Recent Breaches
-
October 5, 2026 • bwi-bau.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: Germany. Website: bwi-bau.de. The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally
-
September 5, 2026 • JPS Health Network was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Healthcare. Country: United States of America. Website: www.jpshealthnet.org. John Peter Smith Hospital, JPS Surgical Center - Arlington, a network of community-based health centers, school-based health centers and psychiatric services at Trinity Springs Pavilion - a stand-alone facility.
-
September 5, 2026 • Gen3 was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Other. Country: United States of America. Website: www.gen3construction.com. Gen3 CO is a leading subcontractor specializing in the installation of various exterior wall systems, including composite wall panels, foam insulated panels, and metal roofing. With a strong portfolio in the Rocky Mountain and Southwest regions, Gen3 serves owners, architects, and contractors by delivering high-quality installation services. Their product offerings include aluminum composite materials, Centria metal panels, and single skin metal wall panels. Gen3 is recognized for its commitment to quality and professionalism in every construction project.
-
October 5, 2026 • Global Security Concepts was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. Website: www.gscsecurity.com.
-
October 5, 2026 • M** A******* G********** O******* a** P***** S****** A********* was listed as a victim on the leak site of the netrunner ransomware group; the attack is estimated to have taken place on 2026-10-05. Country: United States of America. Website: w**.m******.c**.
-
October 6, 2026 • J&D Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services. Website: www.jdfinancial.com.
-
October 6, 2026 • CORBY ROCK MILL was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Ireland. Website: www.corbyrock.ie.
-
October 6, 2026 • Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi ve range of tax and accounting services. They provide individual tax preparation, estate and tr ust tax services, and business tax services, ensuring clients meet their tax obligations effici ently. We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs , payment information), projects, client internal information and so on.
-
October 6, 2026 • Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
-
October 6, 2026 • Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
-
October 6, 2026 • Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Turkey. Website: www.ciftay.com.tr.
-
October 6, 2026 • Andersen Group was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services.
-
October 6, 2026 • harborpacific.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Transportation. Country: United States of America. Website: harborpacific.com. Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs. Employees: 20 Revenue: $5 Million Phone Number: (425) 488-7131
-
October 6, 2026 • acmestamping.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: acmestamping.com. Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs. Employees: 20 Revenue: $5 Million Phone Number: (412) 771-5720
-
November 1, 2026 • Danser was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Other. Country: United States of America. Website: www.danserinc.com.
-
November 1, 2026 • AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump ================================================ URL: https://godaddy.ampbi.net Okta SSO: https://godaddy.okta.com Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI) Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7 ============================================================ USER DATABASE 13,565 unique employees ============================================================ File: all_users.json Fields per user: "name": "", "email": "", "userseq": , "firstname": "", "lastname": "", "ad_id": "", "password": "", "aduser": "true/false", "usertype": "1/2/3/4", "employeenumber": "" User Type Key: 1 = Admin 2 = Manager 4 = Agent Breakdown: Total users: 13,565 AD users (Okta/SSO): 6,184 Non-AD users (local): 16 Admins (type=1): 459 Managers (type=2): 502 Agents (type=4): 5,239 Default password: 13,510 Non-default passwords: 9 ============================================================ ORGANIZATIONS 34 total ============================================================ 1. Agent Dashboard Organizations 1. DEM Sales_Support - ALL 2. DEM Sales_Support - GDDY 3. DEM Sales_Support - TP 4. GD International Independents 5. GD US Independents 6. Commerce - GDDY 7. Commerce - TP 8. DEM Sales_Support - SGS 9. EMEA Brands - ALL 10. EMEA Brands - GDDY 11. EMEA Brands - TP 12. GAO - GDDY 13. GD Teleperformance 14. Global Messaging Ops - GDDY 15. Global Messaging Ops - Genpact 16. Global Messaging Ops - SGS 17. Global Messaging Ops - TP 2. Performance Dashboard Organizations 18. ROW Sales_Support - ALL 19. ROW Sales_Support - Genpact 20. ROW Sales_Support - SGS 