-
NCT Kandla (container terminal operations)
October 12, 2026
•
[ ransomware, leak ]
NCT Kandla (container terminal operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: India. Port terminal operations India | Operational EDI correspondence and internal systems logs | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
HPC Hamburg Port Consulting (port operations)
October 12, 2026
•
[ ransomware, leak, manufacturing ]
HPC Hamburg Port Consulting (port operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Germany. Port consulting / terminal operations Germany | Operational EDI archives and cargo/bill-of-lading records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
T.S. Lines (intra-Asia container shipping)
October 12, 2026
T.S. Lines (intra-Asia container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Taiwan. Container shipping Taiwan | Operational EDI message archives (container manifests, gate movement and booking records), internal systems master data, and internal credential material | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
CULines (container shipping)
October 12, 2026
•
[ ransomware, technology, manufacturing ]
CULines (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: China. Container shipping China | Operational EDI message archives (booking and container manifest records) | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
Premier Alliance (shipping network operations)
October 12, 2026
•
[ ransomware, leak, transportation ]
Premier Alliance (shipping network operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Netherlands. Shipping / terminal services Netherlands | Terminal network documentation and operational EDI archives | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
Ocean Network Express (container shipping)
October 12, 2026
•
[ ransomware, financial ]
Ocean Network Express (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Singapore. Container shipping Singapore | Internal staff directories, operational voyage and fuel-consumption records, and financial-adjacent planning material | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
GlobalNet LCL (port agency operations)
October 12, 2026
•
[ ransomware, leak ]
GlobalNet LCL (port agency operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Indonesia. Port agency / logistics Indonesia | Container gate movement and damage management records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
-
Nu-Quest Distribution Inc
October 12, 2026
Nu-Quest Distribution Inc was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Retail & E-Commerce. Country: United States of America. Website: https:nuquest.com. Nu-Quest Distribution Inc. is a privately held pharmaceutical wholesaler based in Newfoundland and Labrador. The company specializes in the distribution of brand-name and generic medications, as well as medical devices. Its negligent attitude toward security and unwillingness to negotiate led to the leak of confidential documents, including supplier/customer pricing and price lists, drug transaction and compliance records, financial statements, employee personnel files, and legal documents. Due to our disclosure of these details, the company faces regulatory fines, license revocation, lawsuits, and damage to its competition and reputation.
-
Franklin Miller Inc.
October 12, 2026
Franklin Miller Inc. was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Manufacturing. Country: United States of America. Website: www.franklinmiller.com. About Franklin Miller Inc. Franklin Miller has been engineering wastewater grinders, crushers, shredders, and screens for municipal and industrial applications since 1918. Their products are designed for reliability and efficiency, catering to industries such as wastewater treatment, food processing, mining, oil and gas, and recycling. The company is committed to providing comprehensive post-sale support, ensuring that their equipment operates at peak performance. Trusted by industry leaders worldwide, Franklin Miller's equipment is precision manufactured in the USA to handle the toughest jobs. As a result of the attack on "Franklin Miller", more than 250 GB of confidential data were stolen. The organization lost control over documents such as drawings and project documentation, confidential agreements, banking and other financial information, as well as employees personal data.
-
Advanced Imaging Solutions
October 13, 2026
Advanced Imaging Solutions was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Technology. Country: Mongolia. Website: www.ais-mn.com. United States
-
DFK Group
October 13, 2026
•
[ ransomware, finance ]
DFK Group was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Germany. Website: www.dfkgroup.de. Germany
-
The Buckner Company, Inc.
October 13, 2026
•
[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
-
PG Group (Pure Options)
October 13, 2026
•
[ ransomware, finance, retail ]
PG Group (Pure Options) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. cannabis operator (US) Lansing, Michigan, USA | Complete directory database of a Michigan cannabis operator: password data for all 577 accounts; Working password corpus for dozens of staff and administrator accounts; Financial and contract backups: payroll reports, general ledgers, signed operating and lease agreements; Complete inventory of the shared data volume | [NOT PAID EXPOSED]
-
Wolf & Sofsky GmbH
December 10, 2025
•
[ ransomware, manufacturing ]
Wolf & Sofsky GmbH was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-12-10. Sector: Manufacturing. Country: Germany. Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrcken, Germany. The company operates on highly complex projects and maintains a significant financial position.
Critical Information We Possess
Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company.
Commercial Information: Contracts with clients, commercial offers, contract terms these form the foundation of Wolf & Sofsky's competitive advantage.
Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation.
Technical Assets: Technical plans, project drawings, architectural solutions the company's unique intellectual property.
Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects.
-
Excess Baggage
October 5, 2026
•
[ ransomware, leak ]
Excess Baggage was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.excess-baggage.com. Baggage Express is a dynamic national and international excess baggage shipping company with a heritage stretching back some 25 years. We're dedicated to the task of moving the holdalls, cartons, computers, bikes, luggage and material lives of students, backpackers, expats and anyone else who has found themselves in the UK needing their belongings sent elsewhere. Flexibility is the key to the company's success, tailoring the company's baggage shipping services to the specific individual needs of the company's customers.
-
Watermark Retirement Communities
August 24, 2026
•
[ ransomware, healthcare, leak ]
Watermark Retirement Communities was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Healthcare. Country: United States of America. Website: watermarkcommunities.com. [AI generated] Watermark Retirement Communities is a U.S.-based senior living company that develops, manages, and operates retirement communities offering independent living, assisted living, memory care, and skilled nursing services. Headquartered in Tucson, Arizona, it operates numerous communities across the United States. The company belongs to the senior care and hospitality-adjacent real estate industry, focusing on resident-centered lifestyle programming and care.
-
Merrill Iron & Steel
August 13, 2026
•
[ ransomware, manufacturing ]
Merrill Iron & Steel was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-13. Sector: Manufacturing. Country: United States of America. Website: merrillsteel.com.
-
Palma
October 6, 2026
•
[ ransomware, manufacturing, leak ]
Palma was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: palmainc.com. palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy flooring manufacturer and installer founded in 1927 in Whippany, New Jersey now in its third generation (CEO Fred Palma III). It generates estimated annual revenue of $2542M with only ~1015 direct employees (heavy use of subcontractors), completing millions of square feet of industrial flooring over 99 years. The company is a rare single-source formulator/applicator it develops its own products (PalmaLite, PaliKrete, PaliFlake) and installs them, with every square meter personally approved by a family member. Its average project size is $15.3M (Procore data: 122 projects, 76 active simultaneously), serving auto dealerships, jails, hospitals, chemical plants, and government facilities across the U.S. and Canada. Key differentiators: 5-year industry-leading warranty, no membrane required (3040% cost savings), and full ASTM C722-89 compliance. The company's name "A Palma, Manton, Palma Co
-
Majestic Holidays India Private Limited
October 6, 2026
Majestic Holidays India Private Limited was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Hospitality. Country: India. Website: ajesticindiaholidays.com. ajesticindiaholidays.com datanyze.com/companies/majestic-holidays-india/347590614 Majestic Holidays India Private Limited is a micro-sized travel and transport operator based at 2N/72, B.P., NIT Faridabad, Haryana (Delhi NCR), incorporated on 26 March 2015 (CIN U74900HR2015PTC055011, ROC Haryana, GSTIN 06AAJCM6666Q1ZK, DPIIT-recognized startup). Registered activity is "travel agency and tour operators," but the business has pivoted to corporate/government vehicle rental sedans, SUVs, vans, and buses with professional drivers serving institutional clients including BPCL, the Regional Centre for Biotechnology (RCB), THSTI, and AJNIFM; in July 2026 it won THSTI's monthly cab-hiring tender (20 lakh value) as L1 bidder at 16.2 lakh, beating 14 competitors. The company is run by promoter-directors Priyanka Devi (since inception) and Harinder Yadav (since December 2019), a family that controls a small cluster
-
All Smiles Dental of Falls Church
October 6, 2026
All Smiles Dental of Falls Church was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Healthcare. Country: United States of America. Website: allsmilesnova.com. allsmilesnova.com zoominfo.com/c/all-smiles-dental-of-falls-church/357420653 All Smiles Dental is a family-owned dental practice at 6400 Seven Corners Pl, Suite K, Falls Church, VA (Washington DC suburbs), serving Northern Virginia for over three decades founded in the early 1990s by Vietnamese-immigrant dentists Dr. Thang Pham and Dr. Nu Dang, who met at Saigon Dental School and retrained cum laude at MCV/VCU. Their son Dr. Long Pham (Virginia Tech summa cum laude, VCU DDS 2008) joined in 2008 and now leads the practice alongside Dr. Jennifer Lee and Dr. Tuan Anh Ta; the family also runs two related practices Nova Dental Practice in Herndon and All Smiles Dental PLLC in Great Falls (owned by Dr. Long's wife, Dr. Erica Sok). The practice offers full-service dentistry with a flagship focus on biomimetic dentistry Dr. Long Pham is one of the few US dentists with mastership from the Alleman Center for Biomimetic Dentistry plus CEREC same-day crowns, Invisalign/SureSmile aligners
