Recent Breaches
-
October 22, 2026 • Company #107 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-22. Country: Bulgaria. fuel trading and construction materials Bulgaria | [PENDING EXPOSURE]
-
October 22, 2026 • Performance Ford Inc was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Retail & E-Commerce. Country: United States of America. automotive retail United States | Network security configuration of an automotive retailer; Private network tunnel definitions between locations; Internal network maps and device inventory | [NOT PAID EXPOSED]
-
October 22, 2026 • United Restaurant Supply was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Hospitality. Country: United States of America. Website: www.coloradokitchens.com.
-
October 23, 2026 • Horn of Africa Regional Environment Centre and Network was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Other. Country: Ethiopia. Environmental NGO Ethiopia | The complete SAP Business One production database of the organization: 15,275 journal transactions with 89,929 journal lines, 1,007 business partner records of regional partner organizations with contacts, 333 general ledger accounts, procurement and inventory records; A verified full backup of the production ERP database and a fresh copy of the landscape database; The complete financial and operational record of a donor funded environmental organization | [NOT PAID EXPOSED]
-
October 23, 2026 Line2Line Coatings was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Manufacturing. Line2Line Coatings 796,433 files - 641.0 GB~20 years of email: 34 mailboxes (PST/OST), 107,279 messages, 13,068 contacts - including the president's own mailbox (4.0 GB).The entire QuickBooks history: 1,232 backups (.QBB) + 174 live company files (.QBW) for both entities, 15+ years of revenue.Full banking footprint: Chase statements, Clarkston State Bank, account and routing numbers, credit card numbers with CVV.Personal data: 3,614 Social Security Numbers; 64,907 files containing PII - W-2s of all employees, contractor 1099/W-9s, passport and driver license scans, HR files.77,118 PDFs, 66,691 Excel spreadsheets, 38,688 Word documents.Military material: SBIR/ONR/TARDEC files, CUI, patent correspondence.Customer base: Eaton (15,320 emails), GM, Chrysler, Linamar, Whipple (~50% of revenue), Honda R&D, TVS, Mercury Marine, Stihl. More
-
October 13, 2026 Zena Office was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Italy. Zena Office S.r.l. is a regional small-to-mid-sized IT and office technology provider based in Piacenza, Italy, formally registered around 2000 and claiming roots that stretch back to 1930s office-furniture tradition, that with roughly 910 employees and about 2.2 million in annual revenue serves local businesses and public-procurement clients with an end-to-end mix of computer, peripheral and software retail, cybersecurity, ERP, cloud backup, enterprise networking, smart working and videoconferencing, multifunction printer and operational leasing, office furniture and custom software, partnering with vendors such as Microsoft, HP, Lenovo, VMware and Veeam, primarily through zenaoffice.it while also holding the largely unused zenaware.it domain.
-
October 23, 2026 vinsolutions.com was listed as a victim on the leak site of the Scarlettgroup ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Professional Services. Country: United States of America. Website: vinsolutions.com. VinSolutions is an automotive CRM platform that helps car dealerships manage leads, track sales, and improve customer relationships.
-
October 23, 2026 • Trevi Technology was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: Taiwan. Website: www.trevi.cc. 2017TreviTrevi-Fontana di Trevi
-
October 23, 2026 • Aryza was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: Argentina. Website: www.aryza.com.
-
October 23, 2026 • JB Hunt was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Transportation. Country: United States of America. J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace. We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations. Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email. To verify, samples can be found below. Contact: Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67 Email: whitearmorrxd@proton.me
-
October 21, 2026 • Whirlpool was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: United States of America. Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
-
October 23, 2026 • mlh.com.lb was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Professional Services. Country: Lebanon. Website: mlh.com.lb. Mount Lebanon Hospital University Medical Center (MLHUMC) is a healthcare institution that offers a...
-
October 23, 2026 • whitearmor.cc was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Website: whitearmor.cc. Hi! We now have a clearnet domain for easy-access. WhiteArmor.cc
-
October 23, 2026 von Schaewen was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Other. Country: Germany. Website: www.von-schaewen.de.
-
October 8, 2026 • i2r Packaging Solutions Limited was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. i2r Packaging Solutions Limited manufactures aluminium packaging and containers for the food industry. HQ: Capital House, Hadley Park East, Telford, Shropshire, TF1 6QJ, UK Phone: +44 845 371 5111...
-
October 24, 2026 • Asisken Asistencia Mdica S.A. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Healthcare. Country: Argentina. health insurance administration Guayaquil, Ecuador | Identity and contact records of 139,006 named insurance clients, including identity document numbers and dates of birth; 383,159 policy beneficiary records with insured amounts; 402,988 medical and insurance claims with diagnosis codes and dollar amounts, current through 20 October 2026; Policy billing, home and work addresses and bank account details | [NOT PAID EXPOSED]
-
October 24, 2026 • GPIC Projectos Con Instalacoes Lda was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Portugal. engineering design and installations Portugal | The full project archive of an engineering design office, spanning 2000 through 2026, including tender submissions, client proposals and technical drawings; Project folders for named clients including hospital installations for a private hospital group; Scanned office documents with activity through October 2026; A company bank account document with the full IBAN and tax number; Staff curricula with photos and personal details | [NOT PAID EXPOSED]
-
October 24, 2026 • MODON Developments S.A.E was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Egypt. Website: MODON Developments S.A.E. MODON Developments S.A.E. (MODON For Urban Development) is an innovative Egyptian real estate development and management...
-
October 24, 2026 • Hisense was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Technology. Country: China. Website: Hisense.com. Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances. We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary. Our demand is $500,000 in BTC. Good luck. Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
-
October 25, 2026 • Andrews Advisory Group LLC was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Financial Advisory & Restructuring (US) Chicago, Illinois, USA | Patient records with names and dates of birth from the patient database backup of December 2025 (3,698 records), taken from the office network; The complete patient database backup history, 2018 through 2025; More than 13,000 patient eye examination records with full ocular, medical and social history; OCT eye scan files from the imaging server on the network; Workstation profiles of office staff including stored system credentials | [NOT PAID EXPOSED]