Germany. Website: www.kmls.de.
• ShopDunk September 20, 2026 • [ ransomware, retail ] ShopDunk was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Retail & E-Commerce. Country: Thailand. Website: www.shopdunk.com.
• Zorlu Holding September 20, 2026 • [ ransomware, manufacturing, energy ] Zorlu Holding was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Manufacturing. Country: Turkey. Website: www.zorlu.com.
• Euramex Management Group September 20, 2026 Euramex Management Group was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-09-20. Country: United States of America. Website: avilare.com. Avila Real Estate, LLC is a vertically-integrated multifamily company, adding value through acquisition, development of land, construction and operating residential assets. Headquartered in Atlanta, Georgia, Avila has developed over $800 million in 25 multifamily transactions since 1986 for its own account and on behalf of global and institutional investors.
• acilnet.com September 20, 2026 acilnet.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Technology. Country: Turkey. Website: acilnet.com. Ahluwalia Contracts (India) Limited (ACIL) is one of India's largest civil construction and contracting companies, incor...
• Siddhi Green Excellence Pvt. Ltd September 20, 2026 Siddhi Green Excellence Pvt. Ltd was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Energy & Utilities. Country: India. Website: siddhigreen.com. Our journey started in 2001 with baby steps like treatability studies, general analysis of chemicals, water and wastewaters and providing technical consultancy for CC&A and NOC applications of chemical industries; and eventually, Siddhi Green expanded to offer a wide spectrum of environmental services under one roof with systematic planning and a quality-oriented approach.
• TEK SPB September 12, 2026 TEK SPB was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Technology. Country: Russian Federation. Website: tek-spb.ru. TeploEnergoKomplex (TEK SPB, tek-spb.ru) a St. Petersburg heat-engineering company specializing in design, ZEVS-brand equipment manufacturing, installation, commissioning, and maintenance of individual/central heat points (ITP/CTP) and heat-energy metering units (UUTE)
• Alabama Woman's Health Care September 20, 2026 • [ ransomware, leak, healthcare ] Alabama Woman's Health Care was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Healthcare. Country: United States of America. Website: alabamawomenshealth.com. Alabama Woman's Health Care Comprehensive Consultative Medicine, Wellbeing and Aesthetic Care Organization Several thousand documents of employees and clients and an archive of photos 420 Lowell Dr Suite 400 Huntsville, AL 35801 [Sector: Medical, Other]
• arsrenacer.com September 1, 2026 • [ ransomware, healthcare, finance ] arsrenacer.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Argentina. Website: arsrenacer.com. ARS RENACER, S.A. DUMP: ANALYSIS OF A HEALTH INSURANCE COMPANY LEAK ARS Renacer, S.A. (Dominican Republic) is a private Health Risk Administrator (ARS), licensed by SISALRIL (Law 87-01). Member of ADIMARS. It serves hundreds of thousands of affiliates through 24 regional offices. **DUMP VOLUME:** 274,404 files / 158,693 critical and high-risk files 50,894 files in the "Usuarios" (Users) folder user accounts for all systems .ssh/ + .bash_history + .gitconfig access keys and command history of IT personnel 4,501 files direct affiliate databases (names, cdulas [national IDs], phone numbers, addresses) 3,000 backup files potentially complete database dumps 679 files employee payroll data 500 files passwords and access tokens to financial systems **MEDICAL DATA (PHI):** 19,443 medical service authorization files diagnoses, procedures, patient names 13,928 pre-certification files 810 pre-certification files (treatment details) 199 medical record files (expediente clnico) 1,569 prescription files linked to diagnoses 252 claims files containing PHI **FINANCIAL DATA:** 4,863 financial transaction files payments, refunds, bank details 3,676 account files with affiliates' financial data 3,467 financial documents (reports, balance sheets, budgets) 1,293 files containing financial system secrets and tokens **REGULATORY RISKS:** Law 172-13 (Personal Data Protection) Article 13 directly violated; penalties: 6 months to 2 years in prison + fines up to 150 minimum wages per incident Law 42-01, Article 28 (Confidentiality of clinical records) Law 53-07 (Cybercrime) mandatory DICAT investigation Circular SSRL-INT-2025-000827 SISALRIL direct requirement to protect PHI Precedent: SISALRIL fine of 2.3 million DOP for 5 incidents (2021); the current leak is orders of magnitude larger **OTHER RISKS:** Exploitation of the Traspaso Digital system (SISALRIL, 2025) for massive illegal transfers of affiliates using leaked credentials Blackmailing patients with the threat of disclosing diagnoses BEC (Business Email Compromise) attacks on management (Board of Directors' data is in the dump) Synthetic identity theft and fabrication of fake cdulas Mass Habeas Data lawsuits will paralyze the legal department The dump contains a complete cross-section of the medical insurance company: from server SSH keys to the diagnoses of hundreds of thousands of patients and affiliates' bank details. The data cannot be invalidated a cdula and medical history are immutable.
