Recent Breaches
-
September 18, 2026 • Giti Corp was listed as a victim on the leak site of the killsec ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: Singapore. Website: giti-corp.com.
-
September 18, 2026 • ANYTHINGIT was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Website: www.anythingit.com. Certified IT Asset Disposition (ITAD) and e-waste management for federal agencies, defense contractors, and enterprise organizations demanding the highest chain-of-custody standards.
-
September 18, 2026 • AT&T was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: United States of America. Website: att.com. Revenue: $125.6 billion Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!
-
September 18, 2026 • Accela.com was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: United States of America. Website: Accela.com. Revenue: $144.4 million Accela is a comprehensive cloud based software platform used by state and local governments to manage internal agency operations. We have successfully extracted over 50 GB of data from Accela. Data includes over 2 million lines of user data with PII, and 6 million user requests (from their citizen engagement portal where citizens report everyday non-emergencies in/around their neighbourhoods) also with PII. There is a lot of government data, from FBI agents to cops to regular government workers. Speak soon or Leak soon!
-
September 18, 2026 • First Secure Bank and Trust was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: firstsecurebank.com. First Secure Bank and Trust was founded in Palos Hills, Illinois in 1977 to serve the financial needs of the company's friends and neighbors. Today, the company is still in the neighborhood and continuing with that mission. The company is the only "true" locally owned bank in the area. The company care about the community because the company live here, too. This local knowledge and commitment gives the company a tremendous advantage when it comes to helping you with your financial needs. Other nearby bank branches have headquarters miles away and employees that move from location to location as the need arises. The company is always here to listen to you and then use the company's years of experience to help you achieve your financial goals, whether it is a simple free checking account or sophisticated investment advice. The company will always give you the right service-right here, right now. The company headquarters is located in 10360 S Roberts Road, Palos Hills, IL 60465, United States. 11-50 Employees
-
September 18, 2026 • The State Bank was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: thestatebankgroup.com. The State Bank Group is comprised of Wonder Lake State Bank (east), Wonder Lake State Bank (west), Johnsburg State Bank, Spring Grove State Bank, Lakemoor State Bank and Hebron State Bank. The company is proud to have directorship of local business owners and professionals. It has always been the company's focus as a community bank to provide the best banking services available. The company has selected the company's banking locations by identifying areas that were at the time unserviced. Therefore, each of the company's bank locations represents the first bank in their respective community. The company's group of banks has grown since the company's inception in 1979. The company currently have a staff of more than 80 employees. In addition to myself, the company has a teller who has been servicing the company's customers banking needs since 1979. The company thrive on building relationships with the company's customers and believe the company's slogan, "Bank Where You're Known", promotes the company's continuing mission and commitment to providing true "Community Banking". The company's extended lobby and drive-up hours provide the company's customers with the most flexible banking hours in McHenry County. All of the company's locations are full service banks, staffed with loan officers and new accounts representatives. In addition, all the company's locations have safe deposit boxes. Each of the company's loan officers have "real" lending authority, meaning that you will always be dealing with the decision makers. This makes your experience both personal and efficient. To the company's customers who are visiting the company's web site, "Thank You Very Much". If you are not currently a customer, the company invite you to "Bank Where You're Known". The company headquarters is located in 7526 Hancock Drive, Wonder Lake, IL 60097, United States.11-50 Employees
-
September 18, 2026 First Secure Community Bank was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: 1stsecurebank.com. First Secure Community Bank is a locally-owned financial institution based in Sugar Grove, Illinois, offering a range of personal and business banking services. Their product offerings include residential lending, personal and business credit cards, and interest-bearing accounts such as CDs and IRAs. The bank focuses on meeting the financial needs of local residents and businesses, ensuring convenience and security in managing finances. Established in 2000, First Secure Community Bank has become a trusted fixture in the community, dedicated to helping clients achieve their financial goals. The company headquarters is located in 670 Sugar Grove Parkway (Route 47), Sugar Grove, IL 60554, United States. 11-50 Employees
-
September 18, 2026 • Johnson Investment Counsel was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: johnsoninv.com. Johnson Investment Counsel is an independent, employee-owned wealth management firm founded in 1965 and headquartered in Cincinnati, Ohio. The company provides comprehensive financial services to individuals, families, businesses, corporations, retirement plans, foundations, and nonprofit organizations. Its services include investment management, financial planning, retirement and cash-flow planning, estate planning, trust services, charitable planning, and business solutions. Johnson Investment Counsel operates as a fee-only Registered Investment Advisor and emphasizes fiduciary responsibility, long-term relationships, and customized financial strategies. As of June 30, 2026, the firm manages approximately $23 billion in assets and has 159 employees, serving clients across all 50 U.S. states. The company headquarters is located in 7755 Montgomery Road, Suite 180, Cincinnati, OH 45236, United States.51-200 Employees
-
September 18, 2026 • American Casting Company was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: americancastingco.com. American Casting Company is an ISO 9001 and AS9100 certified investment casting foundry located in Hollister, California, specializing in premier quality investment castings for the aerospace and medical industries. The company offers a variety of castings made from super alloys and other high-performance materials, ensuring the industry's shortest lead times through advanced manufacturing processes, including 3D printing and vacuum melting. Their services include design for manufacturability, NADCAP heat treating, and non-destructive testing, catering to clients in sectors such as medical, aerospace, defense, and industrial applications. With a focus on innovation and quality, American Casting Company commits to delivering precise, durable, and strong investment castings perfect for complex geometries. The company headquarters is located in 205 Apollo Way, Suite A, Hollister, CA 95023, United States. 51-200 Employees
-
September 18, 2026 • Inland and Offshore Contractors was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Energy & Utilities. Country: Trinidad & Tobago. Website: www.iocltt.com.
