Recent Breaches
-
October 21, 2026 Jons Civil Engineering Company Ltd. (JCEL) was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Professional Services. Country: Ireland. Website: jonscivil.ie. An Irish construction company specializing in infrastructure. It builds and renovates roads, bridges, rail facilities, water supply and sewer systems, coastal structures, and flood protection syste...
-
October 15, 2026 • smithandcasady.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: United States of America. Website: smithandcasady.com. Inside: a subcontract agreement and insurance requirements from general contractor Charles Perry Partners, Inc. (CPPI, Gainesville); commercial invoices for the export of insulation materials to the U.S. Virgin Islands (HOVENSA LLC, oil refinery, Christiansted); cost estimate sheets for FOAMGLAS, Armaflex, and aluminum jacketing covering dozens of projects from Tampa to Hollywood; bid proposals for the insulation of a Raytheon PCS classified facility, "Classified NE Operations A"; correspondence on the Raymond James Stadium project with Manhattan Construction and BCH Mechanical a dispute ove
-
October 31, 2026 • uaa.mx was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: Mexico. Website: uaa.mx. It provides undergraduate and postgraduate education across a broad range of academic disciplines, including engineering, natural sciences, health sciences, social
-
October 31, 2026 • quevedo-ponce.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Ecuador. Website: quevedo-ponce.com. Headquartered in Quito, the firm serves domestic and international clients, including businesses, investors, entrepreneurs and multinational companies operating in Ecuador
-
October 31, 2026 • Gamdom V2 was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. An Insight into Gamdom's Lies We have given Gamdom multiple chances to communicate, to no avail. They didn't even try to see how much data I have on the people, and have already decided that they will not pay the amount. What does this mean? - The 15.4 million entries will be leaked in the same format as below. - The Perabet data (userid | email | password) will also be leaked along with the Gamdom leak. See sample for the format. - All support chats and photos shared in the support chat are in my possession; see the samples below. - The lies within Gamdom's Provably Fair, part 1 is being leaked today, and part 2 when they choose not to pay (with reproducible evidence). A larger data sample of the original breach will also be attached, since some people are doubting the severity of this case. FELIX ROEMER Founder - Admin uid 16259643 "Felix aka Howly" last IP 13.250.207.55 (Aug 19) net +859,966,343 sats - Legacy supadm uid 3356423 - PHONE +49175804570 - Personal player uid 48242366 ("Felix Roemer", duel4rs@gmail.com, same phone) +49175804570 He changed his number 24 hours ago, as a result of this breach. This was his main number prior. PF: What their own code actually shows: 1. The crash game has no player seed. Provably fair normally means you add your own seed and results are computed from your seed plus theirs. In Gamdom's crash game the seed is one fixed constant hardcoded into the game file. It is the same for every player, every round, forever. Nothing about a round depends on you, and the house can know every upcoming result before anyone places a bet. 2. The crash formula carries a hidden house cut. The math in their code includes a term (a divide by 50) that is not part of the fair formula they describe publicly. There is also a built-in 1 in 100 chance that every round instantly crashes at 1.00x. Running their own formula, the real average return to players is about 97.8 percent, and it gets worse depending on where you cash out. 3. The payout rate is a live setting, not a fixed rule. Admins can change the house edge from a control panel, and the change even overrides the payout rate advertised by game providers. A game can be listed at one payout number and quietly repriced later. 4. For roulette and hilo, their own code comment admits the result mapping is "slightly biased because of modulo." They knew and wrote it down. 5. For dice, the player's seed is never saved to the database, so the "verify your result" feature cannot actually be used after the round. 6. The code also lets the system cut a crash round short and force-cash everyone out when total payouts hit a cap calculated from the live bets on the table. TL;DR: The help page promises "the server seed is secret until reveal, nobody, the house included, can know your next result". Reality: the database stored the raw seed next to the hash, the crash game shipped with a fixed public seed so the house could see every result in advance, and the house edge was a runtime dial. That is not provably fair. That is trust-me with extra steps. The live crash game file at gamdom.com/build/Crash.route.BBLHNSNC.js contains the fixed seed and the formula. Download it and read it yourself. Perabet serves the same file on perabet.com with only the logo changed. <- which they might have changed after I called them out, but I hold artifacts from 13 October. This means they had been running unfairly, while knowing the outcome of EVERY roll/bet (besides Live Casino) from 2016 until October 2026. Finding: 51 dice rolls across 3 accounts, plus 18 and 16 rolls on 2 more, every outcome predicted correctly before the round finished; any staff member with read access can see the same data and act on it. Sample of their own code attached. All arti Originals from the live system, captured and SHA-256 sealed at the time, independently recomputable by anyone. Changes made now cannot rewrite a timestamped capture, they only add to the record. The full evidence package goes to independent journalists and researchers for re-verification. Maybe all of this is the reason why out of the ~16 million entries only 199 users (with around 30% being streamers/staff members) have realized a net profit of 1 BTC+ This is your last chance to reach out to us, Gamdom.
