Recent Breaches

ELITDATA SE (Advokatfirman Kurt Lundberg HB,Artwood AB,Mantum Group) October 5, 2026 • [ ransomware, leak, technology ] ELITDATA SE (Advokatfirman Kurt Lundberg HB,Artwood AB,Mantum Group) was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: Sweden. # Elitdata i Varberg AB Complete Infrastructure Breach **Published:** [DATE] --- Elitdata i Varberg AB (org.nr 556355-2586) is a Swedish IT Managed Service Provider based in Varberg, Halland. Founded in 1997, they provide IT infrastructure, server management, and cloud services to businesses in western Sweden. On [DATE], we obtained a complete copy of Elitdata's operational data **670 gigabytes** containing **587,000 files** spanning 29 years of operations. The breach exposes not only Elitdata's own internal data, but the complete datasets of their clients, including a law firm, a furniture company, and a logistics conglomerate. Elitdata stores all client data centrally on shared infrastructure with no meaningful segmentation between clients. A single compromise cascades through their entire client base. --- ## The Scope | Dataset | Type | Size | Files | |---|---|---|---| | Elitdata i Varberg AB | IT Provider internal ops + 198 client folders | 80 GB | 55,000 | | Advokatfirman Kurt Lundberg HB | Swedish law firm | 122 GB | 204,000 | | Artwood AB | Furniture & design company | 205 GB | 327,000 | | Mantum Group | Logistics & construction conglomerate | 263 GB | 129 | | **Total** | | **670 GB** | **587,000** | --- ## Elitdata The IT Provider **Address:** Vstra Vallgatan 7, 432 45 Varberg, Sweden **Website:** elitdata.se | **Phone:** 0340-86860 Elitdata is owned by Mattias Rdlund and Stefan Qvarford. Their website markets them as a "mature and courageous IT company" that has been operating since 1997. From their infrastructure we obtained: **198 Client Organizations** complete IT documentation for each, including: - VPN access configurations (.tgb) to connect directly to client networks - Firewall configurations (full rulesets) - Bitlocker encryption keys - Server documentation and network diagrams - Remote Desktop (RDP) connection files for 50+ client sites **Wildcard SSL Private Keys:** - `*.elitdata.se` certificate with private key (.pem, .pfx), valid 2025-2026 - `*.mantum.se` certificate with private key (.key, .pem, .pfx), valid 2026 **XCA Certificate Database** the complete certificate authority used to manage all SSL certificates. **Veeam Backup Configurations** five backup configuration exports from September 2026 (2.3 GB total), containing the full backup infrastructure layout. **Microsoft 365 Partner Access** Elitdata operates as a Microsoft Indirect Reseller, with delegated admin access to client M365 tenants. **Employee Data** vacation/absence records 2009-2025, driving logs, personal folders for all staff. **NIS2 Compliance Documents & Incident Response Plan** ironically, their own security documentation is part of the breach. --- ## Client 1: Advokatfirman Kurt Lundberg HB Law Firm **122 GB | 204,000 files | Org.nr 559218-5713** This is the most sensitive dataset. Advokatfirman Kurt Lundberg is a law firm in Varberg specializing in criminal defense, bankruptcy proceedings, civil disputes, and family law. The exposed data includes the **complete case archive** of the firm: ### Criminal Defense Cases 26,871 files The criminal defense archive contains named defendants with their: - Full police investigation reports (FUP frunderskningsprotokoll) - Attorney defense notes and strategy documents - Personal identity documents and passport copies - Court case references (Varbergs Tingsrtt, Gteborgs Tingsrtt) - Phone call logs between attorney and client - Evidence files including USB phone extractions Case types include aggravated tax fraud (grovt skattebrott), civil registration fraud (folkbokfringsbrott), assault, drug offenses, and multiple migration/asylum cases. ### Bankruptcy Proceedings 110,973 files Complete legal files for 20+ company bankruptcies, including: - Creditor lists and debt inventories - Asset valuations and estate inventories - Creditsafe credit reports - Court filings and distribution plans - Wage guarantee (lnegaranti) documents for affected employees ### Civil Disputes & Family Law 20,807 files - Civil lawsuits and insurance claims - Inheritance distributions (arvskiften) - Guardianship cases (God Man) - Custody matters - Estate administration (ddsbon) ### Attorney Communications - Email archives (PST) totaling approximately 15 GB - Internal correspondence between lawyers - Client communication records ### Financial Records - Complete SIE accounting files 2020-2026 - Payroll records (Visma Ln 300) for 2021-2024, including a separate file for "Advokatfirman Anton Karlsson AB" - Balance reports and general ledger entries **Identified attorneys and staff:** Anton Karlsson (primary case attorney), Sofia (disputes/family law), Henrik, Anders, Krister, Peter, Tina, Ing-Mari, Ulla, Kurt Lundberg (founding partner). --- ## Client 2: Artwood AB Furniture & Design **205 GB | 327,000 files** Artwood AB is a Swedish furniture and home dcor company with international sales across Scandinavia, Europe, and New Zealand. The exposed data includes their **complete business operation:** - **Purchasing** (55,684 files) supplier contracts, purchase orders, pricing structures with factories - **Sales** (15,058 files) complete customer lists, pricing, order history - **Marketing** (33,969 files) product catalogs, campaigns, promotional materials - **Complete ERP backup** (54,916 files) Pyramid ERP system with full database - **3D product renders** (19,407 files) entire 2026 product line in 3D - **Employee data** phone list of all employees, email lists, personnel records, anniversary tracking - **EU Deforestation Regulation** (EUDR) compliance documentation **From Elitdata's client folder for Artwood:** - VPN configuration file (Artwood.tgb) - Complete firewall configuration (startup-config.conf) - SSL certificate for mail.artwood.se with private key - GDPR Data Processing Agreement (Personuppgiftsbitrdesavtal) - Incident report templates A competitor with access to this data would gain complete visibility into Artwood's supplier network, pricing strategy, customer base, and product pipeline. --- ## Client 3: Mantum Group Logistics & Construction Conglomerate **263 GB | 129 files (all SQL databases)** Mantum is a Swedish conglomerate operating across logistics, construction, and transportation through multiple subsidiaries. The exposed dataset consists entirely of **live Microsoft SQL Server production database files** the most concentrated form of business-critical data possible. ### Databases: | Database | Size | Contents | |---|---|---| | BC140.mdf | 103 GB | **Microsoft Business Central PRODUCTION** complete ERP | | RamosMantumProd.mdf | 28 GB | Production management system | | Flow_Mantum (6 instances) | 82 GB | Manufacturing/logistics operations | | Hogia_HR_Foundation | 2.7 GB | **HR database employee records, contracts, personnummer** | | Hogia_PBM (7 databases) | 1.7 GB | **Payroll & personnel management** | | Hogia_Travel | 72 MB | Travel/expense management | | Opter + Opter_Special | 8.2 GB | Transport/logistics management | | Per-company accounting | ~600 MB | 10 subsidiaries, 7 years of data | ### Subsidiary companies exposed: Mantum Entreprenad AB, Mantum Entreprenad i Sverige AB, Mantum Holding AB, Mantum Logistics, Mantum Special AB, Hyltebruks Transport AB, Veddige keriaktiebolag, KC Holding, V Service AB, VAAB Service AB. ### Plaintext Credentials From Elitdata's client documentation for Mantum, a file titled "Anvndare.txt" contains plaintext credentials: - **Microsoft 365 Global Admin:** admin@mantum.se - WiFi network passwords for all Mantum SSIDs - Aruba switch and access point admin credentials - Application credentials for RAMOS production system - Individual user credentials These databases contain every financial transaction, employee record, salary payment, customer invoice, supplier payment, inventory movement, and logistics operation for the entire Mantum corporate group spanning 2018 through 2025. --- ## Why This Matters ### 1. Supply Chain Cascade One IT provider. 198 client organizations. All exposed through a single point of failure. Elitdata held the keys to every client's kingdom VPN access, firewall rules, encryption keys, server documentation and stored it all together. ### 2. Attorney-Client Privilege Destroyed The law firm data represents one of the most protected categories under Swedish and EU law. Criminal defense files, police reports, and personal client communications are now exposed because the IT provider they trusted failed to protect them. ### 3. GDPR Nuclear Scenario Elitdata serves as data processor (personuppgiftsbitrde) for all 198 clients. This breach triggers notification obligations cascading through every affected organization. The Swedish Authority for Privacy Protection (IMY) will need to assess GDPR violations not just for Elitdata, but potentially for each client that entrusted their data. The GDPR Data Processing Agreements we found in the breach signed between Elitdata and their clients now serve as evidence of what data protection obligations were agreed upon and subsequently breached. ### 4. Active, Current Data The most recent files are dated September 2026. Veeam backup configurations from September 17-21, 2026. VPN configurations updated August 2026. SIE accounting files for fiscal year 2025-2026. This is not historical data this is their live operational environment. --- ## Data Available The complete dataset (670 GB) is available for download and includes: - Internal IT infrastructure documentation for 198 Swedish organizations - Law firm complete case archive (criminal defense, bankruptcy, disputes, family law) - Furniture company complete business data (ERP, purchasing, sales, HR) - Logistics conglomerate SQL production databases (ERP, HR, payroll, accounting) - SSL wildcard certificates with private keys - VPN and firewall configurations for client networks - Microsoft 365 delegated admin access documentation - 29 years of operational records --- *Contact us through our secure channel for any inquiries.*
ZIRNET LLC (mmplumbingny.com alpha1usa.com askconstruction.com mmplumbingny.com tristate-s... October 8, 2026 ZIRNET LLC (mmplumbingny.com alpha1usa.com askconstruction.com mmplumbingny.com tristate-s... was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Other. Country: United States of America. # ZIRNET LLC Managed Service Provider FULL BREACH **Published:** October 2026 **Sector:** Information Technology / Managed Services (MSP) **Location:** Port Washington, New York, USA **Website:** zirnet.com --- ## Summary ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida. We have obtained **complete access** to ZIRNET's internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals. **Total data: 2,260,963 files across ZIRNET and 12 client server backups.** --- ## Affected Organizations ZIRNET's negligent security practices have resulted in the exposure of the following companies' complete IT environments: | # | Company | Industry | Location | Files | |---|---------|----------|----------|-------| | 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 | | 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 | | 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 | | 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 | | 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 | | 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 | | 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 | | 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 | | 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 | | 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 | | 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 | | 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 | **Additional organizations with exposed credentials and data:** - Skylatus Property Capital LLC (Real Estate) - ClearScope (myclearscope.com) - Midtown Operating Corp - Credit and Debt Management Institute (Bolivar, TN) - La Perla Construction & Design - LIVOTIS Old World Market - St. Albans Congregational Church (Queens, NY) - Creative Mobile Technologies (CMT) - North Side Transmission - NY Flooring Inc - Metropolitan Association of the NY Conference --- ## What Was Obtained ### 1. ZIRNET Internal Data (2,743 files) - **QuickBooks databases** Zirnet.QBW (163 MB) and 2025.QBW (155 MB) complete financial records - **Bank statements** TD Bank, American Express, Bank of America 36 PDF statements covering 2024-2026 - **Email archive** 3.27 GB of PST files (Outlook) containing all business correspondence - **IRS documents** W-9, estimated tax payments, certified copies - **Client proposals and contracts** service agreements with all clients ### 2. Complete Credential Database (100+ accounts) For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained: - **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords - **Industrial Solutions (ISNY):** 39 email accounts with passwords - **ClearScope:** 8 Microsoft 365 accounts with passwords - **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials - **St. Albans Church:** 18 email accounts + Azure tenant secret key - **LIVOTIS:** 3 accounts + VoIP portal access - **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness) ### 3. Hidden Backdoor Account on ALL Client Machines ZIRNET created a **hidden administrator account** on every managed workstation and server: ``` Username: NetworkAccess Password: [REDACTED] ``` This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** a single credential compromise gives access to every machine ZIRNET manages. ### 4. Credit Card Numbers (with CVV) Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes. ### 5. Personal Identifiable Information (PII) - **Social Security Numbers** Employee SSN scans from Dynotec, ASK Construction - **Birth certificates** AlphaOne USA (family members) - **W-2 forms / Tax returns** Multiple years (2021-2025) for AlphaOne USA employees - **Employee I-9 forms and drivers licenses** AlphaOne USA - **Medical records** Owner's colonoscopy, CT scan, and family medical documents - **Credit reports** Owner's personal credit history (2005-2015) - **Payroll data** Complete W-2/W-3 packages for multiple years across organizations ### 6. Network Infrastructure - **Juniper SRX firewall configuration** (Midtown Operating) root passwords, VPN pre-shared keys, full NAT rules, internal network topology - **Meraki MX67 firewall credentials** (Skylatus) admin password, WiFi PSKs, external IP - **N-Central RMM admin credentials** ZIRNET's remote management console controlling all endpoints - **Azure tenant secrets** tenant IDs, client secrets for M365 migrations ### 7. Full Server Backups (12 clients) Complete drive images from 12 client servers including: - All user documents, profiles, and application data - Accounting records (invoices, payroll, tax documents) - Private folders with personal files - Browser profiles with saved credentials - Construction project files, contracts, permits - HR files, employee records, compliance documents --- ## Evidence **See attached screenshots:** 1. `01_clients_list.png` Full client listing with file counts 2. `02_credentials.png` Sample of extracted credentials (partially redacted) 3. `03_financial.png` ZIRNET financial data and bank accounts 4. `04_pii_sensitive.png` PII and sensitive document inventory 5. `05_infrastructure.png` Network backdoors and firewall configurations --- ## Impact Assessment This breach affects: - **13+ organizations** across New York, New Jersey, Florida, and Tennessee - **500+ individuals** (employees, contractors, clients of affected companies) - **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data) ZIRNET's security practices represent gross negligence: 1. **Storing all client passwords in plaintext text files** 2. **Using a single hidden backdoor account across all clients** 3. **No encryption on sensitive data storage** 4. **Storing credit card numbers with CVV in plain text** 5. **Mixing personal medical/financial records with business data** --- ## Contact ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published. Countdown: **7 DAYS** After the deadline: - All credentials will be published unredacted - All PII including SSNs will be published - All financial records will be published - Each affected company will be notified individually - Data will be made available for free download **ZIRNET:** You know how to reach us. The clock is ticking. --- *This post will be updated as more data is analyzed. Additional client data may be published as proof of access.*
La Filipina Uy Gongco October 7, 2026 La Filipina Uy Gongco was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-07. Sector: Agriculture and Food Production. Country: Philippines. # La Filipina Uy Gongco Corporation (LFUGGOC) Philippines **Published:** [DATE] **Data Volume:** 278,594 files --- ## Company Overview **La Filipina Uy Gongco Group of Companies (LFUGGOC)** is a major Philippine conglomerate operating across multiple industries including food manufacturing, flour milling, animal feed production, sugar processing, livestock farming, port operations, logistics, and real estate. **Website:** foodgroup.ph **Headquarters:** Taguig City (BGC), Metro Manila, Philippines **Employees:** 1,500+ **Annual Revenue:** Estimated PHP 15-20 billion ($270-360M USD) **Auditor:** SGV & Co. (Ernst & Young Philippines) **ERP:** SAP S/4HANA The group operates 17+ legal entities across the Philippines with nationwide operations spanning Luzon, Visayas, and Mindanao regions, including 6+ port terminals, flour mills, feed mills, sugar centrals, farms, retail stores, and distribution networks. --- ## Group Entities | Segment | Companies | |---|---| | **Logistics** | Amigo Logistics Corp (ALC), Amadi ALC Services (AASI), Amadi MGT Terminals (AMTI), Mariveles Grain Corp (MGC) | | **Flour & Pasta** | Philippine Foremost Milling Corp (PFMC), PLILI, MT Philippine Container (MTPCI) | | **Feeds & Livestock** | LFUG Manufacturing (LFMI), Farms Division, Progreso Retail Stores (PRSI) | | **Sugar** | CSCI, CAFC, RAFC, Plantation Division | | **Commodities** | Advanced Agrisolutions Philippines Corp (AAPC), Gentle Earth | | **Holdings** | CDH Holdings, STARCI/PGIC, Hok Heng/HHH Trading | | **Real Estate** | LFUG Realty | --- ## Data Exfiltrated Complete contents of the production file server (FILESHARED01) containing 278,594 files spanning 2018-2026, including: ### Financial Data - **Consolidated Financial Statements** for the entire group (FY2022 through July 2026) - **Annual Financial Statements** (AFS) for all business units - **Budget files** for 2022-2027 including forward projections - **SGV (Ernst & Young) external audit workpapers** (2022-2025) - **Bank statements** and reconciliation files (BPI, BDO, Metrobank) - **Loan documents** including PHP 300M+ BPI promissory notes and amortization schedules - **Quarterly Income Tax Returns** and all BIR filings ### Employee Data (PII) - **Complete payroll summaries** for all months of 2025 (24 files, ~13MB each) - **Employee Alphalist** (JAN-DEC 2025) all employee TIN numbers and annual income - **Employee contact details** names, phone numbers, email addresses, positions - **13th Month Pay summaries** - **Leave summaries** and tax refund data - **SSS, HDMF (Pag-IBIG), and PhilHealth** contribution records ### Organizational Data - **30+ organizational charts** for all business units (dated March 2025) - **Job descriptions** with career paths for all positions - **KPI documents** - **Headcount reports** (2026) ### Customer & Vendor Data - **Customer contact database** (26MB) including major Philippine food brands: - Jollibee Foods Corporation - Goldilocks Bakeshop Inc - Shakey's Pizza Commerce Inc - The French Baker Inc - Pan De Manila - North Park Noodle House - Vikings Group - Monde Nissin Corporation - Del Monte Philippines - **100+ flour bakery client files** across the Philippines - **30+ notarized vendor contracts** ### Legal & Compliance - Correspondence and billing from **5 law firms** (MVGS Law, SAM Law, MOST Law, Rojas & Uy, Tillman & Marquez) - **Litigation files** - **SEC filings** and corporate governance documents - **BIR validated tax returns** (2022-2025) - **Business permits** (Taguig, Davao, Iloilo, Ingore) - **Insurance policies** and asset registers ### Operations - **Import/export documentation** and customs records - **Vessel operations** data and shipping schedules - **SAP S/4HANA** data exports, journal entries, and master data - **Marketing materials** for brands: Iron Claw, Canis Prime, IC+, Progreso - **IT infrastructure** data including database connection files --- ## Regulatory Implications This data is subject to the **Philippine Data Privacy Act of 2012 (Republic Act No. 10173)**, which requires: - **Mandatory breach notification** to the National Privacy Commission (NPC) within 72 hours - **Notification to affected data subjects** (1,500+ employees and thousands of customers) - Penalties of up to **PHP 5,000,000** and **imprisonment of 3-6 years** for violations The company has **5 business days** to respond before data publication begins. --- ## Proof of Data See attached screenshots showing: 1. Complete file server directory structure 2. Employee payroll files with dates and sizes 3. Group consolidated financial statements 4. HR organizational charts for all business units 5. Customer contact database and email addresses 6. Banking documents and tax filings
Nandan Terry Pvt October 2, 2026 • [ ransomware, manufacturing, financial ] Nandan Terry Pvt was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-02. Country: India. # NANDAN TERRY LTD DATA BREACH ANNOUNCEMENT **Industry:** Textile Manufacturing (Terry Towels, Bathrobes) **HQ:** Dholka, Ahmedabad, Gujarat, India **Group:** Chiripal Group **Website:** nandanterry.com **Revenue:** ~$23M USD (194 Crore) **Employees:** 500+ --- ## WHAT WE HAVE Nandan Terry Limited's entire corporate infrastructure has been compromised. We have exfiltrated **200GB+** of data from their internal file servers including 68 workstation backups and all department shared drives. --- ### CREDENTIALS & ACCESS (46+ accounts) Login credentials for **every shipping and logistics portal** they use including their supply chain accounts with: - **H&M Supplier Portal** (supplierportal.hm.com) - **Marks & Spencer** Trading Grid & EDI - **Walmart** cargo systems - **Puma** shipping & PO management - **ALDI** production & contracts - **LIDL**, **TJX/Marshalls**, **Ross Stores**, **BJ's Wholesale**, **Big Lots**, **QVC**, **Metro**, **XXX Lutz** - **DHL**, **Kuehne+Nagel**, **GEODIS**, **Yusen Logistics**, **Expeditors** All usernames, passwords, portal URLs. Many still active. --- ### COMPLETE FINANCIAL RECORDS - **Profit & Loss** statements monthly, FY 2024-2026 - **Balance Sheet** FY 2024-25 (audited, 47 pages) - **Consolidated P&L** with revenue breakdown (Export vs Domestic) - **EBITDA, Net Profit, Working Capital** calculations - Revenue: **194 Crore** ($23M), Net Profit: **9 Crore** ($1.07M) - Full cost structure: raw materials, salary, power, logistics --- ### BANKING & LOAN DATA Complete banking relationships with **7 major Indian banks**: | Bank | Facility | |------|---------| | **Punjab National Bank (PNB)** | CC 70Cr + TL 95Cr | | **State Bank of India (SBI)** | TL 47Cr | | **Bank of Baroda (BOB)** | TL 47Cr | | **Canara Bank** | TL 47Cr | | **Central Bank of India (CBI)** | TL 70Cr | | **Union Bank (UBI)** | TL 47Cr | | **Bank of Maharashtra + Bandhan Bank** | CC facilities | **Total loan exposure: 433+ Crore ($51.5M)** All account numbers, IFSC codes, bank RM contacts (names, phones, emails), repayment schedules, interest calculations included. **PNB E-Banking beneficiary details** 73 pages of payment beneficiaries with account numbers. --- ### CIBIL CREDIT REPORTS & LEGAL ISSUES **Extremely sensitive** credit bureau data: - **CIBIL Commercial Credit Report** 69 pages, full credit history - **DPD (Days Past Due) reports** from Canara Bank (31 days) and SBI (29 days) **evidence of late loan payments** - **CIBIL irregularity complaints** to PNB - **Legal suits against company and directors** documented in internal files - **NCLT (National Company Law Tribunal)** withdrawal orders - Director **Braijmohan Chiripal** CIBIL irregularity for housing loan 4.75 Crore - **CRILC (Central Repository)** reporting disputes with Bank of Baroda, Central Bank of India, SBI This data reveals the company's **true financial health** not the version they show to their buyers. --- ### EMPLOYEE DATA (500+ workers & staff) - **Complete salary sheets** every employee, every month (NTPL Staff, NTPL Workers, SPG Staff, SPG Workers) - **Worker increment proposals** with full PII: Name, Father's Name, Department, Designation, Date of Joining, Salary - **PF (Provident Fund)** and **ESI** data - **SAP payroll upload files** with individual amounts - **KPI performance data** individual worker performance metrics --- ### CLIENT & SUPPLY CHAIN DATA **62+ global buyers** in customer master including: ALDI, H&M, Walmart, Marks & Spencer, Puma, TJX (Marshalls/TK Maxx), BJ's Wholesale, Ross Stores, Big Lots, QVC, Metro, XXX Lutz, Falabella, LIDL, Meijer, Bealls, Liberty, Hemtex/Kesko, Vineyard Vines, Cencosud, DD's Discount **Client-specific data includes:** - Purchase Orders with pricing - Product specifications (GSM, size, design files) - H&M Master Order Dashboards (2023-2026) - Puma packing instructions & shipment data - ALDI contract correspondence - Production schedules per buyer - Cost sheets and margin calculations **This data is devastating for their buyer relationships.** Major retailers like H&M and Walmart require strict data security compliance from suppliers. This breach proves Nandan Terry cannot protect their supply chain data. --- ### CORPORATE & LEGAL DOCUMENTS - **KYC package:** CIN, IEC (Import Export Code), GST Registration, Export House Certificate - **Board Resolutions** (conversion from Pvt to Public) - **Director list** with education and experience - **Insurance policies** (8 active plant, machinery, solar, marine) - **Settlement agreements** (Uday Buildcon) - **Tax Audit Reports** (FY 2019-2025) - **Secretarial Audit Report** 2024 - **CredAvenue borrower profile** and shareholding patterns - **DSRA release letters** from 4 banks --- ### DATA VOLUME | Category | Volume | |----------|--------| | Workstation backups | 68 machines | | Financial records | Monthly P&L, BS, NCA (2+ years) | | Salary data | ALL employees, monthly | | Banking data | 7 banks, full account details | | Client data | 62+ global buyers | | Credentials | 46+ portal logins | | Legal/CIBIL | Credit reports, court cases | | Insurance | 8 active policies | | Total estimated | **200GB+** | --- ## TIMELINE **Announcement published.** Nandan Terry Limited has been contacted. **4 DAYS** deadline to begin negotiations. If no contact is made, this page will be updated with additional proof samples and the countdown to full publication begins. **+10 DAYS** full data publication. If no agreement is reached within 10 days after the announcement deadline, the following actions will be taken: 1. **Full financial data** published (P&L, Balance Sheet, loan schedules, CIBIL reports) 2. **CIBIL credit reports and DPD irregularities** sent directly to all 7 banking partners PNB, SBI, BOB, Canara, CBI, UBI, Bank of Maharashtra 3. **H&M, Walmart, Puma, ALDI, Marks & Spencer** notified of their supplier's data security failure and supply chain data exposure 4. **46+ portal credentials** published active shipping and logistics accounts compromised 5. **Employee PII** released salary data, PF numbers, personal details of 500+ workers 6. **Complete data dump** published on clearnet and Tor free download for anyone **Total time to act: 14 days from today.** The clock is ticking. --- *Data verified. Screenshots below are samples only. Full dataset available for verification upon contact.* --- ## PROOF DATA SAMPLES *Screenshots from exfiltrated data:* ![Data Tree Overview](00_DATA_TREE_OVERVIEW.png) ![Portal Passwords 46+ Credentials](01_PORTAL_PASSWORDS.png) ![Bank Loan Facilities 433 Crore](02_BANK_DETAILS_LOANS.png) ![Bank Relationship Manager Contacts](03_BANK_CONTACTS.png) ![Loan Outstanding June 2025](04_LOAN_OUTSTANDING.png) ![Term Loan Repayment Schedule](05_LOAN_REPAYMENT.png) ![Corporate Loan Interest Calculation](06_CORPORATE_LOAN_INTEREST.png) ![Customer Master 62+ Global Buyers](07_CUSTOMER_LIST_GLOBAL.png) ![Worker Increment Proposal Employee PII](08_WORKER_INCREMENT_PII.png) ![Profit & Loss Statement FY 2025-26](09_PNL_FINANCIALS.png) ![Consolidated P&L Revenue & EBITDA](10_CONSOLIDATED_PNL.png) ![CIBIL Commercial Credit Report (69 pages)](11_CIBIL_CREDIT_REPORT.png) ![Canara Bank Days Past Due Report](12_CANARA_BANK_DPD.png) ![SBI Days Past Due Report](13_SBI_BANK_DPD.png) ![PNB E-Banking Beneficiaries (73 pages)](14_PNB_EBANKING_BENEFICIARIES.png) ![Balance Sheet FY 2024-25 (47 pages)](15_BALANCE_SHEET_FY2425.png)
