-
Morcon Developments
October 6, 2026
•
[ ransomware, leak ]
Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A
I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
-
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi
October 6, 2026
•
[ ransomware, manufacturing ]
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Turkey. Website: www.ciftay.com.tr.
-
Andersen Group
October 6, 2026
•
[ ransomware, technology ]
Andersen Group was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services.
-
harborpacific.com
October 6, 2026
•
[ ransomware, manufacturing ]
harborpacific.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Transportation. Country: United States of America. Website: harborpacific.com. Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs.
Employees: 20
Revenue: $5 Million
Phone Number: (425) 488-7131
-
acmestamping.com
October 6, 2026
•
[ ransomware, manufacturing ]
acmestamping.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: acmestamping.com. Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs.
Employees: 20
Revenue: $5 Million
Phone Number: (412) 771-5720
-
Danser
November 1, 2026
•
[ ransomware, manufacturing ]
Danser was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Other. Country: United States of America. Website: www.danserinc.com.
-
AmplifAI (GoDaddy instance)
November 1, 2026
•
[ ransomware, leak, technology ]
AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump
================================================
URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7
============================================================
USER DATABASE 13,565 unique employees
============================================================
File: all_users.json
Fields per user:
"name": "",
"email": "",
"userseq": ,
"firstname": "",
"lastname": "",
"ad_id": "",
"password": "",
"aduser": "true/false",
"usertype": "1/2/3/4",
"employeenumber": ""
User Type Key:
1 = Admin
2 = Manager
4 = Agent
Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9
============================================================
ORGANIZATIONS 34 total
============================================================
1. Agent Dashboard Organizations
1. DEM Sales_Support - ALL
2. DEM Sales_Support - GDDY
3. DEM Sales_Support - TP
4. GD International Independents
5. GD US Independents
6. Commerce - GDDY
7. Commerce - TP
8. DEM Sales_Support - SGS
9. EMEA Brands - ALL
10. EMEA Brands - GDDY
11. EMEA Brands - TP
12. GAO - GDDY
13. GD Teleperformance
14. Global Messaging Ops - GDDY
15. Global Messaging Ops - Genpact
16. Global Messaging Ops - SGS
17. Global Messaging Ops - TP
2. Performance Dashboard Organizations
18. ROW Sales_Support - ALL
19. ROW Sales_Support - Genpact
20. ROW Sales_Support - SGS
21. Services - SGS
22. US Sales_Support - SGS
3. Analytics Organizations
23. Global Messaging Ops - ALL
24. ROW Sales_Support - TP
25. Services - ALL
26. Services - GDDY
27. Services - TP
28. US Sales_Support - ALL
29. US Sales_Support - GDDY
4. Non Core Care Organizations
30. US Sales_Support - TP
31. Non Core Care - GDDY
32. Non Core Care - Genpact
33. Non Core Care - SGS
34. Non Core Care - TP
============================================================
LOGIN LOGS 4,451 records
============================================================
File: login_logs.json
Fields per record:
"Name": "",
"Title": "",
"Module": "",
"Access Date": "",
"Access Time": "",
"Time Zone": "",
"Access Device": "",
"Primary Program": "",
"Organization": "",
"Location": "",
"Manager Name": "",
"OpsManager Name": ""
Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy
Sample devices: Desktop, Mobile
============================================================
ROSTER DATA 1,201 records (1,193 with @godaddy.com emails)
============================================================
File: roster.json
Fields per record:
"RosterExportID": "",
"companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8",
"employeeid": "",
"email": "",
"fname": "",
"lname": "",
"managerid": "",
"pbxid": null,
"location": "",
"primaryprogram": "",
"title": "",
"recorddate": "",
"hiredate": null,
"termdate": null,
"loginuserid": "",
"customfield1": null,
"customfield2": null,
"customfield3": null,
"customfield4": null,
"customfield5": null,
"customfield6": null,
"customfield7": null,
"customfield8": null,
"customfield9": null,
"customfield10": null,
"otherprogram1": null,
"otherprogram2": null,
"otherprogram3": null,
"otherprogram4": null,
"otherprogram5": null,
"otherprogram6": null,
"otherprogram7": null,
"otherprogram8": null,
"otherprogram9": null,
"otherprogram10": null,
"varcharemployeeid": "",
"varcharmanagerid": "",
"organization": "",
"movedToCosmos": "False",
"glidepathtitle": null,
"gltitleid": null,
"coach": null,
"programstartdate": null,
"RequestID": ""
Roster by Organization:
US Sales_Support - GDDY: 405 records
Global Messaging Ops - Genpact: 191 records
EMEA Brands - GDDY: 176 records
Commerce - GDDY: 135 records
DEM Sales_Support - GDDY: 103 records
ROW Sales_Support - SGS: 101 records
Commerce - TP: 41 records
Non Core Care - Genpact: 37 records
Services - TP: 12 records
----------------------------------------
TOTAL: 1,201 records
25 organizations have no roster data available.