21. Services - SGS 22. US Sales_Support - SGS 3. Analytics Organizations 23. Global Messaging Ops - ALL 24. ROW Sales_Support - TP 25. Services - ALL 26. Services - GDDY 27. Services - TP 28. US Sales_Support - ALL 29. US Sales_Support - GDDY 4. Non Core Care Organizations 30. US Sales_Support - TP 31. Non Core Care - GDDY 32. Non Core Care - Genpact 33. Non Core Care - SGS 34. Non Core Care - TP ============================================================ LOGIN LOGS 4,451 records ============================================================ File: login_logs.json Fields per record: "Name": "", "Title": "", "Module": "", "Access Date": "", "Access Time": "", "Time Zone": "", "Access Device": "", "Primary Program": "", "Organization": "", "Location": "", "Manager Name": "", "OpsManager Name": "" Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy Sample devices: Desktop, Mobile ============================================================ ROSTER DATA 1,201 records (1,193 with @godaddy.com emails) ============================================================ File: roster.json Fields per record: "RosterExportID": "", "companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8", "employeeid": "", "email": "", "fname": "", "lname": "", "managerid": "", "pbxid": null, "location": "", "primaryprogram": "", "title": "", "recorddate": "", "hiredate": null, "termdate": null, "loginuserid": "", "customfield1": null, "customfield2": null, "customfield3": null, "customfield4": null, "customfield5": null, "customfield6": null, "customfield7": null, "customfield8": null, "customfield9": null, "customfield10": null, "otherprogram1": null, "otherprogram2": null, "otherprogram3": null, "otherprogram4": null, "otherprogram5": null, "otherprogram6": null, "otherprogram7": null, "otherprogram8": null, "otherprogram9": null, "otherprogram10": null, "varcharemployeeid": "", "varcharmanagerid": "", "organization": "", "movedToCosmos": "False", "glidepathtitle": null, "gltitleid": null, "coach": null, "programstartdate": null, "RequestID": "" Roster by Organization: US Sales_Support - GDDY: 405 records Global Messaging Ops - Genpact: 191 records EMEA Brands - GDDY: 176 records Commerce - GDDY: 135 records DEM Sales_Support - GDDY: 103 records ROW Sales_Support - SGS: 101 records Commerce - TP: 41 records Non Core Care - Genpact: 37 records Services - TP: 12 records ---------------------------------------- TOTAL: 1,201 records 25 organizations have no roster data available. ============================================================ PROGRAMS 227 unique GoDaddy call center programs ============================================================ File: programs.json Categories include: Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin) Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS Geographic: UK & IE, CA & AU, LATAM, EMEA, International English Security: Website Security Sales I/II, Website Security Support Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services ============================================================ OKTA / ACTIVE DIRECTORY INTEGRATION ============================================================ Okta Tenant: https://godaddy.okta.com AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7) Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta) SAML SSO: SAML 2.0 OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration Authn API: POST https://godaddy.okta.com/api/v1/authn (accepts JSON {username, password}, returns sessionToken on success) Password Grant: Supported (grant_type=password in OIDC config) AD User Identity Format: "Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin) Okta accepts: username, username@godaddy.com, EMAIL format Reach out on session or be the next headline https://getsession.org ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
-
November 1, 2026 • fzmb GmbH, Forschungszentrum fr Medizintechnik und Biotechnologie was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Healthcare. Country: Germany. Website: www.fzmb.de.
-
November 2, 2026 Company #115 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: United States of America. digital sports entertainment and gaming United States | [PENDING EXPOSURE]
-
November 2, 2026 • deom.be was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: Belgium. Website: deom.be. The company specializes in the distribution, installation, customization and maintenance of lifting equipment, truck-mounted cranes, forestry machinery and material-handling systems.
-
October 1, 2026 • Laboratorios Roemmers SAICF was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Healthcare. Country: Argentina. Website: roemmers.com.ar. Laboratorios Roemmers SAICF Argentina's #1 pharmaceutical company by revenue, with 1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) Argentina's equivalent of a Social Security Number combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers.
82 GB of drug formulations the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence