-
BeLi Teacher / FSC education centers (AWS)
September 18, 2026
•
[ ransomware, education, technology ]
BeLi Teacher / FSC education centers (AWS) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: Vietnam. Website: beliteachers.com. Education / edtech Vietnam | The complete CRM lead database: 152,044 contact records names, emails, +84 phone numbers, cities, study interests, engagement history; The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 02:47 UTC]
-
Konnatus (usucapião legal services)
September 18, 2026
Konnatus (usucapio legal services) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Professional Services. Country: Brazil. Legal services / real estate Brazil | The application database: chart of accounts, income/outflow structures, account types; User accounts with password hashes | Publication proceeds after the deadline. | [ACTIVE: deadline 2026-09-20 03:32 UTC]
-
STOKR (digital securities platform)
September 18, 2026
STOKR (digital securities platform) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: Luxembourg. Website: stokr.io. Digital securities / investment platform Luxembourg - EU | KYC investor register: full names, emails, countries, nationalities, wallet addresses and tax IDs where present; Identity-to-crypto-wallet mapping of KYC-accepted investors (FR, DE, CH, BE, NL, UK and others); Internal platform admin directory with staff accounts and roles | The investor data will also be delivered to the tax authorities of the investors' countries. | [ACTIVE: deadline 2026-09-20 22:40 UTC]
-
AstraZeneca Türkiye
September 18, 2026
•
[ ransomware, healthcare, manufacturing ]
AstraZeneca Trkiye was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: Turkey. Website: astrazeneca.com.tr. Pharmaceutical manufacturing (GxP) Trkiye | Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings; 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications | All sites are enforcing a total network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
-
Argentem Creek Partners (investment firm)
September 18, 2026
•
[ ransomware, finance, technology ]
Argentem Creek Partners (investment firm) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: argentemcreek.com. Investment management / private credit United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
-
Ministry of Education — Argentina
September 18, 2026
•
[ ransomware, government, education ]
Ministry of Education Argentina was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: Argentina. Website: argentina.gob.ar. Government / education Argentina | Complete network-security configuration of the ministry network; 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becasprogresar), titulosvalidez, certificadosinfd, sitrared; Evidence of the Monero cryptocurrency miner operating inside the ministry network | The ministry network is under a total blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
-
PayPal support operations (Transcom WorldWide)
September 18, 2026
•
[ ransomware, finance, technology ]
PayPal support operations (Transcom WorldWide) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: Sweden. Website: transcom.com. Outsourced customer support / financial services Netherlands / Tunisia | 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems; Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites | All 8 sites are enforcing a network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
-
Prefix Corp
September 18, 2026
•
[ ransomware, manufacturing ]
Prefix Corp was listed as a victim on the leak site of the securotrop ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: United States of America. Website: www.prefix.com. Status: AWAITING
Size: 1135 GB
-
Paid Victim 192EB2B6AD7B98D9
September 18, 2026
•
[ ransomware ]
Paid Victim 192EB2B6AD7B98D9 was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-09-18. Country: Russian Federation. [AI generated] N/A
I don't have any reliable information about a company named "Paid Victim 192EB2B6AD7B98D9." This appears to be an anonymized or coded identifier, possibly from a ransomware leak site or threat intelligence feed, rather than an actual company name. Without access to the specific database or source that generated this identifier, I cannot provide factual details about its operations, industry, or country.
-
kit-e.jp
September 9, 2026
kit-e.jp was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Technology. Country: Japan. Website: kit-e.jp. No data breaches
-
Premier Lighting & Controls
September 18, 2026
Premier Lighting & Controls was listed as a victim on the leak site of the Gammax ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: premierlight.com. Premier Lighting & Controls is a full-service commercial lighting agency. It serves architects, contractors, distributors, building owners, and en...
-
Inter (Venezuela's largest internet provider)
September 18, 2026
Inter (Venezuela's largest internet provider) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Venezuela (Bolivarian Republic of). Website: inter.com.ve. Telecommunications / ISP Venezuela | Subscriber connection records: 15,300,000+ entries, tens of thousands of subscriber addresses with the services they contacted; Complete internal network map across all regional operations; Core infrastructure configuration evidence | Network traffic remains severed until settlement. | [ACTIVE: deadline 2026-09-20 18:39 UTC]
-
PITTSRAD
September 18, 2026
•
[ ransomware, healthcare ]
PITTSRAD was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: United States of America. Website: pittsrad.net. [AVAILABLE DATA] Radiology and health imaging, client personal and health data.
-
Barrett Mahony Consulting Engineers
September 18, 2026
•
[ ransomware, leak, technology ]
Barrett Mahony Consulting Engineers was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Professional Services. Country: Ireland. Website: www.barrettmahony.com. Ireland
-
Inglewood Golf
September 18, 2026
•
[ ransomware, retail ]
Inglewood Golf was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Hospitality. Country: Canada. Website: www.inglewoodgolfclub.ca. Canada
-
Vista Plastic Solutions
September 18, 2026
•
[ ransomware, manufacturing ]
Vista Plastic Solutions was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: Canada. Website: www.vistahelps.com. Canada
-
forus.cl
May 13, 2026
•
[ ransomware, retail ]
forus.cl was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-05-13. Sector: Professional Services. Country: Chile. Website: forus.cl. Founded in 1980 and headquartered in Santiago, Chile, Forus is a provider of apparel. The company pr...
-
hygear.com
September 11, 2026
•
[ ransomware, healthcare, energy ]
hygear.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-11. Sector: Healthcare. Country: Germany. Website: hygear.com. yGear specializes in providing reliable and affordable on-site and on-demand hydrogen and industrial...
-
K3G Solutions Brazil
September 18, 2026
•
[ ransomware, technology ]
K3G Solutions Brazil was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Brazil. Website: k3gsolutions.com.br. K3G Solutions is a Brazilian telecom/IT consulting company based in Manaus, providing network engineering, ISP support, monitoring, call-center, CDN, and colocation services.
-
Quest Group
September 18, 2026
•
[ ransomware, technology, leak ]
Quest Group was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: United States of America. Website: questgroupsearch.com. Employee data, internal files, and a few unexpected discoveries.