Onmion LLC (Lake Connor Park, Port Susan Camping Club, Cured by Visconti) September 30, 2026 • [ ransomware, misconfiguration, technology ] Onmion LLC (Lake Connor Park, Port Susan Camping Club, Cured by Visconti) was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Hospitality. Country: United States of America. # Onmion LLC One IT Provider, Three Breached Companies, 3,000+ Victims **Subject:** Onmion LLC (Mukilteo, WA) Managed IT Provider **Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB --- ## Who Is Onmion LLC? **Onmion LLC** 10620 62nd Pl W, Mukilteo, WA 98275 (425) 349-9636 **onmion.com** A managed IT and software services provider that markets itself as "empowering businesses with cutting-edge software technology." In practice, Onmion LLC stored all of its clients' most sensitive data Social Security Numbers, banking records, healthcare credentials, tax filings on shared, unencrypted infrastructure with no segmentation between client environments. Through Onmion's FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.** ![Onmion Website](screenshots/01_onmion_website.png) *Screenshot 1 onmion.com "Empowering businesses with cutting-edge software technology"* --- ## Three Clients, One Point of Failure ![FTP Structure](screenshots/02_onmion_ftp_structure.png) *Screenshot 2 All three client datasets on the same shared FTP infrastructure* | # | Client | Website | Location | Data | Individuals | |---|--------|---------|----------|------|-------------| | 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members | | 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs | | 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs | --- ## Onmion's Failures ![N-Central RMM](screenshots/03_onmion_ncentral_rmm.png) *Screenshot 3 N-Central RMM backup archives from Onmion's management server* ![Healthcare Creds](screenshots/04_onmion_healthcare_creds.png) *Screenshot 4 Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted* ![Failures](screenshots/05_onmion_failures_summary.png) *Screenshot 5 Summary of Onmion's security failures* 1. **No segmentation** all clients on shared FTP with no access controls 2. **N-Central RMM exposed** 44 daily backups (45 GB) with device inventories and remote access credentials 3. **Plaintext passwords** production databases storing user credentials in cleartext 4. **Healthcare credentials in Word docs** 25+ login pairs for major US insurers unencrypted 5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files 6. **Refused to respond** when notified no action, no client notification --- # CLIENT 1 Lake Connor Park **lcpmembers.com** Tulalip, WA Gated residential/RV community 500+ members **178.8 GB exfiltrated** | Category | Details | |----------|---------| | SQL Databases | 92+ GB member records, POS transactions, user credentials | | N-Central RMM | 45 GB 44 daily backups of IT management server | | Gate Access Logs | 700+ daily logs 363+ members with names, cards, timestamps | | Member Database | 500+ records with full PII, passwords in plaintext | | Healthcare Creds | 25+ pairs AETNA, UHC, Humana, Cigna, others | | Source Code | 99 VB.NET files POS, QuickBooks integration | | System Backups | 656 DAR archives (4.8 GB), JanSep 2026 | ![LCP Data](screenshots/06_lcp_data_overview.png) *Screenshot 6 178.8 GB data archive* ![LCP Members](screenshots/07_lcp_member_database.png) *Screenshot 7 MAAS member database: 500+ individual PII records* ![LCP Gate](screenshots/08_lcp_gate_access_logs.png) *Screenshot 8 Daily gate logs: names, card numbers, timestamps* ![LCP Healthcare](screenshots/09_lcp_healthcare_creds.png) *Screenshot 9 Healthcare credentials in plaintext* ![LCP SQL](screenshots/10_lcp_sql_backups.png) *Screenshot 10 SQL Server database backups (92+ GB)* ![LCP Plaintext](screenshots/11_lcp_plaintext_passwords.png) *Screenshot 11 User passwords stored in cleartext in production DB* ![LCP N-Central](screenshots/12_lcp_ncentral_backups.png) *Screenshot 12 44 daily N-Central RMM backups* --- # CLIENT 2 Port Susan Camping Club **portsusan.com** Stanwood, WA Tribal nonprofit (Tulalip Tribes) 2,490 sites $7.4M revenue **400+ SSNs exposed** | Category | Details | |----------|---------| | Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings | | Employee PII | 219 individuals (91 active + 128 terminated) full SSN | | W-2 Forms | 2020-2025 SSN for every employee | | Vendor W-9s | 202 forms EIN/SSN for all vendors | | Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations | | HR Investigations | 10 named cases harassment, misconduct, legal | | IRS/Tax | 990T, 1099, PPP/SBA loan records | | IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps | ![PSCC Structure](screenshots/13_pscc_data_structure.png) *Screenshot 13 Three data drives: Finance (K), HR (T), Departments (V)* ![PSCC Finance](screenshots/14_pscc_finance_files.png) *Screenshot 14 20+ years of financial records* ![PSCC Employees](screenshots/15_pscc_employee_files.png) *Screenshot 15 91 active employee personnel files* ![PSCC W-2](screenshots/16_pscc_w2_payroll.png) *Screenshot 16 W-2 forms (2020-2025) with employee SSNs* ![PSCC Banks](screenshots/17_pscc_bank_accounts.png) *Screenshot 17 7 Heritage Bank accounts with full account numbers* ![PSCC W-9](screenshots/18_pscc_vendor_w9s.png) *Screenshot 18 202 vendor W-9 forms with EIN/SSN* ![PSCC HR](screenshots/19_pscc_hr_investigations.png) *Screenshot 19 10 confidential HR investigation files* --- # CLIENT 3 CarneVita / Cured by Visconti **curedbyvisconti.com** 1501 N Miller St, Wenatchee, WA Food production **26+ SSNs** $3.4-4.8M revenue Three entities compromised through a single shared backup: | Entity | EIN | QuickBooks | |--------|-----|------------| | CarneVita, LLC | 33-3284096 | 64 MB (active) | | Cured by Visconti, LLC | 85-0659112 | 201 MB (active) | | 3 Boots Ranch & Custom Cuts | | 13 MB (active) | | Category | Details | |----------|---------| | QuickBooks Files | 278 MB+ complete financials for all 3 entities | | IRS W-2 Forms | 26 employees full SSN, names, wages | | IRS 941/940/W-3 | Quarterly + annual federal tax returns | | Transactions | 2,018 documents invoices, POs, receipts | | Backups | 70+ automated QBW backups (Feb 2025 Apr 2026) | | Investment | Fidelity account statements | ![CV W-2](screenshots/20_carnevita_w2_forms.png) *Screenshot 20 W-2 forms with employee SSNs* ![CV 941](screenshots/21_carnevita_form941.png) *Screenshot 21 Form 941 CarneVita: 15 employees, $176K quarterly wages* ![Visconti 941](screenshots/22_visconti_form941.png) *Screenshot 22 Form 941 Cured by Visconti: 11 employees* ![CV QB](screenshots/23_carnevita_quickbooks.png) *Screenshot 23 QuickBooks files for all three entities* ![CV Invoices](screenshots/24_carnevita_invoices.png) *Screenshot 24 2,018 transaction documents* ![CV PII](screenshots/25_carnevita_pii_summary.png) *Screenshot 25 PII summary across all three entities* --- ## Combined Impact | Metric | Total | |--------|-------| | Organizations compromised | 3 | | Data exfiltrated | 179+ GB | | Individuals with PII exposed | 3,000+ | | Social Security Numbers | 426+ | | Bank accounts exposed | 10+ | | Healthcare credentials | 25+ portal logins | | Financial history | 20+ years | | IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 | | Member/client sites | 2,990+ | --- ## What Affected Organizations Should Do 1. **Terminate Onmion LLC** they knew and chose silence 2. **Engage independent cybersecurity counsel** 3. **Begin breach notification** per WA State RCW 19.255.010 4. **Notify banks** Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita) 5. **Report to WA Attorney General** and relevant authorities 6. **Offer credit monitoring** to all individuals with exposed SSNs **All data will be published in full if Onmion LLC continues to refuse engagement.** --- *Onmion LLC 10620 62nd Pl W, Mukilteo, WA 98275 (425) 349-9636 onmion.com* *Lake Connor Park lcpmembers.com | Port Susan Camping Club portsusan.com | CarneVita curedbyvisconti.com*
