Recent Breaches
-
November 9, 2026 • Company #209 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-09. Country: United States of America. biopharmaceutical neuroscience United States | [PENDING EXPOSURE]
-
November 9, 2026 • Company #210 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-09. Country: United States of America. biopharmaceutical oncology United States | [PENDING EXPOSURE]
-
November 9, 2026 • Company #211 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-09. Country: United States of America. biopharmaceutical (chronic hepatitis infections) United States | [PENDING EXPOSURE]
-
November 9, 2026 • Johnson Development Corp. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Other. Website: Johnson Development Corp.. [developer] Johnson Development Corp., a Houston, Texas-based privately held master-planned residential community developer founded circa 1975 by Larry D. Johnson (deceased), operating through The Johnson Companies LP (TJC LP) as the family-owned holding company, with 25+ active communities across Texas (Cross Creek Ranch, Grand Central Park, Sienna, Trinity Falls, Woodforest, Imperial, Jordan Ranch, Viridian, Bryson, Lake Arrowhead, and others) and a Georgia subsidiary (Johnson Dev Co Georgia LLC). Tricon Capital Group invested approximately $18.5 million in the development-management division in 2014. Current headcount: approximately 109 employees across Texas and Georgia offices. The company is managed by Kirk W. Boswell (President/VP/Treasurer across 100+ entities) and Elizabeth F. York (Secretary/VP/Registered Agent across 200+ entities), with the Johnson family (Suzanne Johnson, Jennifer Johnson, Chad Johnson, Nick Johnson) as beneficial owners. The dataset comprises approximately 661 GB exfiltrated from the corporate file server across three major branches Cash Management (808 MB), company (659 GB), and hrshare (1.5 GB) capturing the company's entire digital footprint spanning 30 years of operations from 1996 through August 2026.
The HR share contains 14 years of payroll records (20132026) for TJC LP, Johnson Development Services LLC, and Johnson Dev Co Georgia LLC, with semi-monthly officer/employee salaries of approximately $494,000 per period, FICA, Medicare, federal/state withholdings, 401k contributions, and insurance deductions. The 401k participant list names 109 current employees with contribution eligibility status, and companion census reports likely contain SSNs, dates of birth, compensation, and account balances spanning 12 annual filings. Workers compensation claims cover 20162026 including Georgia-specific claims. Employee HR folders contain I-9s, offer letters, insurance enrollment, photos, and performance records. The legal and corporate governance archives include a CTA Transparency Company List detailing beneficial ownership for 239 entities with EINs, ownership percentages, officer names, registered agents, and formation types, plus 21 individual FinCen ID submission receipts. Entity organizational charts (79 files, current through June 2026), the Last Will and Testament of Larry D. Johnson and associated estate/partition documents, confidential settlement and release agreements, severance agreements, employment contracts, and 74 GB of executive Outlook PST email archives across four users spanning 20182025. The financial reporting archive contains 498 audit and review reports from eight firms (Ernst & Young, Weaver, Deloitte & Touche, BKD, PwC, Whitley Penn, CliftonLarsonAllen, and Null-Lairson) spanning 19962025, including engagement letters, management representation letters, attorney confirmation letters, governance letters, internal control deficiency notifications, and bond consent materials. Twenty-two years of federal and state income tax returns (20042026), bank account analyses across 17+ banks from 20062026, and partner meeting materials for all 25+ active communities complete the financial picture. -
November 9, 2026 • carrollins.com was listed as a victim on the leak site of the everstake ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Retail & E-Commerce. Country: United States of America. Website: carrollins.com. Insurance Agency
-
November 9, 2026 • Vanderbilt EDU was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Education. Country: United States of America. If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
-
November 9, 2026 • Texas HHSC was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Government & Defense. Country: United States of America. So much for firing your enployees for leaking ~94k records, the true flaw remained in your system leading to the whole program being compromised, it's actually laughable, 2 Million Texas Citizens, Medicaid, Banking Information, SNAP, TANF, Disaster Assistance, well, like stated it is not just that, yet, the whole program. Yikes. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
-
