Recent Breaches
-
September 1, 2026 • dmt-group.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Germany. Website: dmt-group.com. DMT Consulting Private Limited is an Indian private limited company incorporated on September 25, 1998, formerly known a...
-
September 1, 2026 • tum.com.mx was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Education. Country: Mexico. Website: tum.com.mx. TUM Transportistas Unidos Mexicanos Divisin Norte, S.A. de C.V. is the largest trucking company in Mexico, founded in ...
-
October 27, 2026 • Burris & MacOmber was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. [AI generated] N/A I don't have reliable, verifiable information about a company called "Burris & MacOmber." I'm not able to confirm its existence, industry, operations, or location, and providing fabricated details would be inaccurate and potentially misleading for threat intelligence purposes. If you have additional context or source material about this entity, I'd be glad to help analyze it.
-
October 27, 2026 • OR Technology was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Technology.
-
October 27, 2026 • Charter Township of Commerce was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Government & Defense. Country: United States of America. Website: www.commercetwp.com. Government Administration Stolen data: 155 GB.
-
October 27, 2026 • Hygiena was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Healthcare. Country: United States of America. Website: www.hygiena.com. United States
-
October 27, 2026 • VPC Builders was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Country: United States of America. Website: www.vpcbuilders.com. United States
-
October 28, 2026 • wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence: 1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json). 2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json). Evidence to support this can be found below:
-
October 28, 2026 • Meleghy Automotive & Cie. GmbH was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: Germany. Website: Meleghy Automotive & Cie. GmbH. [automotive] The exposed material includes: Passport/visa/student-admission dossiers Tesla Model Y/Opal tooling, CAD and DFM tree Employee contract and HR folders
MEB/BMW NCAR metrology and plant-layout trees PLC/SPS/robot backups and cross-reference DBs TISAX/IATF audit and corrective-action records Restricted management meeting/WLAN record Browser profile SQLite databases -
October 28, 2026 • Insurance Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a uto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv es over 20,000 policyholders across Ontario. We will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs and other personal docs), projects (client personal information and other documents (~250 perso ns (DL numbers, name, addresses, phones and so on)), contracts and agreements, NDA, etc.
-
October 28, 2026 • Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
-
October 28, 2026 L... was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-28. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).
-
October 28, 2026 T... E... was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-28. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).
-
October 29, 2026 • ClaimTek Systems was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Financial Services. Website: claimtek.com. ClaimTek Systems ClaimTek Systems specializes in preparing individuals for successful entry into the medical billing and practice management business with a comprehensive training and support system. They offer a range of scalable products and services, including state-of-the-art billing software and marketing tools, targeted towards aspiring entrepreneurs in the healthcare industry. More
-
October 29, 2026 • MAA Group Consulting Engineers was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975, with over 1,000 professionals operating across East and Southeast Asia. The group provides comprehensive integrated solutionsranging from conceptual planning and engineering design to project managementacross infrastructure, buildings, land resources, environment, and information technology. Renowned for its industry-leading expertise in Building Information Modeling (BIM), MAA Group has successfully completed major high-speed rail, mass rapid transit (MRT), and tunnel projects throughout Taipei, Hong Kong, Bangkok, and Singapore. The client data and internal documents youve leaked go well beyond what youve seen here. We have taken several terabytes of filesthis is just a small sample. In fact, we have obtained sensitive documents pertaining to virtually all of your clients. Warning: You have 3 days to enter negotiations. Once the deadline passes, the negotiation window will be permanently closed and all exfiltrated data will be published. Additionally, the encrypted data will be rendered completely unrecoverable. sample files: https://mega.nz/file/CgxxTKCZ#PzGFlZt67HDF2oLsP4jn_W_QdrquHJpNAfVm-jXGYxo https://mega.nz/file/2ogzwAyY#r8F31SFQTqyW6bzQA-e8HNzgw-rEW_gn7fhwY5TAByg https://mega.nz/file/2gIRXQwY#-4IzU70FjqvSYotZoaJuod_H2P5sXoGTvsja9Patte0 https://mega.nz/file/alQU0JaT#2GgaPb1Z-z1xB1FfAd_NohXbfkbfRfhfZ_OwtxPd0cc [Sector: Construction]
-
October 29, 2026 • Programs for Parents, Inc. was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Education. Country: United States of America. Website: www.programsforparents.org. Non-profit Organizations Stolen data: 95 GB.
-
October 28, 2026 • Udima was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Education. Country: Spain. Website: www.udima.es.
-
October 29, 2026 • corp-smart.com was listed as a victim on the leak site of the everstake ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: corp-smart.com. Corporate Compliance
-
October 29, 2026 • lyserp.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: www.lyserp.com. ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.
-
October 30, 2026 • Grupo Ciosa, SAPI de CV was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Other. Country: Mexico. Website: www.ciosa.com.