-
Flexmaster
September 7, 2026
•
[ ransomware, manufacturing ]
Flexmaster was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Manufacturing. Country: Canada. Flexmaster, part of the Novaflex Group, specializes in a wide range of flexible ducting solutions including aluminum, stainless steel, and fabric ducting. Their product offerings also include innovative systems like the Platinum Flow gasketed duct and fume vent solutions. The company caters to various clients in the HVAC industry, providing essential accessories and insulation products. Flexmaster is committed to delivering high-quality, reliable ducting systems for diverse applications.
The company headquarters is located in 20 East Pearce Street, Richmond Hill, ON L4B 1B7, Canada. 201-500 Employees
-
Technology Dynamics
September 8, 2026
•
[ ransomware, technology, manufacturing ]
Technology Dynamics was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Technology. Country: United States of America. Established in 1976, Technology Dynamics Inc. is a leading designer and manufacturer of Switching Power Supplies, DC-DC Converters, and DC-UPS Systems for Military, Industrial, and Commercial applications. The company offers a wide range of products including standard, modified, and custom power supplies, with power levels from 50 Watts to 50KW and output voltages from 3.3V to 500 VDC. Known for its high reliability and rugged designs, Technology Dynamics Inc. serves demanding environments and has a strong reputation among defense contractors and industrial firms. Their products are rigorously tested to meet military standards, ensuring they are suitable for various applications worldwide.
The company headquarters is located in 100 School Street, Bergenfield, NJ 07621, United States. 51-200 Employees, Data includes full solidworks designs and firmware source codes.
-
BAYMER
September 9, 2026
•
[ ransomware, manufacturing ]
BAYMER was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Important documents [Size: 1.4 GB | Sector: Other]
-
Universal Starch-Chem Allied Ltd
September 9, 2026
•
[ ransomware, manufacturing ]
Universal Starch-Chem Allied Ltd was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: India. important documents [Size: 3.5 GB | Sector: Other]
-
Jet Specialty
September 9, 2026
•
[ ransomware, manufacturing ]
Jet Specialty was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: United States of America. Website: www.jetspecialty.com.
-
Specchem LLC
September 9, 2026
•
[ ransomware, manufacturing, financial ]
Specchem LLC was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: United States of America. Website: specchem.com. About Specchem LLC Specchem LLC is a U.S.-based supplier of concrete repair materials, flooring products, and chemical admixtures. The company offers a range of cementitious and epoxy-based systems. Their distribution network covers domestic commercial and industrial contractors. A cyberattack on Specchem LLC resulted in a massive data breach. As a result of the incident, approximately 500 GB of datacontaining roughly 700,000 files, including confidential personal and financial informationwas stolen.
-
Bosnia and Herzegovina Mine Action Center
September 9, 2026
•
[ ransomware, government, leak ]
Bosnia and Herzegovina Mine Action Center was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Government & Defense. Country: Bosnia & Herzegovina. important documents [Size: 1.7 GB | Sector: Other]
-
Kyodo USA
September 9, 2026
•
[ ransomware, manufacturing ]
Kyodo USA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: United States of America. Kyodo USA is a leading distributor of marine engine spares and ship operation equipment, boasti
ng over 20 years of experience in the international maritime industry. The company serves over
300 clients across more than 100 countries, providing a highly diversified product line and rel
iable services.
We will upload 30gb of corporate data soon. Detailed employee personal docs scans (DLs, passpor
ts, SSNs and other information), contacts and agreements, financials, confidential files, custo
mer files, projects, NDAs and so on.
-
RelyComply AML Platform
September 9, 2026
•
[ ransomware, finance, technology ]
RelyComply AML Platform was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: relycomply.com. Financial Software
-
https://mediengruppethiel.de/
September 9, 2026
https://mediengruppethiel.de/ was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Other. Country: Germany. Website: mediengruppethiel.de. Die Mediengruppe Thiel aus Ludwigsfelde ist Ihr verlsslicher Druck- und Werbepartner, wenn es um individuelle Lsungen fr innen und auen geht. Ob eindrucksvolle Printprodukte, mageschneiderte Werbetechnik oder professionelle Geschftsausstattung bei uns erhalten Sie alles aus einer Hand.
Dank unseres breiten Leistungsspektrums sparen Sie sich Wege, Schnittstellen und Zeit und knnen sich ganz auf Ihr Kerngeschft konzentrieren. Unser engagiertes Team aus Ideengebern, Technik-Profis und Gestaltern begleitet Sie dabei von der ersten Idee bis zur fertigen Umsetzung.
