Recent Breaches
-
October 6, 2026 • J&D Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services. Website: www.jdfinancial.com.
-
October 6, 2026 • CORBY ROCK MILL was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Ireland. Website: www.corbyrock.ie.
-
October 6, 2026 • Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi ve range of tax and accounting services. They provide individual tax preparation, estate and tr ust tax services, and business tax services, ensuring clients meet their tax obligations effici ently. We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs , payment information), projects, client internal information and so on.
-
October 6, 2026 • Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
-
October 6, 2026 • Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
-
October 6, 2026 • Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Turkey. Website: www.ciftay.com.tr.
-
October 6, 2026 • Andersen Group was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services.
-
October 6, 2026 • harborpacific.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Transportation. Country: United States of America. Website: harborpacific.com. Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs. Employees: 20 Revenue: $5 Million Phone Number: (425) 488-7131
-
October 6, 2026 • acmestamping.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: acmestamping.com. Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs. Employees: 20 Revenue: $5 Million Phone Number: (412) 771-5720
-
November 1, 2026 • Danser was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Other. Country: United States of America. Website: www.danserinc.com.
-
November 1, 2026 • AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump ================================================ URL: https://godaddy.ampbi.net Okta SSO: https://godaddy.okta.com Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI) Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7 ============================================================ USER DATABASE 13,565 unique employees ============================================================ File: all_users.json Fields per user: "name": "", "email": "", "userseq": , "firstname": "", "lastname": "", "ad_id": "", "password": "", "aduser": "true/false", "usertype": "1/2/3/4", "employeenumber": "" User Type Key: 1 = Admin 2 = Manager 4 = Agent Breakdown: Total users: 13,565 AD users (Okta/SSO): 6,184 Non-AD users (local): 16 Admins (type=1): 459 Managers (type=2): 502 Agents (type=4): 5,239 Default password: 13,510 Non-default passwords: 9 ============================================================ ORGANIZATIONS 34 total ============================================================ 1. Agent Dashboard Organizations 1. DEM Sales_Support - ALL 2. DEM Sales_Support - GDDY 3. DEM Sales_Support - TP 4. GD International Independents 5. GD US Independents 6. Commerce - GDDY 7. Commerce - TP 8. DEM Sales_Support - SGS 9. EMEA Brands - ALL 10. EMEA Brands - GDDY 11. EMEA Brands - TP 12. GAO - GDDY 13. GD Teleperformance 14. Global Messaging Ops - GDDY 15. Global Messaging Ops - Genpact 16. Global Messaging Ops - SGS 17. Global Messaging Ops - TP 2. Performance Dashboard Organizations 18. ROW Sales_Support - ALL 19. ROW Sales_Support - Genpact 20. ROW Sales_Support - SGS 21. Services - SGS 22. US Sales_Support - SGS 3. Analytics Organizations 23. Global Messaging Ops - ALL 24. ROW Sales_Support - TP 25. Services - ALL 26. Services - GDDY 27. Services - TP 28. US Sales_Support - ALL 29. US Sales_Support - GDDY 4. Non Core Care Organizations 30. US Sales_Support - TP 31. Non Core Care - GDDY 32. Non Core Care - Genpact 33. Non Core Care - SGS 34. Non Core Care - TP ============================================================ LOGIN LOGS 4,451 records ============================================================ File: login_logs.json Fields per record: "Name": "", "Title": "", "Module": "", "Access Date": "", "Access Time": "", "Time Zone": "", "Access Device": "", "Primary Program": "", "Organization": "", "Location": "", "Manager Name": "", "OpsManager Name": "" Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy Sample devices: Desktop, Mobile ============================================================ ROSTER DATA 1,201 records (1,193 with @godaddy.com emails) ============================================================ File: roster.json Fields per record: "RosterExportID": "", "companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8", "employeeid": "", "email": "", "fname": "", "lname": "", "managerid": "", "pbxid": null, "location": "", "primaryprogram": "", "title": "", "recorddate": "", "hiredate": null, "termdate": null, "loginuserid": "", "customfield1": null, "customfield2": null, "customfield3": null, "customfield4": null, "customfield5": null, "customfield6": null, "customfield7": null, "customfield8": null, "customfield9": null, "customfield10": null, "otherprogram1": null, "otherprogram2": null, "otherprogram3": null, "otherprogram4": null, "otherprogram5": null, "otherprogram6": null, "otherprogram7": null, "otherprogram8": null, "otherprogram9": null, "otherprogram10": null, "varcharemployeeid": "", "varcharmanagerid": "", "organization": "", "movedToCosmos": "False", "glidepathtitle": null, "gltitleid": null, "coach": null, "programstartdate": null, "RequestID": "" Roster