-
September 18, 2026 • Grupo Juste was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Mexico. Website: www.grupojuste.com.
-
September 18, 2026 • Futuro Forestal was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Chile. Website: www.futuroforestal.com.
-
September 18, 2026 • Ceres Tolvas was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Argentina. Website: www.cerestolvas.com.ar.
-
September 18, 2026 • Ascend Com was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Singapore. Website: www.ascendcom.com.sg.
-
September 18, 2026 • www.kendallhunt.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: www.kendallhunt.com. Founded in 1944, Kendall Hunt Publishing is a publisher of hands-on, inquiry-based science, mathematics, and gifted curricula for grades PreK-12. Their research and standards-based programs are available in both print and digital components that encompass students, teachers, and parents. Kendall Hunt is headquartered in Dubuque, IA.
-
September 18, 2026 • www.roancampingholidays.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Hospitality. Country: Netherlands. Website: www.roancampingholidays.com. Roan Luxury Camping Holidays is a Dutch tour operator specializing in deluxe mobile home and tent rentals at 4- and 5-star campsites across Europe
-
September 18, 2026 • Anderson Industries was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: anderson-industries.com. Anderson Industries is a cutting-edge engineering and manufacturing company that assists forwar d-thinking businesses in bringing innovative products to market. They offer a range of products including agricultural equipment, trailers, and foundry services. We will upload 9gb of corporate data soon. Employee personal information, client information, l ots of projects, specifications, orders, financials, NDAs and so on.
-
September 18, 2026 MPA Pharma was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: Germany. Website: mpapharma.de. MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accounting records and database backups, government audits (customs / corporate tax / social security / wage tax),corporate ownership (nominee structure, beneficial-ownership filings, related-party payments), narcotics/BtM records (opioids, cannabis, precursors),litigation files, executive and employee personal data, IT artifacts, pharmacovigilance correspondence.Credit cards with CVV of executives, Oltersdorf ID card valid until 2030, the Pfeiffer letter on the hidden Paranova Pack B.V., UBO passportsSQL backups (17.7 million general-ledger rows), commercial register extract (HRB), organizational chartCredentials (TIER 1) - a list of all password files (values not repeated here, stored in the MPA PASSWORDS report)Government audits - customs 17,011.77 EUR with a breakdown, corporate tax +202,203.18 EUR, social security (DRV) 23,134.96 EUR with a separate case against the managing director, wage-tax auditNarcotics (BtM) - permits (318 04 74), reconciliations of 588 rows / 93 differences, fentanyl, hydromorphone, oxycodone, tapentadol, unexplained remainders of 1-13 units, documentation gap 2017-2020, cannabis up to 22 percent THC, precursorsLitigation - MSD/Merck memo, settlement agreement, Amgros judgment 5,180,043.09 DKK, complaint to the Ministry of Health, arbitration filingPeople, security, pharmacovigilance, bulk financial recordsArtifacts - leadership phone book, employee medical documents, Eli Lilly 2025, AstraZeneca, rebate contracts, a list of all produced reports More
-
September 18, 2026 • United Federation of Teachers was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: uft.org. Education / Labor Union US New York | The unions complete legal case archive approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named for a member; Contract documents: CBAs, MOUs, MOAs and side letters; Nurse-federation and health-benefit-fund case materials; Teacher evaluation and class-size complaint files; Staff search and case-view audit logs | Publication proceeds in batches after the deadline. The victim can verify everything and settle in their private negotiation room. | [ACTIVE: deadline 2026-09-19 14:58 UTC]
-
September 18, 2026 Vietnamese betting operator (GC789 network / Boundless TE) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Vietnam. Online gambling / agent platform Vietnam / Switzerland | The complete bettor database: 2,021,011 registered bettors with names, +84 phone numbers, email addresses, deposit and withdrawal amounts; The full agent network: 39,998 agent accounts, hierarchy, balances, credit lines and commission ladders; 85 million login records with IP addresses and device identifiers; Daily trading and P&L data per provider; The fraud stack: 33,000+ blacklisted emails and phones, arbitrage and odds-mover reports, multi-account detection rules | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 01:37 UTC]