-
amorsaude.com.br
August 22, 2026
amorsaude.com.br was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-08-22. Sector: Healthcare. Country: Brazil. Website: amorsaude.com.br. AmorSade is a rapidly growing network of popular clinics in Brazil that offers medical, dental, and...
-
Air Canada
September 9, 2026
Air Canada was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Transportation. Country: Canada. Website: aircanada.com. aircanada.com zoominfo.com/c/air-canada/3937344 Revenue $16.5 Billion Air Canada We have taken 51409 critical files! Canada's flag carrier and largest airline founded in 1937 as Trans-Canada Air Lines, HQ'd in Montral, ~37,000 employees, 45.3M passengers in 2025, and a founding Star Alliance member. Record revenue: $22.37B CAD in 2025 ($6.27B in Q2 2026 alone, +11%), but a fuel shock (+50.8% per litre) and $388M one-off charges pushed Q2 2026 to a $178M net loss guidance cut, though load factor (87.5%) and Aeroplan (10M+ members), Cargo (+29%) and Sixth Freedom traffic stay strong. Its moat: the most aggressive fleet renewal in its history A321XLRs with Canada's first lie-flat seats on a narrowbody, 787-10s and A350-1000s unlocking "thin" long-haul routes no widebody could fly (Oslo, Shannon, Basel, Dubrovnik, Guangzhou) ahead of Super Bowl 2027 and the LA 2028 Olympics.
-
PharmaEssentia Corporation
September 9, 2026
•
[ ransomware, healthcare, technology ]
PharmaEssentia Corporation was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Healthcare. Country: Taiwan. Website: pharmaessentia.com. pharmaessentia.com zoominfo.com/c/pharmaessentia-corp/145441146 PharmaEssentia Taiwanese global biopharma founded in 2003, known for besremi (ropeginterferon alfa-2b) the first drug developed in Taiwan ever approved by the FDA (2021) and the only polycythemia vera (PV) therapy approved in both the US and EU. Its innovation: a mono-pegylated long-acting interferon dosed every 2 weeks at home, with disease-modifying potential (reducing JAK2V617F mutant allele frequency) a premium rare-disease asset vs. hydroxyurea and Jakafi. Financials: $197M+ revenue in 2024 (~89% gross margin), TPEX-listed (6446) with a ~5x stock rally since 2024; next bets: essential thrombocythemia (ET) Phase 3 and myelofibrosis. Bottom line: the Taiwanese biotech that proved a local startup can take a molecule from out-license to FDA approval and global commercialization a rare-disease champion with an expanding moat.
-
Mesan USA
September 9, 2026
Mesan USA was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Other. Country: United States of America. Website: mesanusa.com. Country: Miami, Florida 33166, US |
Website: mesanusa.com |
Revenue: $5.4 Million |
Industry: Industrial Machinery & Equipment, Manufacturing |
Employees: 10-20 |
Properties: 184 GB (188,562 Files, 26,169 Folders)
-
John Engel Team
September 10, 2026
•
[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
-
HARLEY-DAVIDSON.COM
September 10, 2026
•
[ ransomware, manufacturing, automotive ]
HARLEY-DAVIDSON.COM was listed as a victim on the leak site of the clop ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Manufacturing. Country: United States of America. Website: HARLEY-DAVIDSON.COM. [AI generated] Harley-Davidson is an American iconic motorcycle manufacturer headquartered in Milwaukee, Wisconsin, USA. Founded in 1903, the company designs, manufactures, and sells heavyweight motorcycles, related parts, accessories, and branded merchandise. It operates globally across the powersports and automotive industry. Its website serves as a digital hub for product information, dealer locators, community engagement, and e-commerce for enthusiasts worldwide.
-
HENRYPRATT.COM
September 10, 2026
•
[ ransomware, manufacturing ]
HENRYPRATT.COM was listed as a victim on the leak site of the clop ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Manufacturing. Country: United States of America. Website: HENRYPRATT.COM. [AI generated] Henry Pratt Company is a US-based manufacturer specializing in industrial valves, including butterfly valves, gate valves, and check valves. Operating within the flow control and fluid handling industry, the company serves water, wastewater, and industrial markets. Headquartered in Aurora, Illinois, it is a subsidiary of McWane Inc. and supplies infrastructure and municipal water systems across North America.
-
EASY JOB S.A.S.