November 9, 2026 • Cameroon government troops leaked was listed as a victim on the leak site of the HYFLOCK ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Government & Defense. Country: Cameroon. Website: mindef.gov.cm. The core conclusion has already completed an analysis of the entire database's data volume sorted by table. It can be confirmed that this is a massive database containing over 6 million records, including nearly 1.35 million historical personnel records (HISTO_RECIP) and nearly 2.41 million core operation audits/history records (HISTO_OR). More seriously, the TMOUCHARD table contains nearly 1 million recordsin French, 'Mouchard' means 'spy/listener/log monitor,' which indicates that the system's core activity audit logs have also fallen into the hands of the attacker. Below is a deep security breakdown of the non-empty tables sorted by data: 1. Precise Quantitative Analysis of Core Affected Assets By doing this, the attacker has effectively ranked the database's assets by value. The following types of data are in extremely high-risk status: 1) Core identities and historical records (totaling about 1.6 million+) RECIPIENDAIRE (160,920 records) & DISTINCTION (161,481 records): Current roster of awarded/declared military and political personnel. HISTO_RECIP (1,349,243 records): This is the largest core asset, containing detailed birth/death records, career histories, files, or background information for over 1.34 million historical personnel. FGRADE_ARME (6,542 records): Military rank and branch correspondence, used to precisely identify high-value targets (such as generals and senior special forces officers). 2) System core audit logs have been 'reverse-forensicated' (nearly 1 million records) TMOUCHARD (999,037 records): In French business systems, 'Mouchard' usually refers to backdoor logs, user activity tracking logs, or security audit tables. Severe consequence: The attacker stole nearly a million audit logs, which means they didn't just take the datathey also learned the system administrators' routine checks, login times, and frequently accessed assets. They could use this knowledge to precisely hide their backdoors or even delete specific log entries without being easily noticed. 3) Full business process history (about 2.7 million+) HISTO_OR (2,409,874 records): Possibly historical orders, commands, or core decision-making flows. TRANSMIS_MEMOIRES (246,658 records) & HISTO_MEMOIRE (264,407 records): Over 500,000 memoranda, submitted documents, and transmission records. This involves a large amount of non-public official communications from the state, military, or government internal exchanges. ...
-
November 9, 2026 • M.C.S. Steel Public Company Limited was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Manufacturing. Country: Thailand. M.C.S. Steel Public Company Limited M.C.S. Steel Public Company Limited - largest structural-steel fabricatorin Thailand, SET-listed (ticker MCS).Total files: 2,314,625Total volume: 4.2 TB'Senior Advisor to Chairmen of the Board' paid 800,000 JPY/month viaTrust Engineering K.K. (Tokyo) to Keiyo Bank Chiba account 5376091,term Nov-2025..Oct-2027 - while Mr. Yokoyama Yukio also sits on MCSpayroll. Related-party flow outside SET disclosures.Chairman & CEO Dr. Naiyuan Chi carries a PAYROLL 'advisor' gross of12.92M THB/yr (2023-2026); lifetime net receipts ~79M THB (2015-2026).Advisor/consultant contracts to Haneishi, Iijima, Ogilvie, Yang -overlapping the company's Japanese payroll.Identity documents of staff incl. Chairman's daughter (Thai nationalIDs, passport, house registration), foreign managers' work permits.Myanmar workshop staff charged 500-800 THB per clinic visit (signedmemo, 2023) - labour-protection exposure.Prior Faust ransomware infection inside the network (victim idA2242861-3499) - security failures never remediated; SQL credentialsand Windows OEM keys stored in plaintext.Confidential pipeline of Japan's Big-5 contractors incl. site names. More
-
November 9, 2026 • La'ala Al Kuwait Real Estate Co KSCC was listed as a victim on the leak site of the Eclipse ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Retail & E-Commerce. Country: Kuwait. Website: www.laalaalkuwait.com. La'ala Al-Kuwait Real Estate Company is a major pioneering real estate development and construction firm based in Kuwait, established in January 1991. Originally founded by the Al-Marzouq family, the company transformed from a traditional real estate business into an infrastructure and marine construction powerhouse. This shift occurred after the company struggled to find contractors capable of handling the highly complex earthworks, dredging, and marine engineering required for its signature megaproject: Sabah Al-Ahmad Sea City. Consequently, La'ala invested heavily in its own massive fleet of heavy excavation equipment and assembled an expert team of civil and marine engineers.
