-
Premier Alliance (shipping network operations)
October 12, 2026
•
[ ransomware, leak, transportation ]
Premier Alliance (shipping network operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Netherlands. Shipping / terminal services Netherlands | Terminal network documentation and operational EDI archives | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
Ocean Network Express (container shipping)
October 12, 2026
•
[ ransomware, financial ]
Ocean Network Express (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Singapore. Container shipping Singapore | Internal staff directories, operational voyage and fuel-consumption records, and financial-adjacent planning material | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
GlobalNet LCL (port agency operations)
October 12, 2026
•
[ ransomware, leak ]
GlobalNet LCL (port agency operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Indonesia. Port agency / logistics Indonesia | Container gate movement and damage management records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
Nu-Quest Distribution Inc
October 12, 2026
Nu-Quest Distribution Inc was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Retail & E-Commerce. Country: United States of America. Website: https:nuquest.com. Nu-Quest Distribution Inc. is a privately held pharmaceutical wholesaler based in Newfoundland and Labrador. The company specializes in the distribution of brand-name and generic medications, as well as medical devices. Its negligent attitude toward security and unwillingness to negotiate led to the leak of confidential documents, including supplier/customer pricing and price lists, drug transaction and compliance records, financial statements, employee personnel files, and legal documents. Due to our disclosure of these details, the company faces regulatory fines, license revocation, lawsuits, and damage to its competition and reputation.
-
Franklin Miller Inc.
October 12, 2026
Franklin Miller Inc. was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Manufacturing. Country: United States of America. Website: www.franklinmiller.com. About Franklin Miller Inc. Franklin Miller has been engineering wastewater grinders, crushers, shredders, and screens for municipal and industrial applications since 1918. Their products are designed for reliability and efficiency, catering to industries such as wastewater treatment, food processing, mining, oil and gas, and recycling. The company is committed to providing comprehensive post-sale support, ensuring that their equipment operates at peak performance. Trusted by industry leaders worldwide, Franklin Miller's equipment is precision manufactured in the USA to handle the toughest jobs. As a result of the attack on "Franklin Miller", more than 250 GB of confidential data were stolen. The organization lost control over documents such as drawings and project documentation, confidential agreements, banking and other financial information, as well as employees personal data.
-
Advanced Imaging Solutions
October 13, 2026
Advanced Imaging Solutions was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Technology. Country: Mongolia. Website: www.ais-mn.com. United States
-
DFK Group
October 13, 2026
•
[ ransomware, finance ]
DFK Group was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Germany. Website: www.dfkgroup.de. Germany
-
The Buckner Company, Inc.
October 13, 2026
•
[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
-
PG Group (Pure Options)
October 13, 2026
•
[ ransomware, finance, retail ]
PG Group (Pure Options) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. cannabis operator (US) Lansing, Michigan, USA | Complete directory database of a Michigan cannabis operator: password data for all 577 accounts; Working password corpus for dozens of staff and administrator accounts; Financial and contract backups: payroll reports, general ledgers, signed operating and lease agreements; Complete inventory of the shared data volume | [NOT PAID EXPOSED]
-
Wolf & Sofsky GmbH
December 10, 2025
•
[ ransomware, manufacturing ]
Wolf & Sofsky GmbH was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-12-10. Sector: Manufacturing. Country: Germany. Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrcken, Germany. The company operates on highly complex projects and maintains a significant financial position.
Critical Information We Possess
Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company.
Commercial Information: Contracts with clients, commercial offers, contract terms these form the foundation of Wolf & Sofsky's competitive advantage.
Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation.
Technical Assets: Technical plans, project drawings, architectural solutions the company's unique intellectual property.
Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects.
-
Excess Baggage
October 5, 2026
•
[ ransomware, leak ]
Excess Baggage was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.excess-baggage.com. Baggage Express is a dynamic national and international excess baggage shipping company with a heritage stretching back some 25 years. We're dedicated to the task of moving the holdalls, cartons, computers, bikes, luggage and material lives of students, backpackers, expats and anyone else who has found themselves in the UK needing their belongings sent elsewhere. Flexibility is the key to the company's success, tailoring the company's baggage shipping services to the specific individual needs of the company's customers.
-
Watermark Retirement Communities
August 24, 2026
•
[ ransomware, healthcare, leak ]
Watermark Retirement Communities was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Healthcare. Country: United States of America. Website: watermarkcommunities.com. [AI generated] Watermark Retirement Communities is a U.S.-based senior living company that develops, manages, and operates retirement communities offering independent living, assisted living, memory care, and skilled nursing services. Headquartered in Tucson, Arizona, it operates numerous communities across the United States. The company belongs to the senior care and hospitality-adjacent real estate industry, focusing on resident-centered lifestyle programming and care.
-
Merrill Iron & Steel
August 13, 2026
•
[ ransomware, manufacturing ]
Merrill Iron & Steel was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-13. Sector: Manufacturing. Country: United States of America. Website: merrillsteel.com.
-
Palma
October 6, 2026
•
[ ransomware, manufacturing, leak ]
Palma was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: palmainc.com. palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy flooring manufacturer and installer founded in 1927 in Whippany, New Jersey now in its third generation (CEO Fred Palma III). It generates estimated annual revenue of $2542M with only ~1015 direct employees (heavy use of subcontractors), completing millions of square feet of industrial flooring over 99 years. The company is a rare single-source formulator/applicator it develops its own products (PalmaLite, PaliKrete, PaliFlake) and installs them, with every square meter personally approved by a family member. Its average project size is $15.3M (Procore data: 122 projects, 76 active simultaneously), serving auto dealerships, jails, hospitals, chemical plants, and government facilities across the U.S. and Canada. Key differentiators: 5-year industry-leading warranty, no membrane required (3040% cost savings), and full ASTM C722-89 compliance. The company's name "A Palma, Manton, Palma Co
-
Majestic Holidays India Private Limited
October 6, 2026
Majestic Holidays India Private Limited was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Hospitality. Country: India. Website: ajesticindiaholidays.com. ajesticindiaholidays.com datanyze.com/companies/majestic-holidays-india/347590614 Majestic Holidays India Private Limited is a micro-sized travel and transport operator based at 2N/72, B.P., NIT Faridabad, Haryana (Delhi NCR), incorporated on 26 March 2015 (CIN U74900HR2015PTC055011, ROC Haryana, GSTIN 06AAJCM6666Q1ZK, DPIIT-recognized startup). Registered activity is "travel agency and tour operators," but the business has pivoted to corporate/government vehicle rental sedans, SUVs, vans, and buses with professional drivers serving institutional clients including BPCL, the Regional Centre for Biotechnology (RCB), THSTI, and AJNIFM; in July 2026 it won THSTI's monthly cab-hiring tender (20 lakh value) as L1 bidder at 16.2 lakh, beating 14 competitors. The company is run by promoter-directors Priyanka Devi (since inception) and Harinder Yadav (since December 2019), a family that controls a small cluster
-
All Smiles Dental of Falls Church
October 6, 2026
All Smiles Dental of Falls Church was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Healthcare. Country: United States of America. Website: allsmilesnova.com. allsmilesnova.com zoominfo.com/c/all-smiles-dental-of-falls-church/357420653 All Smiles Dental is a family-owned dental practice at 6400 Seven Corners Pl, Suite K, Falls Church, VA (Washington DC suburbs), serving Northern Virginia for over three decades founded in the early 1990s by Vietnamese-immigrant dentists Dr. Thang Pham and Dr. Nu Dang, who met at Saigon Dental School and retrained cum laude at MCV/VCU. Their son Dr. Long Pham (Virginia Tech summa cum laude, VCU DDS 2008) joined in 2008 and now leads the practice alongside Dr. Jennifer Lee and Dr. Tuan Anh Ta; the family also runs two related practices Nova Dental Practice in Herndon and All Smiles Dental PLLC in Great Falls (owned by Dr. Long's wife, Dr. Erica Sok). The practice offers full-service dentistry with a flagship focus on biomimetic dentistry Dr. Long Pham is one of the few US dentists with mastership from the Alleman Center for Biomimetic Dentistry plus CEREC same-day crowns, Invisalign/SureSmile aligners
-
The Law Office of James R Walsh
October 6, 2026
•
[ ransomware, leak ]
The Law Office of James R Walsh was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Country: United States of America. Website: jrwalshlaw.com. jrwalshlaw.com The Law Office of James R. Walsh is a small plaintiff-side law firm in Lynnwood, WA (north of Seattle), specializing in workers' compensation (L&I claims), personal injury, maritime, and Social Security cases. Founder James R. Walsh (admitted 1981) has practiced for 44+ years and was named to "Top Attorneys of North America 2015-16." The firm fights for injured workers against Washington's Dept. of Labor & Industries and self-insured employers, with published precedents including Elliott v. L&I (2009) and ITT Rayonier v. Dalman (1992). It acts as a talent incubator attorney Joshua L. Hughes (UW Law, JD with honors) rose from paralegal (2017) to attorney (2022), following the path of earlier associates.
-
Potomac Animal Hospital
October 6, 2026
•
[ ransomware, healthcare ]
Potomac Animal Hospital was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Healthcare. Country: United States of America. Website: potomacanimalhospital.com. potomacanimalhospital.com zoominfo.com/c/potomac-animal-hospital/183255483 Potomac Animal Hospital is a family-owned, full-service small animal medical and surgical facility at 10020 River Road in Potomac, Maryland, an affluent Washington, DC suburb, founded in 1973 and led since 1983 by Air Force veteran Dr. Michael Scott (CSU DVM 1969; former officer in charge of the Europe Military Working Dog Referral Center in Ramstein). His son Dr. Jason Scott joined in 1999 hooded at graduation by his father exactly 30 years to the day after his own and now leads a team including Dr. Sarah Orloff (2021) and Dr. Kimber Wagner (2025); Dr. Michael retired in 2018 but remains owner. Beyond medicine (wellness exams, international health certificates, laser surgery, dentistry with digital oral radiography, in-house lab), the hospital runs a separate boarding kennel ($42.50$72.50/night, dogs exercised every 23 hours, VIP suites) and a grooming salon all powered through outages by an industria
-
Machine sro
October 6, 2026
•
[ ransomware, manufacturing, automotive ]
Machine sro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Czechia. Website: k2machine.cz. k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~2550 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~4M), though 2024 saw a sharp 18.7% revenue decline (operating revenue 27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtn campus (since 2020).
-
University of Buraimi
October 6, 2026
•
[ ransomware, education ]
University of Buraimi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: Oman. Website: uob.edu.om. uob.edu.om zoominfo.com/c/university-of-buraimi/464061196 University of Buraimi (UOB) is a private higher education institution founded in 2016 (originally College of Banking & Financial Studies, upgraded to university status in 2024) in Buraimi, Oman, just 5 minutes from the UAE border (Al Ain). Licensed by Oman's Ministry of Higher Education (MOHERI), it operates 4 faculties (Computing & IT, Engineering, Business, Health Sciences) with 11 departments offering programs in AI, cybersecurity, civil/electrical/mechanical engineering, nursing, architecture, business, and MBA. It serves ~5001,500 students from 40+ countries (3040% international) with ~5082 staff (PhD-holders from UK, USA, Canada, Malaysia). Tuition runs ~$6,00012,000/year with extensive scholarships. The university follows a US academic model, earned a spot in UI GreenMetric World Rankings 2025 (289th for sustainability), and is currently undergoing OAAA accreditation. Led by Chancellor HE Sheikh Saif Al-Mamari