• Maryann Kriger September 21, 2026 Maryann Kriger was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-21. Country: United States of America. Website: bonitaortho.com. At Bonita Orthodontics, Dr. Maryann Kriger and our friendly team provide personalized orthodontic care using state-of-the-art technology. As a board-certified orthodontist and Elite Invisalign Provider, Dr. Kriger takes a conservative approach creating simple, affordable treatment plans that deliver beautiful, lasting smiles. Call today to schedule your free consultation! We have reached out to Bonita Ortho on multiple occasions to prevent this leak, warning them that it exposes the private information of patients who are minors. Despite this, our messages have been ignored.
• SECOND HOUSE September 21, 2026 • [ ransomware, retail ] SECOND HOUSE was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Hospitality. Country: Spain. Website: secondhouse.es. Second House (Second House, S.L.) is a privately held real estate company headquartered in Barcelona, Spain, with over 26 years of experience in the property sector. Their business model centers on buying properties and adding value to them through renovation works, improving rental situations, and legalizing the existing state of buildings effectively driving renewal of the real estate market in Barcelona and its surroundings. They are actively acquiring in the Barcelona area (including L'Hospitalet, Badalona, Sant Cugat, etc.)
• newmantractor.com September 21, 2026 • [ ransomware, manufacturing ] newmantractor.com was listed as a victim on the leak site of the threeam ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: United States of America. Website: newmantractor.com. Since 1976, Newman Tractor has been serving the heavy equipment industry both domestically, and internationally. Originally founded as a farm equipment business in Boone County, Kentucky, Newman Tractor has transformed into one of this country's m
• siinqeebank.com September 20, 2026 • [ ransomware, finance ] siinqeebank.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Financial Services. Country: Somalia. Website: siinqeebank.com. Siinqee Bank is a licensed Ethiopian financial institution that offers inclusive and innovative bank...
• IKEGAMI TSUSHINKI COMPANY LIMITED September 21, 2026 • [ ransomware, manufacturing, technology ] IKEGAMI TSUSHINKI COMPANY LIMITED was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Japan. Website: www.ikegami.co.jp.
• Gomomentum.com September 21, 2026 • [ ransomware, leak, technology ] Gomomentum.com was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-21. Country: United States of America. Website: momentumtelecom.com. Revenue: $221.7 million Momentum is a telecommunications company founded in 2001 that provides cloud-based communication solutions for businesses, specializing in cloud voice services, managed networks, SD-WAN solutions, and Microsoft Teams Phone integration. We gained access to a diagnostic and provisioning tool used by Momentum through a compromised Multi-Service Operator (MSO). Upon reconnaissance, we identified multiple critical vulnerabilities throughout the system. This tool controls internet and voice services for millions of users across global markets. We successfully accessed user data for every MSO, exposing personally identifiable information (PII) for over 7.5 million users. They didn't notice the prolonged access or the customer data dump for a while, but when we started deleting modems they noticed. They kept burning access and we gained it back, they'd burn it again. We removed modem packages for 58,127 users across the United States. That's 58,127 people without internet service right now. Families, businesses, students all cut off from the digital world. This is the direct result of their negligence and failure to secure their systems. These services can be restored immediately with the click of a button on our tool but you must reach out. Momentum management should contact us to discuss resolution.