HONG BAO GROUP (lovelywines.co.th) October 6, 2026 • [ ransomware, retail, finance ] HONG BAO GROUP (lovelywines.co.th) was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Retail & E-Commerce. Country: Thailand. Website: lovelywines.co.th. # HONG BAO GROUP DATA BREACH **Hong Bao Group** ( ) a major Thai restaurant conglomerate operating 15+ restaurant brands across Bangkok, including **Hong Bao Restaurant**, **Water Library**, **Lovely Wine**, **PLU ()**, **CIAO PIZZA**, **Bistro**, and **SEED** has suffered a complete network compromise resulting in the exfiltration of their entire corporate infrastructure. ## Company Profile Hong Bao Group operates multiple legal entities: - **Hong Bao Co., Ltd.** ( ) - **Hong Bao EV Co., Ltd.** ( ) Tax ID: 0105559005630 - **Water & Wine (Thailand) Co., Ltd.** ( () ) - **Lovely Wine Co., Ltd.** ( ) - **I-Group** (investment holding) The group operates restaurants in premium Bangkok locations including MBK Center, King Square, Ramada, and multiple other shopping malls across Thailand. **Websites:** hongbaorestaurant.com | waterlibrary.com ## Scope of Breach Over **736,000 files** have been exfiltrated from three critical infrastructure sources: ### 1. Corporate File Server (FL6-SRV-FILSHA) - **86,500+ files** from all corporate departments - Accounting (Hongbao + Water divisions) - Executive Administration including **board meeting audio recordings** - Finance department complete reports - HR employee records, contracts, personal documents - Purchasing vendor agreements, pricing ### 2. Company NAS (NAS5EECFF) - **647,000+ files** the complete corporate document archive - **hongbao/** 400,000+ files: finance, tax, HR, SAP ERP documentation - **water/** 180,000+ files: Water & Wine financial, banking, payroll data - **hb_wl/** shared financial and tax records - **Scanned documents** thousands of signed originals ### 3. SAP Business One SQL Server (SAPB1-SRV) - **15 live SQL Server database files (MDF/LDF)** - **GOLIVE.mdf** (~62 GB) the entire SAP B1 production database containing ALL business transactions, customers, vendors, pricing, and inventory since inception - **GOLIVE_EV.mdf** (~56 GB) complete audit trail - **SBO-COMMON.mdf** (~10 GB) user accounts and system configuration - **master.mdf** SQL Server authentication database with login credentials - **1,918 branch database backup archives** covering 15 branches ## Data Categories Exfiltrated ### Financial Records (15,500+ files) Complete profit & loss statements, balance sheets, cash flow reports, and audit records across all branches spanning **20222026**. Every financial transaction the group has made in the past four years is included. ### Banking Information (28,400+ files) - **Bangkok Bank (BBL)** Corporate iCash account statements, transfers - **Siam Commercial Bank (SCB)** Business Net corporate banking records - **Kasikorn Bank (K-Cash Connect Plus)** payment records - Personal **credit card statements** of company directors - Wire transfer confirmations, payment vouchers ### Tax & Revenue Records (5,100+ files) - VAT filings for all entities - Withholding tax certificates - Revenue Department submissions - Annual tax returns from 20222026 ### Payroll & HR (7,800+ files) - Complete **salary records** for all employees across all branches - Overtime calculations, bonus payments - Social Security () contributions - Provident fund records - Employment contracts ### Email Archives (14 Outlook mailboxes) Complete email archives (.PST) of key personnel from both hongbaorestaurant.com and waterlibrary.com domains, including all attachments and internal communications. ### Personal Identity Documents - **Passport scans** and **Thai national ID cards** of company directors and executives - Visa and travel documents - Flight bookings and itineraries ### Contracts & Legal (2,800+ files) - Mall lease agreements for all restaurant locations - Vendor supply contracts - Non-disclosure agreements - Employment contracts with personal terms ### Wine & Alcohol Import Licenses (425+ files) All regulatory permits, excise department records, and import documentation for the Lovely Wine business **without which the wine import business cannot legally operate**. ### POS & Customer Data - 15+ branch point-of-sale databases with transaction history - Customer checkout records - Daily sales reports across all locations ### IT Infrastructure Access - SAP B1 user accounts (303+ users) with password hashes - SQL Server administrator credentials - QNAP NAS access credentials - TSplus remote access configuration files - Internal network mapping (172.16.x.x) - Evidence of prior security compromise (CLR assemblies loaded in SQL Server) ## Key Personnel Exposed Personal documents, passport scans, banking records, and travel documents of the following individuals are included in the breach: - **Noppadon Narittakurn** Director - **Tata** Director - **Zithai** Director / Designer - **Nitchaya Tohsanguanpun** Director ## Impact This breach represents a **complete corporate data compromise**. Every department, every financial record, every employee record, every branch database, and every executive communication has been exfiltrated. The data includes sensitive regulatory documents (tax filings, alcohol import licenses) that could trigger **government investigations** if disclosed publicly. The personal banking records and passport scans of company directors present significant **identity theft and fraud risks**. The SAP production database alone contains the company's **entire operational history** customer lists, vendor pricing, proprietary recipes and inventory formulas, and every financial transaction processed through their ERP system. **Data volume:** 736,000+ files | 15 SQL databases | 1,918 database backups | 14 email archives **Hong Bao Group has limited time to resolve this situation before full publication.**
Millimed Thailand (i-HERB) September 30, 2026 • [ ransomware, healthcare, manufacturing ] Millimed Thailand (i-HERB) was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Country: United States of America. # MILLIMED CO., LTD. () DATA BREACH DISCLOSURE **Date Added:** 2026-09-17 **Last Updated:** 2026-09-17 **Country:** Thailand **Industry:** Pharmaceutical Manufacturing & Distribution **Website:** millimedthailand.com **Revenue:** ~$70-85M USD (2.5-3.0 billion THB, group annual revenue) **Data Volume:** **~3 TB** (databases, production records, email archives, factory documents, financial data) --- ## Overview Millimed Co., Ltd. ( ) is a major Thai pharmaceutical manufacturer headquartered in Bangkok with GMP-certified production facilities in **Samut Prakan** and **Chiang Rai** provinces. The Millimed Group operates through **25+ subsidiary companies** spanning pharmaceutical manufacturing, consumer healthcare brands, supplements, real estate, agriculture, and hospitality. Their consumer brand **i-HERB**, endorsed by Thai celebrity **Mario Maurer**, is one of the most recognized herbal healthcare brands in Thailand. The company holds **multiple Thai FDA quality awards** and manufactures prescription drugs, OTC products, sterile eye drops (BFS technology), and dietary supplements distributed nationwide through hospitals and pharmacies. The group's crown jewel subsidiary **Millimed BFS** reported **1,423 million THB revenue** and **593 million THB net profit** in 2025, with a staggering **41.7% net margin** and **65% year-over-year growth**. The parent company holds **942 million THB in retained earnings** they can afford to resolve this. Millimed's management chose to ignore our communications and failed to protect their data. As a result, we are publishing details of the breach. --- ## What We Have Over 3 Terabytes We have obtained **complete access** to the Millimed Group's entire IT infrastructure across **both factory locations and the Bangkok headquarters**. This includes production servers, file servers, NAS systems, ERP databases, email archives, and factory department shares. The total data volume exceeds **3 terabytes**. ### Pharmaceutical Manufacturing Data (CRITICAL) - **Batch Manufacturing Records (BMR)** for **ALL pharmaceutical products** the legal backbone of every drug they produce. We hold BMR distribution records from 2016 through August 2026, covering 18+ active product lines including i-HERB, Neoca, Denta Dente, Haelex, Leluxi, Amogin, and more - **Quality Control & Calibration databases** testing results, equipment calibration records, deviation reports - **Drug Registration & Regulatory Affairs (RA)** data complete product formulations for Amogin (4 variants), Chlovas, Caltab, BFS eye drops, Lidocaine HCl, Hilazin, Nicardipine, Cystaline-200, Nuosic, and more. **Master Formula documents** included - **Bioequivalence Studies** (Bio Equalise subsidiary) complete BE study reports, LC-MS/MS chromatography data, OECD compliance documents, and the contract with Chiang Mai University Faculty of Pharmacy - **R&D Department** pilot batch data, stability studies, cleaning validation, pharmaceutical excipient references (USP 38, BP 2013) - **14 types of GMP audit records** Thai FDA, Halal, GSDP, GPP, ISO 9001/14001/17025, Pfizer audit, TAISHO audit, iNova audit (including **CAR/PAR corrective action records**) - **i-HERB brand complete IP** all formulations, BMR, SOP, COA, specifications, cosmetic registrations, and production data for the Mario Maurer-endorsed brand ### Complete Financial Records (25+ Companies) - **Audited financial statements** () for fiscal years **2024, 2025, and 2026** for all major subsidiaries: - Millimed Co., Ltd. 876M THB revenue, 54M THB net profit - **Millimed BFS 1,423M THB revenue, 593M THB net profit (41.7% margin!)