-
Logar Network Solutions
September 9, 2026
•
[ ransomware, technology ]
Logar Network Solutions was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Technology. Country: Brazil. Website: logar.com.br. Logar Network Solutions is a Brazilian managed IT services provider (MSP) that delivers outsourced IT management, cybersecurity, cloud infrastructure, backup and disaster recovery, software licensing, hardware lifecycle management, and custom software development. The company primarily serves medium-sized businesses across multiple industries, offering 24/7 IT monitoring and support. It has served more than 500 companies and operates across six Brazilian states.
-
gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local
September 9, 2026
•
[ ransomware, leak, retail ]
gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local was listed as a victim on the leak site of the embargo ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Agriculture and Food Production. Country: United States of America. Website: gardensalive.com. Gardens Alive, Inc. is a privately held U.S. consumer goods company specializing in direct-to-consumer gardening products, plants, seeds, nursery stock, fertili... - 2tb data
-
cullottalaw.com
September 9, 2026
•
[ ransomware ]
cullottalaw.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Professional Services. Country: United States of America. Website: cullottalaw.com. Cullotta Bravo Law Group is a personal injury law firm based in Aurora, IL, with over 35 years of experience in various legal areas including personal injury, nursing home abuse, and workers compensation.
-
Mitsuwa Trading Co., Ltd
September 9, 2026
•
[ ransomware, retail ]
Mitsuwa Trading Co., Ltd was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Retail & E-Commerce. Country: Japan. Website: e-mitsuwa.com.
-
Aqualogus
September 9, 2026
•
[ ransomware, technology ]
Aqualogus was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Agriculture and Food Production. Website: aqualogus.com. Aqualogus is a private engineering consulting firm that helps communities and businesses solve water-related challenges. They work closely with clients to design smart solutions for hydraulic projects, water resources management, and environmental protection. With years of hands-on experience, their team of skilled engineers creates practical plans that make a real difference in how water systems work and how we care for our environment.
-
amorsaude.com.br
August 22, 2026
amorsaude.com.br was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-08-22. Sector: Healthcare. Country: Brazil. Website: amorsaude.com.br. AmorSade is a rapidly growing network of popular clinics in Brazil that offers medical, dental, and...
-
Air Canada
September 9, 2026
Air Canada was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Transportation. Country: Canada. Website: aircanada.com. aircanada.com zoominfo.com/c/air-canada/3937344 Revenue $16.5 Billion Air Canada We have taken 51409 critical files! Canada's flag carrier and largest airline founded in 1937 as Trans-Canada Air Lines, HQ'd in Montral, ~37,000 employees, 45.3M passengers in 2025, and a founding Star Alliance member. Record revenue: $22.37B CAD in 2025 ($6.27B in Q2 2026 alone, +11%), but a fuel shock (+50.8% per litre) and $388M one-off charges pushed Q2 2026 to a $178M net loss guidance cut, though load factor (87.5%) and Aeroplan (10M+ members), Cargo (+29%) and Sixth Freedom traffic stay strong. Its moat: the most aggressive fleet renewal in its history A321XLRs with Canada's first lie-flat seats on a narrowbody, 787-10s and A350-1000s unlocking "thin" long-haul routes no widebody could fly (Oslo, Shannon, Basel, Dubrovnik, Guangzhou) ahead of Super Bowl 2027 and the LA 2028 Olympics.
-
PharmaEssentia Corporation
September 9, 2026
•
[ ransomware, healthcare, technology ]
PharmaEssentia Corporation was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Healthcare. Country: Taiwan. Website: pharmaessentia.com. pharmaessentia.com zoominfo.com/c/pharmaessentia-corp/145441146 PharmaEssentia Taiwanese global biopharma founded in 2003, known for besremi (ropeginterferon alfa-2b) the first drug developed in Taiwan ever approved by the FDA (2021) and the only polycythemia vera (PV) therapy approved in both the US and EU. Its innovation: a mono-pegylated long-acting interferon dosed every 2 weeks at home, with disease-modifying potential (reducing JAK2V617F mutant allele frequency) a premium rare-disease asset vs. hydroxyurea and Jakafi. Financials: $197M+ revenue in 2024 (~89% gross margin), TPEX-listed (6446) with a ~5x stock rally since 2024; next bets: essential thrombocythemia (ET) Phase 3 and myelofibrosis. Bottom line: the Taiwanese biotech that proved a local startup can take a molecule from out-license to FDA approval and global commercialization a rare-disease champion with an expanding moat.
-
Mesan USA
September 9, 2026
Mesan USA was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Other. Country: United States of America. Website: mesanusa.com. Country: Miami, Florida 33166, US |
Website: mesanusa.com |
Revenue: $5.4 Million |
Industry: Industrial Machinery & Equipment, Manufacturing |
Employees: 10-20 |
Properties: 184 GB (188,562 Files, 26,169 Folders)
-
John Engel Team
September 10, 2026
•
[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