• Charlottesville Police Department September 21, 2026 • [ ransomware, government ] Charlottesville Police Department was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Government & Defense. Country: United States of America. Website: cpdcareers.com. Status: upcoming | Data size: | Files: 0 files | Deadline: 2026-09-30T00:00:00Z
• Manroc Developments September 21, 2026 Manroc Developments was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: Canada. Website: manroc.com. Manroc Developments Inc. is a leading full-service mining contractor specializing in the Alimak Raise Mining process, with over 30 years of experience in the industry. The company serves the international mining community, having completed over 70 projects across four continents and driven more than 65,000 lateral development meters. Headquartered in Manitouwadge, Ontario, Manroc is committed to building long-term relationships with clients by delivering on promises and ensuring project success through experienced personnel. They also offer a comprehensive training program to support career development in the mining sector. The company headquarters is located in 7 Black Road, Manitouwadge, ON P0T 2C0, Canada. 201-500 Employees
• TrueCore Behavioral Solutions September 21, 2026 • [ ransomware, healthcare ] TrueCore Behavioral Solutions was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Healthcare. Country: United States of America. Website: truecorebehavioral.com. TrueCore Behavioral Solutions is a behavioral treatment provider located in Tampa, FL, specializing in services for at-risk adjudicated youth aged 13-21. Established in 2001, the company is committed to empowering individuals, families, and communities to discover their true potential through quality behavioral health services. They offer residential and outpatient treatment programs that utilize a strength-based approach and evidence-based interventions tailored to the needs of the youth they serve. TrueCore is recognized for its unmatched commitment to helping youth improve their quality of life and achieve personal success. The company headquarters is located in 1907 US-301, Building C, Suite C150, Tampa, FL 33619, United States. 51-200 Employees
• The Money Store September 21, 2026 • [ ransomware, finance ] The Money Store was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Financial Services. Country: United States of America. Website: themoneystore.com. The Money Store is a local mortgage lender based in Hamilton, NJ, specializing in home financing solutions. They offer a variety of loan products including home purchase, refinance, construction, renovation, and home equity loans to cater to diverse client needs. Their services are designed for individuals looking to buy, build, renovate, or refinance their homes. The company aims to simplify the home financing journey with a user-friendly application process and dedicated team support. The company headquarters is located in 30B Vreeland Road, Suite 200, Florham Park, NJ 07932, United States. 201-500 Employees
• Grupolider September 21, 2026 • [ ransomware, manufacturing, retail ] Grupolider was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: Angola. Website: grupolider-ao.com. grupolider-ao.com zoominfo.com/c/grupolider/429885445 Grupolider is an Angolan diversified holding company founded in 1999, headquartered in Catete (Luanda province). The group operates in agriculture, logistics, freight forwarding, construction, and furniture manufacturing, with its flagship business being Novagrolider the largest agricultural producer in Angola. Novagrolider farms around 20,000 hectares of land and produces roughly 150,000 tons of food per year (bananas, vegetables, fruit, and dairy), while the group employs over 3,200 direct staff. The company exports to Portugal, Spain, France, Belgium, Russia, South Africa, and Morocco, and was the first farm in Africa to receive GlobalGAP certification. Estimated annual revenue is around USD 1315 million (Novagrolider alone), though reliable consolidated figures for the private group are not publicly disclosed. Since 2021, after the death of co-founder Joo Macedo, the group has been led by his brother and partner Jos Macedo.