** - Pros Pharma, MLM Healthcare, Neoca Healthcare, Bio Equalise, i-Herb Innovation, Siriphanwa - **K-Bank and EXIM Bank credit facility summaries** full loan structures, credit lines, and covenant details - **Monthly sales reports** (January 2025 **August 2026**) complete OTC and prescription drug revenue by product, region, sales channel, and individual sales unit - **Oracle ERP database** every financial transaction across the group. We also have the **Oracle ERP login credentials** (MMNEW/MMNEW@millimed.world) - **Accounting databases** for **all 25+ entities** complete general ledger, trial balances, tax reconciliation, intercompany transactions - **28 entity accounting folders** with full Chart of Accounts, audit records, tax preparation documents ### Employee & HR Data (1,000+ People) - **HRM8 database** complete employee records: names, national ID numbers (), salaries, benefits, performance reviews - **Organization charts** for all 7 production departments (PD1-PD7) with employee names - **Payroll data** for all subsidiaries across three locations - **FingerScan biometric data** backups - **Personal data** of 1,000+ employees across Bangkok, Samut Prakan, and Chiang Rai ### Email Archives (30+ GB) - **IT Administrator email archives** (15+ PST files) including: - Network configuration and infrastructure credentials - NAS Synology management alerts (neoca-office.synology.me, millimed-office.synology.me) - Microsoft 365 administration - VPN configuration and access management - Vendor communications and support tickets - Backup system notifications ### 60+ Credentials & Network Access - **Thai Revenue Department ()** login credentials for **ALL 25+ companies** tax portal access for every entity in the group - **BOI (Board of Investment)** portal credentials 5 companies with tax incentive access - **Department of Business Development ()** 5 corporate filing portal credentials - **Dual VPN access** WatchGuard Firebox at Ram Intra HQ (210.86.174.42) + **OpenVPN with full certificate chain and private key** for Neoca office (210.86.171.29) - **Oracle ERP credentials** MMNEW/MMNEW@millimed.world (production system) - **SQL Server logins** including sysadmin (sa), mkuser, DB_ECM, dev_01-03 - **Microsoft 365 tenant** (millimedthailand.com) cloud email and collaboration - **Active Directory** domain controller at 192.168.1.2 ### Complete Factory Infrastructure - **233+ department folders** from the factory file server every production, quality, regulatory, and administrative department - **22 CCTV cameras + 1 access control** complete Hikvision surveillance network with IP addresses and serial numbers covering BFS sterile area, laboratories, warehouses, food production, and all manufacturing floors - **31 internal network subnets** (192.168.69.0/24 through 192.168.100.0/24) full factory network topology - **5 internal servers identified** AD domain controller, 2x Orion NAS, barcode server, Chiang Rai center NAS - **VMware vSphere** virtualization infrastructure, **CheckMK** monitoring, **Hikvision iVMS-4200** CCTV management ### Sales & Operations - **SALES & SALESAPP databases** (12+ GB) complete sales history, pricing, customer relationships from 2022-2026 - **Monthly sales performance presentations** (January 2025 August 2026) OTC + prescription by area, product, channel - **Marketing database** campaigns, customer targeting, product focus data - **Stock management** inventory across all facilities - **Forecast data** business projections and planning - **Transport & logistics** GPS tracking, delivery records, government pharmaceutical organization reports --- ## Regulatory Impact Millimed should be aware of the following consequences of this data becoming public: 1. **Thai FDA (.) Manufacturing License** We hold the **actual BMR documents, QA audit records, and 14 types of regulatory audit documentation** including corrections (CAR/PAR). This is not just database records these are the physical production documents that underpin every drug Millimed manufactures. Release triggers **immediate FDA review and potential suspension of manufacturing licenses**. The FDA Quality Award for 3 consecutive years ends here. 2. **PDPA Violation (...)** Personal data of **over 1,000 employees** including national ID numbers, salaries, biometric data, and home addresses has been compromised. The PDPA Office can impose fines up to **5 million THB per violation** and criminal penalties including imprisonment. 3. **Revenue Department Exposure** We hold active login credentials for **ALL 25+ company tax portals** plus the complete intercompany financial structure across the group. The multi-entity accounting data, transfer pricing arrangements, and BOI tax incentive records will be of great interest to Thai tax authorities. 4. **Drug Formulation Theft** Complete drug formulations including **Master Formula documents**, bioequivalence study data, R&D results, and regulatory submissions for the entire product portfolio. Competitors gain **decades of R&D investment** in seconds. The i-HERB brand formulas, Neoca supplement compositions, BFS sterile manufacturing specifications, and all proprietary pharmaceutical formulations are fully exposed. 5. **Bioequivalence Study Exposure** Bio Equalise subsidiary's complete BE studies, including the **contract with Chiang Mai University**, LC-MS/MS analytical data, and OECD-compliant study reports. Competitors can use this data to bypass their own bioequivalence testing requirements. 6. **Banking & Credit Exposure** K-Bank and EXIM Bank credit facility details, loan covenants, and the true financial health of each subsidiary will be publicly available, potentially triggering credit reviews, covenant violations, or credit rating downgrades. 7. **Physical Security Compromise** The complete **CCTV surveillance network** (22 cameras + access control) with IP addresses and serial numbers, factory network topology, and building plans are exposed. Combined with VPN access credentials, this represents a total physical and digital security failure. --- ## Message to Millimed Management Chairman **Thongplew Siripornpithak** ( ) and the board of directors had an opportunity to resolve this matter privately. That window is closing. The data we hold represents the **complete digital footprint** of your 25+ company pharmaceutical empire **over 3 terabytes** spanning both factory locations, the Bangkok headquarters, and all subsidiary operations. From drug manufacturing records to tax filings, from employee national IDs to bank loan structures, from factory CCTV configurations to Oracle ERP credentials. Your **Millimed BFS** subsidiary generated **593 million THB in net profit** last year with a 41.7% margin. Your parent company holds **942 million THB in retained earnings**. You can afford to resolve this. Your **i-HERB brand**, endorsed by Mario Maurer and sold across Thailand, depends on consumer trust. Your **FDA manufacturing licenses** depend on the integrity of your BMR and QA data. Your relationships with **K-Bank and EXIM Bank** depend on financial confidentiality. Your **ISO and Halal certifications** depend on audit documentation security. **All of this 3 terabytes of it is now in our hands.** We strongly recommend Millimed's management reconsider their position and contact us immediately to resolve this situation before the full dataset is published. **Screenshots below demonstrate the scope and authenticity of the breach:** *(See attached: 26 evidence screenshots)*
Nota Groep September 28, 2026 • [ ransomware ] Nota Groep was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Other. Country: Netherlands. notagroep.nl
Kolin September 27, 2026 Kolin was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-27. Sector: Manufacturing. Country: Turkey. # Kolin Construction **Kolin Construction** (*Kolin naat Turizm Sanayi ve Ticaret A..*) is one of Turkeys major construction and industrial companies. Founded in **1977** and headquartered in **Ankara, Turkey**, the company serves as a flagship business of **Kololu Holding**. ## Business Activities Kolin Construction operates primarily in large-scale construction, infrastructure, and engineering projects. Its areas of expertise include: * Highways and road infrastructure * Bridges and viaducts * Tunnels * Railways and metro systems * Airports * Ports and marine infrastructure * Dams and hydroelectric power plants * Energy infrastructure * Industrial and mining projects The company has participated in numerous major infrastructure developments in Turkey and abroad and has regularly appeared in international contractor rankings published by **Engineering News-Record (ENR)**. ## Major Projects Kolin Construction has been involved in several large-scale and strategically important projects. One of its most notable developments is its participation in the construction of **Istanbul Airport**, one of the largest aviation infrastructure projects in the world. Beyond transportation infrastructure, the company is active in projects involving power generation, water infrastructure, ports, industrial facilities, and other complex engineering works. ## Other Business Sectors Through its broader corporate group, Kolin is also involved in several industries outside traditional construction, including: * Energy and power generation * Mining * Port operations * Shipyards and maritime services * Tourism * Trade and commercial activities ## International Presence Kolin Construction maintains an international presence and has undertaken projects across **Europe, Asia, the Middle East, and Africa**. Its international operations have included countries such as: * Azerbaijan * Libya * Uganda * Poland * Romania * Oman * Saudi Arabia * Kuwait The company has established representative offices and project operations in several of these markets to support its international engineering and construction activities. ## Company Scale Kolin Construction is considered one of the prominent Turkish contractors operating internationally. Its annual turnover has been reported in the range of approximately **USD 1.52 billion**, reflecting the scale of its infrastructure, energy, and industrial projects. ## Summary With several decades of experience, Kolin Construction has developed capabilities in managing complex, large-scale infrastructure and engineering projects. Its portfolio covers transportation, energy, industrial construction, and public infrastructure, with operations extending from Turkey to multiple international markets.