============================================================
PROGRAMS 227 unique GoDaddy call center programs
============================================================
File: programs.json
Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services
============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================
Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)
AD User Identity Format:
"Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, username@godaddy.com, EMAIL format
Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
-
fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie
November 1, 2026
•
[ ransomware, healthcare, technology ]
fzmb GmbH, Forschungszentrum fr Medizintechnik und Biotechnologie was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Healthcare. Country: Germany. Website: www.fzmb.de.
-
Company #115
November 2, 2026
Company #115 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: United States of America. digital sports entertainment and gaming United States | [PENDING EXPOSURE]
-
deom.be
November 2, 2026
•
[ ransomware, manufacturing ]
deom.be was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: Belgium. Website: deom.be. The company specializes in the distribution, installation, customization and maintenance of lifting equipment, truck-mounted cranes, forestry machinery and material-handling systems.
-
Laboratorios Roemmers SAICF
October 1, 2026
•
[ ransomware, healthcare, manufacturing ]
Laboratorios Roemmers SAICF was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Healthcare. Country: Argentina. Website: roemmers.com.ar. Laboratorios Roemmers SAICF Argentina's #1 pharmaceutical company by revenue, with 1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries.
The exposed material includes:
4,207 employees' national identity numbers (CUIL) Argentina's equivalent of a Social Security Number combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce.
Psychotropic drug dispensing records employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data.
COVID-19 health tracking with clinical symptoms individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive.
Pre-employment medical exam results with full DNI (national identity document) numbers.
82 GB of drug formulations the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications.
193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain.
14 GB of internal drug pricing strategy and competitive intelligence
-
Dynamic Office Solutions
October 1, 2026
•
[ ransomware, technology ]
Dynamic Office Solutions was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.dynamicos.co.uk.
-
Post Metal Recycling
October 1, 2026
•
[ ransomware, manufacturing ]
Post Metal Recycling was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. Country: United States of America. Post Metal Recycling specializes in buying scrap metal from businesses and individuals, offering both ferrous and non-ferrous recycling services. They provide on-site scales for accurate measurements and facilitate various recycling options including yard drop-off, roll-off service, and site clean-up. The company emphasizes the environmental benefits of recycling, such as energy conservation and resource preservation. With a commitment to honesty and excellent customer service, Post Metal Recycling aims to create jobs and generate income through their operations.
-
VPNE
September 24, 2026
•
[ ransomware, technology, leak ]
VPNE was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Technology. Website: .. A company that specializes in managing people, transportation and other services for its clients in various industries
-
Rimrock Foundation
October 1, 2026
•
[ ransomware, healthcare ]
Rimrock Foundation was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Other. Country: United States of America. Website: rimrock.org. Rimrock is the largest drug and alcohol addiction treatment center in the region, offering a comprehensive range of services for adults dealing with substance use and co-occurring disorders. The organization approaches addiction as a holistic illness that affects an individual's emotional, physical, spiritual, and social well-being. Their innovative and compassionate care includes various treatment options such as inpatient and outpatient programs, counseling services, and specialized therapies. Rimrock aims to create opportunities for recovery and balance in the lives of those impacted by addiction and mental illness.
-
Superior Plating Technology CO
October 1, 2026
Superior Plating Technology CO was listed as a victim on the leak site of the morpheus ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. **Website**: superiortec.com
**Revenue**: $30 Million
Superior Plating Technology Co., Ltd. is a Taiwanese industrial company specializing in metal surface treatment and electroplating, providing co
-
Terca
August 21, 2026
•
[ ransomware, leak ]
Terca was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-08-21. Sector: Other. Country: Brazil. Website: www.terca.com.br. TERCA Zilli is a leading logistics operator in Esprito Santo, Brazil, offering innovative solutions and synonymous with logistical efficiency. The company provides a wide range of services including general warehousing, customs areas, and specialized storage for hazardous chemicals and vehicles. With a rich history and extensive experience, TERCA Zilli caters to diverse client needs while optimizing operations to reduce costs.
-
ProMind IT
September 22, 2026
ProMind IT was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Technology. Country: Italy. Website: promindit.com. ProMind IT (promindit.com) is a small Italian IT consulting company offering website development, business solutions, and Odoo ERP/accounting software integration services, though its website is currently offline and very little public information is available.
-
www.pierrefeu.fr
October 2, 2026
www.pierrefeu.fr was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Other. Country: France. Website: www.pierrefeu.fr. Pierrefeu Immobilier is an independent French real estate agency founded in 1963, headquartered in Tarare, in the Nord-O...
-
Tronex A/S
October 2, 2026
Tronex A/S was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Manufacturing. Country: Denmark. Tronex A/S is a Danish Electronics Manufacturing Services (EMS) company headquartered in Fredensborg, Denmark. Founded in 1988, Tronex provides electronics manufacturing, assembly, testing, procurement, prototyping, and technical production solutions for industrial customers