-
October 31, 2026 • SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Government & Defense. Country: Germany. SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) is a state-owned land development company belonging to the German federal state of Saxony-Anhalt. The organization specializes in urban and regional planning, brownfield redevelopment, land resource management, and the support of infrastructure projects. It operates as a service partner for local municipalities, coordinating and implementing spatial development programs in the interests of the public sector.
-
October 31, 2026 • Straze Garden Center was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Straze Garden Center is a German company operating a garden center and an online store for gardening supplies. The business specializes in selling indoor and outdoor plants, planting materials, soils, fertilizers, and garden tools. It provides on-site retail sales as well as order delivery across Germany.
-
September 1, 2026 • Italtel Peru was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Peru. [AI generated] Italtel Peru is a subsidiary of Italtel, an Italian telecommunications technology company. Operating in Peru, it provides ICT solutions including network infrastructure, system integration, and telecommunications services. The company serves enterprise and public sector clients, offering digital transformation, unified communications, and managed services. It operates within the telecommunications and information technology industry in the Peruvian market.
-
September 1, 2026 • Rise UP was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Website: riseup.ai.
-
September 1, 2026 • Lawter was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Manufacturing. Country: United States of America. Website: lawter.com. Organization with 150 emails extracted. Domain: lawter.com
-
September 1, 2026 • transportesmontejo.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Transportation. Country: Mexico. Website: transportesmontejo.com. Transportes Montejo S.A.S. is a Colombian specialized heavy transport and logistics company established on June 7, 1988,...
-
September 1, 2026 • meccahighfeed.blogspot.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Agriculture and Food Production. Country: Saudi Arabia. Website: meccahighfeed.blogspot.com. (Mecca High Feed Factory) is an Egyptian animal feed manufacturing compan...
-
September 1, 2026 • jswlaw.bt was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Professional Services. Country: Bhutan. Website: jswlaw.bt. Jigme Singye Wangchuck School of Law (JSW Law) is Bhutan's first and only law school, established by Royal Charter on Fe...
-
September 1, 2026 • REXT Holdings Co., Ltd. was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Japan. Website: www.rext.jp. Private retail and holding company based in Tokyo, Japan.
-
July 24, 2026 BYK Construction was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-07-24. Sector: Manufacturing. Country: United States of America. Website: bykconstruction.com. BYK Construction is a trusted home builder based in Mount Vernon, Washington, specializing in r esidential and commercial construction, land development, property management, and home mainten ance. We will upload 27gb of corporate data and their client soon. Employee personal information (pas sport numbers, SSNs, DLs, financial information), clients information, company financials, proj ects (specifications) and so on.
-
September 1, 2026 • Szechenyi Programiroda Nonprofit Kf was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Hungary. Szechenyi Programiroda Nonprofit Kf
-
September 1, 2026 • Total Education Solutions was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Education. Country: United States of America. Website: tesidea.com. TES IDEA provides personalized educational, therapeutic, and developmental solutions that help students, families, and schools achieve better outcomes.
-
September 1, 2026 • Congressional Iron Works was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Manufacturing. Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci al construction industry in the greater Baltimore-Washington area. Established in 2004, the com pany offers a range of services including estimating, drafting, fabrication, and project manage ment, focusing on steel and architectural metals components such as structures, stairs, and can opies. We will upload 35gb of corporate data soon. Employee personal information (passport numbers, SS Ns, DLs, financial information, health information), clients information, company financials, p rojects, NDAs.
-
August 14, 2026 • Algra Group was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Other. Country: Switzerland. Website: algragroup.ch. Algra Group specializes in customized input systems, front panels, and industrial labels, provi ding tailored solutions for various industries. Their product range includes agnostic touch sys tems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation, wellness, medical technology, and transportation. We will upload corporate data soon. Employee personal information (passport numbers, DLs), clie nts and partners information, contacts and agreements, financials, NDAs.
-
September 2, 2026 • ScrubaDub Auto Wash Centers was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Retail & E-Commerce. Country: United States of America. ScrubaDub Car Wash is New England's leading auto wash, offering customizable tunnel and touchle ss washes, interior cleaning, and detailing services across over 20 locations in Massachusetts, New Hampshire, Maine, and Rhode Island. We will upload corporate data soon. Employee personal information (passport numbers, DLs of 22 employees, contact information), clients information (addresses, contacts and so on), company f inancials, payment details.