by Organization: US Sales_Support - GDDY: 405 records Global Messaging Ops - Genpact: 191 records EMEA Brands - GDDY: 176 records Commerce - GDDY: 135 records DEM Sales_Support - GDDY: 103 records ROW Sales_Support - SGS: 101 records Commerce - TP: 41 records Non Core Care - Genpact: 37 records Services - TP: 12 records ---------------------------------------- TOTAL: 1,201 records 25 organizations have no roster data available. ============================================================ PROGRAMS 227 unique GoDaddy call center programs ============================================================ File: programs.json Categories include: Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin) Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS Geographic: UK & IE, CA & AU, LATAM, EMEA, International English Security: Website Security Sales I/II, Website Security Support Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services ============================================================ OKTA / ACTIVE DIRECTORY INTEGRATION ============================================================ Okta Tenant: https://godaddy.okta.com AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7) Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta) SAML SSO: SAML 2.0 OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration Authn API: POST https://godaddy.okta.com/api/v1/authn (accepts JSON {username, password}, returns sessionToken on success) Password Grant: Supported (grant_type=password in OIDC config) AD User Identity Format: "Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin) Okta accepts: username, username@godaddy.com, EMAIL format Reach out on session or be the next headline https://getsession.org ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
-
November 1, 2026 • fzmb GmbH, Forschungszentrum fr Medizintechnik und Biotechnologie was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Healthcare. Country: Germany. Website: www.fzmb.de.
-
November 2, 2026 Company #115 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: United States of America. digital sports entertainment and gaming United States | [PENDING EXPOSURE]
-
November 2, 2026 • deom.be was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: Belgium. Website: deom.be. The company specializes in the distribution, installation, customization and maintenance of lifting equipment, truck-mounted cranes, forestry machinery and material-handling systems.
-
October 1, 2026 • Laboratorios Roemmers SAICF was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Healthcare. Country: Argentina. Website: roemmers.com.ar. Laboratorios Roemmers SAICF Argentina's #1 pharmaceutical company by revenue, with 1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) Argentina's equivalent of a Social Security Number combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers.
82 GB of drug formulations the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence -
October 1, 2026 • Dynamic Office Solutions was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.dynamicos.co.uk.
-
October 1, 2026 • Post Metal Recycling was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. Country: United States of America. Post Metal Recycling specializes in buying scrap metal from businesses and individuals, offering both ferrous and non-ferrous recycling services. They provide on-site scales for accurate measurements and facilitate various recycling options including yard drop-off, roll-off service, and site clean-up. The company emphasizes the environmental benefits of recycling, such as energy conservation and resource preservation. With a commitment to honesty and excellent customer service, Post Metal Recycling aims to create jobs and generate income through their operations.
-
September 24, 2026 • VPNE was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Technology. Website: .. A company that specializes in managing people, transportation and other services for its clients in various industries
-
October 1, 2026 • Rimrock Foundation was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Other. Country: United States of America. Website: rimrock.org. Rimrock is the largest drug and alcohol addiction treatment center in the region, offering a comprehensive range of services for adults dealing with substance use and co-occurring disorders. The organization approaches addiction as a holistic illness that affects an individual's emotional, physical, spiritual, and social well-being. Their innovative and compassionate care includes various treatment options such as inpatient and outpatient programs, counseling services, and specialized therapies. Rimrock aims to create opportunities for recovery and balance in the lives of those impacted by addiction and mental illness.
-
October 1, 2026 Superior Plating Technology CO was listed as a victim on the leak site of the morpheus ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. **Website**: superiortec.com **Revenue**: $30 Million Superior Plating Technology Co., Ltd. is a Taiwanese industrial company specializing in metal surface treatment and electroplating, providing co