Roane Transportation Services September 21, 2026 Roane Transportation Services was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Transportation. Country: United States of America. # ROANE TRANSPORTATION SERVICES, INC. ## Rockwood, Tennessee | DOT# 652055 | roanetrans.com --- ### YOUR COMPANY HAS BEEN COMPROMISED We have obtained complete access to your internal file systems and extracted a full copy of your corporate data. This includes all divisions: **Roane Transportation Services (RTS)**, **Roane Logistics (RLI)**, **Roane Metal Group (RMG)**, **Roane Specialized**, and **B&W**. This is not a bluff. Below is a summary of what we hold. --- ### DATA IN OUR POSSESSION **EMPLOYEE PERSONAL DATA** - 262 employee files containing Social Security Number scans (PDF), driver's licenses (CDL), DOT medical examination cards, drug screening results, I-9 employment verification forms, background check reports (PSP/MVR), tax withholding forms, and direct deposit authorizations - Complete payroll records with full names, bank routing numbers, and account numbers for all current employees across RTS and RLI divisions **FINANCIAL & BANKING** - ACH payment files containing 351 bank account numbers (routing + account) for employees, contractors, and carrier partners - First Horizon Bank online banking credentials - State tax portal login credentials for 20+ US states (TN, KY, GA, OH, PA, VA, NC, IN, AL, MS, LA, MO, WV, NM, NE, OR, SC, IL, NY, AR) - QuickBooks financial data - Payroll ACH batch files with individual salary amounts - Settlement payment records for 112 carrier/vendor relationships - Insurance loss reports spanning 2008 through 2025 - Positive Pay check verification data **CREDENTIALS & ACCESS** - 200+ plaintext username/password combinations exported from employee browsers, covering Microsoft 365, banking portals, fleet management (Samsara, OmniTracs), customer billing portals, insurance providers, government tax systems, and personal accounts - Customer portal credentials for 39 business partners including Nucor, Ryder, Cleveland Cliffs, US Bank, Valmont, SiteOne, Megacorp, Hubbell, CMC, Builders FirstSource, and others - Your Carbon Black security product license information - Acronis backup system license keys - CheckPoint VPN configuration data **DOT / FMCSA COMPLIANCE** - DOT audit files - Drug and alcohol testing results for all drivers - DOT medical examination certificates - FMCSA inspection and violation records - Accident and incident reports spanning multiple years - CSA score documentation **BUSINESS INTELLIGENCE** - 949-entry contact database (drivers, customers, vendors, suppliers) - Customer contracts and rate agreements - IFTA fuel tax reports (all states, 20212025) - Complete fleet and driver assignment records - Internal HR files for current and terminated employees - Workers' compensation claim records --- ### WHAT THIS MEANS FOR YOU If this data becomes public: 1. **Mandatory breach notification in all 50 US states** for SSN and financial data exposure estimated cost: $500,000 $1,000,000 in notification, credit monitoring, and legal fees alone 2. **FMCSA regulatory action** exposure of drug test results and DOT medical records creates grounds for federal compliance investigation. Potential suspension or revocation of operating authority under 49 CFR Part 382 3. **Employee lawsuits** 262 individuals with exposed Social Security Numbers and bank accounts will have grounds for identity theft class action litigation. Average settlement: $5,000 $50,000 per affected person 4. **Customer relationship damage** 39 business partners whose portal credentials were stored in plaintext will be notified. Nucor, Cleveland Cliffs, Ryder, US Bank, and others will terminate carrier agreements and pursue damages 5. **Financial fraud exposure** bank routing numbers, account numbers, and online banking passwords enable direct financial theft. Every employee and carrier partner will need to change bank accounts immediately 6. **Tax fraud liability** login credentials for 20+ state tax portals enable fraudulent filings. State revenue departments will freeze accounts pending investigation 7. **Total estimated exposure: $5,000,000 $15,000,000** in regulatory fines, legal costs, settlements, lost business, and remediation --- ### PROOF OF DATA We will provide a sample data package upon request in this chat to verify authenticity. This may include: - Partial employee SSN document samples (redacted) - ACH file headers showing bank routing information - Portal credential samples - Payroll records with employee names and amounts --- ### OUR TERMS We are prepared to: - Permanently delete all copies of your data - Provide proof of deletion - Never disclose or publish any information - Provide a full list of accessed systems for your security remediation **In exchange, we require a one-time payment. The amount will be discussed in this chat.** --- ### DEADLINE You have **168 hours (7 days)** from the moment this message was posted to initiate contact and begin negotiations. **After the deadline:** - Phase 1: Data samples will be sent directly to your customers (Nucor, Ryder, Cleveland Cliffs, US Bank, SiteOne) - Phase 2: Full dataset published on our public blog - Phase 3: FMCSA, state attorneys general, and IRS notified with supporting evidence **The timer is running.** --- *To begin the conversation, type your message below. All communications are encrypted and confidential. We respond within 2 hours during business days.*
Partners Financial Services, a.s. September 11, 2026 Partners Financial Services, a.s. was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-11. Sector: Financial Services. Country: Czechia. # PARTNERS FINANCIAL SERVICES, a.s. DATA BREACH **Date:** September 2026 **Target:** Partners Financial Services, a.s. (IO: 27699781) **Location:** Prague, Czech Republic **Industry:** Financial Services / Banking / Insurance --- ## WHO IS PARTNERS? Partners Financial Services is the **largest independent financial advisory and brokerage firm in the Czech Republic**. Founded in 2007, the group has grown to include: - **Partners Banka** a fully licensed bank (NB license, launched March 2024) - **Partners investin spolenost** investment fund management (7.2 billion CZK AUM) - **Simplea pojiovna** life insurance company (64,000+ clients) - **Rentea penzijn spolenost** pension fund (2 billion CZK AUM) - **Trigea nemovitostn fond** real estate fund (3.7 billion CZK AUM) - **NextPage Media** Penze.cz, Finmag, Heroine.cz **Revenue:** >3 billion CZK/year (~120M) **Assets Under Management:** ~13 billion CZK (~520M) **Financial Advisors:** 2,000+ **Branches:** 170+ across Czech Republic **Clients:** 300,000+ Ownership: **Petr Borkovec** (CEO, 49%) and **Radim Luke** (co-founder, 36%). --- ## WHAT WAS COMPROMISED ### 1. COMPLETE ACTIVE DIRECTORY FOREST 10 DOMAINS The entire AD forest was extracted including full NTDS.dit: | Domain | Accounts | Entity | |--------|----------|--------| | partners.cz | 888 | HQ Partners Financial Services | | pfs.local | 708 | Core internal domain | | simplea.cz | 132 | Simplea insurance | | simplea.sk | 38 | Simplea Slovakia | | rentea.cz | 36 | Rentea pension fund | | partnersis.cz | 36 | Partners investment company | | nextpagemedia.cz | 4 | NextPage Media | | merity.cz | 3 | Merity fund | | simplea.pl | 1 | Simplea Poland | | penize.cz | 1 | Penze.cz media | **Total: 3,338 AD objects 1,856 users 1,482 computers 156 privileged admins** Golden Ticket material (krbtgt) extracted permanent forest-wide access. Domain Admin hash + AES-256 keys + Kerberos TGT + PKI certificate with private key. ### 2. 