-
November 9, 2026 • Heartland Honda was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Retail & E-Commerce. Country: United States of America. Website: heartlandhonda.com. Country: Springdale, Arkansas, US | Website: heartlandhonda.com | Revenue: $85 Million | Industry: Automotive Dealership, New & Used Car Sales, Automotive Service & Repair | Employees: 150-250 | Properties: 144 GB (39,140 Files, 945 Folders)
-
November 9, 2026 • Ornico was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Professional Services. Country: South Africa. Website: www.ornico.co. Country: Gauteng 2000, ZA | Website: www.ornico.co | Revenue: $20 Million | Industry: Information and Media | Employees: 100-200 | Properties: 216 GB (583,507 Files, 23,572 Folders)
-
November 9, 2026 • Published was listed as a victim on the leak site of the PixelLeaks ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Technology. This disclosure concerns a verified set of records from a hosted email and IT services provider in Italy. The material scheduled for publication comprises the hosted mail database, covering more than 24,000 mailboxes of the provider's client organizations, together with business correspondence and internal documents.
-
November 9, 2026 • B... W... was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-11-09. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).
-
November 7, 2026 • Living Word Schools was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-11-07. Sector: Education. Country: United States of America. Website: livingwordschools.org. An educational institution/network providing school-related educational services. Its online platform includes student and school administration functionality, including an application portal and login facilities. Publicly available information suggests an education-focused organization.
-
November 7, 2026 • Albion Online Data Project was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-11-07. Sector: Technology. Country: United States of America. Website: www.albion-online-data.com. A community-driven data platform that collects and distributes real-time market prices, gold prices, market orders and historical data for the MMORPG Albion Online. It provides APIs, data feeds and downloadable client software for players, developers and third-party applications.
-
November 9, 2026 • Wilentz, Goldman & Spitzer was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Professional Services. [AI generated] Wilentz, Goldman & Spitzer is a law firm based in the United States, headquartered in Woodbridge, New Jersey. It provides legal services across practice areas including litigation, business law, real estate, health law, family law, personal injury, and trusts and estates. Operating within the legal services industry, the firm serves individual and corporate clients primarily throughout New Jersey and the broader New York metropolitan region.
-
November 9, 2026 Irwin Automotive Group was listed as a victim on the leak site of the Aoqin ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Retail & E-Commerce. Country: United States of America. Irwin Automotive Group is a premier car dealership located in Laconia, NH, specializing in new and pre-owned vehicles from trusted manufacturers such as Toyota, Chevrolet, Hyundai, Ford, and Lincoln. They offer a wide range of services including automotive sales, financing options, and expert maintenance performed by factory-trained technicians. The dealership is committed to providing a transparent and enjoyable car shopping experience, with a focus on customer satisfaction and community involvement. Irwin Automotive Group serves clients across the Lakes Region and Central New Hampshire, ensuring a reliable and quality service for all automotive needs. Status: Not paid. Data publication: 2026-11-18 22:00 UTC. Revenue: $27M. Employees: 200. Data type: Contracts, banking, clientsData, confidential.
-
November 9, 2026 • fhiworks was listed as a victim on the leak site of the iah6477 ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Healthcare. Size: 114.0 GiB
-
November 9, 2026 • Vertex Pharmaceuticals Incorporated was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-09. Sector: Healthcare. Country: United States of America. biopharmaceutical United States | A prescriber identification list of a US biopharmaceutical company: 248,023 named nurse practitioners and physician assistants; 237,785 DEA registration numbers with full names and practice addresses; Prescriber IDs, specialties and specialty subgroup targeting | [NOT PAID EXPOSED]