September 10, 2026
•
[ ransomware, finance, leak ]
EASY JOB S.A.S. was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: Colombia. Website: easyjobsas.com. Colombian Company.
Audit and Tax Audit with more than 5 years of experience
Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medelln Colombia.
Llmanos o escrbenos: 310 447 2013 - 313 796 9917
The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents
17000 documents [Size: 2.7 GB | Sector: Finance]
-
George Cameron Nash
August 26, 2026
George Cameron Nash was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-26. Website: georgecameronnash.com. George Cameron Nash Interior Design operates showrooms in Dallas and Houston, Texas, specializi
ng in high-end furniture and lighting. They represent a diverse range of brands, including Alex
ander Lamont, Chelsea Textiles, and Rubelli, offering products such as outdoor furniture, fabri
cs, textiles, and wall coverings.
We will upload corporate data soon. Employee personal information, customer information, contra
cts.
-
Eagle Construction
September 10, 2026
Eagle Construction was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Manufacturing. Eagle Construction specializes in building quality new homes across Virginia, offering a variet
y of communities, floor plans, and quick move-in options. Their services cater to a diverse cli
entele, including families and individuals looking for single-family homes, townhomes, and 55
communities.
We will upload 70gb of corporate data soon. Detailed employee personal information (passports,
DLs, SSNs, w-9 forms), internal confidential files, projects, clients information and so on.
-
AK Stamping
August 19, 2026
•
[ ransomware, manufacturing, leak ]
AK Stamping was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-19. Sector: Manufacturing. Website: akstamping.com. AK Stamping is a leader in precision metal stamping technology, offering engineered design solu
tions and a complete package of manufacturing capabilities, including prototyping, tooling, and
precision stamping for various manufacturing scales.
We will upload 30gb of corporate data soon. SQL and other internal files.
-
jms building corporation
September 10, 2026
jms building corporation was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Manufacturing. Country: United States of America. JMS Building Construction is a full service Insurance Restoration construction company that handles every step of the Insurance Restoration process,
from dealing with your insurance company to restoring your home's integrity
WE HAS COLLECTED SUCH DATA AS:
- Confidential documents
- Clients Data
- NDA
- Financial data
- Operations
- Corporate data
- Business Agreements
- Development
- Financial databases, all transactions, all clients
And a lot of other VERY IMPORTANT information!
-
Goldston Oil Corporation
September 10, 2026
•
[ ransomware, energy ]
Goldston Oil Corporation was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Energy & Utilities. Country: United States of America. Goldston Oil Corporation is a Houston-based oil and gas exploration and production company operating in Texas and Louisiana
-
On Demand Occupational Medicine
September 10, 2026
•
[ ransomware, healthcare ]
On Demand Occupational Medicine was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Healthcare. Country: United States of America. On Demand Occupational Medicine provides occupational health, drug testing, workplace safety, and employee wellness services in Austintown, Ohio.
-
NcbChurch
September 10, 2026
•
[ ransomware ]
NcbChurch was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Other. Country: United States of America. New Covenant Believers Church is a faith-based ministry focused on spiritual, emotional, and mental growth through Gods Word
-
artiflexmfg.com
September 10, 2026
•
[ ransomware, manufacturing ]
artiflexmfg.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Manufacturing. Country: United States of America. Website: artiflexmfg.com. ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica
-
mankatoclinic.com
September 10, 2026
mankatoclinic.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Healthcare. Country: United States of America. Website: mankatoclinic.com. The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea
-
California School Employees Association
August 21, 2026
•
[ ransomware, education ]
California School Employees Association was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-08-21. Sector: Education. Country: United States of America. Website: www.csea.com. The California School Employees Association (CSEA) is dedicated to supporting classified school employees and advocating for public education. They offer a range of member benefits including financial services, legal help, and educational resources. CSEA aims to protect the rights of its members while promoting quality education for students. Their intended clients include school employees, retirees, and individuals interested in joining their advocacy efforts.
-
Professional Retail Services
September 10, 2026
Professional Retail Services was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Retail & E-Commerce. Professional Retail Services Owners documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFOs documents: client credit reports, bankruptcy records, tax documents, fathers medical records (guardianship court case)Corporate financials: owners personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More
-
General Santos Doctors Hospital
September 10, 2026
•
[ ransomware, healthcare, finance ]
General Santos Doctors Hospital was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Healthcare. Country: Philippines. General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data personal cell numbers of the president, hospital administrator and board members More