1,324,203 CLIENT CALL RECORDINGS (20082021) Thirteen years of recorded phone conversations from the Partners call center: - **1,324,203 WAV files** with **1,323,829 unique caller IDs** - Clients discussing **mortgages, investments, insurance, pensions** - Contains: client voice, phone numbers, full financial details - Period: **2008 to 2021** (~130,000 recordings per year at peak) This is **maximum GDPR-sensitive data** financial conversations of hundreds of thousands of Czech citizens. ### 3. CLIENT DATABASE (SQL) - **ClientHistory** full client financial history (PII) - **Anonymizace** GDPR anonymization pipeline (proves they know this data is sensitive) - Production AlwaysOn Availability Group (Cluster036) full/diff/log backups from August 2026 ### 4. VEEAM BACKUP INFRASTRUCTURE - **15 production server images** (full .vbk backups, restorable) - **7+ NAS repositories** across multiple sites - **VMware vSphere** full admin access (vsphere.pfs.local) - **Azure Cloud Connect** off-site backup credentials - **DELL PowerStorage** storage infrastructure - **Proxmox** secondary hypervisor - Backup period: November 2023 to August 2026 ### 5. COMPLETE IT INFRASTRUCTURE - Microsoft Dynamics CRM (client data) - Dynamics NAV ERP (financial operations) - SharePoint intranet (12 service accounts) - 188 IIS application pools - CheckPoint firewall - Kofax document management - Exchange/M365 email ### 6. CRACKED CREDENTIALS Passwords already cracked from the NTDS dump: ``` qwerqwer 7 accounts (adkofax, OfficeZ, hrsit, DPokorny, vars, vratky, web) September2023 simplea.sk\XVidrova dominik521 pfs.local\DHutecka Neutrogena123 partners.cz\KPtackova J1j2j3j4j5j6 partners.cz\JKonicek Administrator77 partners.cz\NAutratova ``` 3,325 additional hashes pending crack. --- ## DATA VOLUME | Category | Count | |----------|-------| | Call recordings (WAV) | 1,324,203 files | | AD objects | 3,338 | | NTLM hashes | 3,331 | | Kerberos keys | 12,470 | | VM backup files | 108 | | SQL backup files | 398 | | Veeam storage blobs | ~5,600 | | **Estimated total** | **~1.52.5 TB** | --- ## REGULATORY EXPOSURE Partners Financial Services operates under supervision of: - **NB (Czech National Bank)** Partners Banka has a full banking license. This breach directly threatens that license. - **OO (Czech Data Protection Authority)** GDPR breach with 1.3M client call recordings. Fine up to **4% of annual turnover (~5M)**. - **GDPR Article 33** Mandatory 72-hour breach notification to hundreds of thousands of affected clients. - **NBS (Slovakia)** Simplea SK operations. Partners/Borkovec chairs **AFIZ** (Association of Financial Intermediaries and Advisors) the industry body that is supposed to ensure standards. The company already received negative coverage on **ern ovce (T, 2025)** for advisor misconduct. This breach proves systemic security failure. --- ## PROOF Screenshots and sample data available. We can provide: - Any 10 files from the 1.3M+ file tree on request - NTDS dump samples with domain attribution - WAV recordings with caller IDs - Veeam job metadata proving backup infrastructure access - SQL database headers --- ## TIMELINE Partners Financial Services was given the opportunity to resolve this matter privately. Their response determines next steps. --- *Partners Financial Services, a.s. | Trkova 2319/5b, 149 00 Praha 4 | IO: 27699781*
aidon.com September 3, 2026 • [ ransomware, leak, technology ] aidon.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-03. Sector: Technology. Country: Finland. Website: aidon.com. # Aidon Oy / Gridspertise (Enel Group) Smart Meter Operations Platform Breach **Date:** September 2026 **Sector:** Critical Infrastructure Energy / Smart Grid **Country:** Finland **Parent Company:** Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) --- ## Summary The Smart Meter Operations (SMO) platform operated by **Aidon Oy** Finland's leading smart metering company and a subsidiary of **Gridspertise** (Enel Group) has been fully compromised. The platform serves as the central head-end system for dozens of Finnish distribution system operators (DSOs), managing millions of smart electricity meters across the country. Between **April 19 and May 1, 2026**, a total of **9,899 files (8.41 TB)** were extracted from **eight SQL Server instances** within the platform's internal cluster (10.110.4.0/24, legacy domain: empalvelut.dom). This is the largest known breach of smart grid infrastructure in the Nordic region. --- ## By the Numbers | Metric | Value | |--------|-------| | **AES-128 encryption keys** | 520,796 (Unicast / Multicast / Authentication) | | **Citizen PII records** | ~1,500,000 | | **Total data exfiltrated** | 8.41 TB | | **SQL servers compromised** | 8 | | **Databases** | 25+ (~2.4 TB on disk) | | **Full SQL backups (.bak)** | 368 | | **Transaction logs (.trn)** | 9,079 (15-minute intervals continuous chain) | | **Live database files (.mdf/.ldf/.ndf)** | 218 | | **User accounts with credentials** | 74 (SHA-512 + TOTP secrets + 23 API keys) | | **SIM / IMSI records** | 108,000+ | | **GPS coordinates of metering points** | 91,430+ | | **Affected organizations** | 10+ energy utilities | | **Data period** | 19 April 1 May 2026 | --- ## What Was Compromised ### 1. Smart Meter Encryption Keys 520,796 AES-128 keys The **SecurityManager** database contains 520,796 AES-128-CBC encryption keys used to secure communication with smart meters in the field. Three key types are stored per device: - **Unicast** device-specific encrypted communication - **Authentication** meter identity verification - **Multicast** group commands (firmware updates, disconnect/reconnect) Possession of these keys enables: decryption of all mesh network traffic, forging of commands to meters, and remote disconnection of electricity supply across entire regions. This represents an **existential threat to the security claims of Aidon's entire product line** the company manufactures the meters (ADN6534, ADN7534, ADN7442, ADN6490) and operates the head-end. ![AES-128 Keys Sample](04_AES128_KEYS_sample.png) ### 2. Personal Data ~1.5 Million Finnish Citizens Across 11 Meteringware customer data shards, the Vantage platform, and municipal CDAPIDB instances, the following personal data was extracted for approximately 1.5 million individuals: - Full names and home addresses - GPS coordinates of metering points (91,430+ with precision coordinates) - Energy consumption profiles (15-minute intervals) - Customer GUIDs and metering point identifiers - Fuse sizes, meter serial numbers, device configurations This data covers residential and commercial electricity customers across Eastern and Central Finland. ![GPS Map Metering Points](08_GPS_MAP_metering_points.png) ![PII Table with GPS](09_PII_GPS_metering_points.png) ### 3. User Accounts and Authentication Material 74 Accounts The **UserManager** database contains 74 operator accounts across multiple organizations: | Domain | Accounts | |--------|----------| | @aidon.com | 31 | | @enerim.com | 17 | | @ese.fi | 9 | | @pbe.fi | 4 | | @savonvoima.fi | 3 | | @keoy.fi | 2 | | Service/API accounts | 8 | Each account includes: SHA-512 password hash, salt, **TOTP secret** (time-based one-time password seed), creation date, and last login timestamp. Additionally, 23 API keys were extracted from the ApiKey table. The TOTP secrets allow real-time generation of valid two-factor authentication codes for any of these accounts. Notable: the account of **Aidon's CTO** is among the compromised records, with a last login of April 24, 2026. ![UserManager Accounts](06_USERMANAGER_accounts.png) ![Email Domain Distribution](07_EMAIL_DOMAINS_chart.png) ### 4. Telecom Data 108,000+ SIM Records The platform stores cellular connectivity data for every smart meter with a SIM module: - SIM IMSI numbers (89358020...) - ICCID identifiers - Phone numbers (+358...) - Device IP:port endpoints (10.83.x.x:9999) - Mesh network topology (RSSI levels, communication roles) - Communication technology flags (Cellular / Radio) ### 5. DSO Client Databases Per-Utility Isolation Breached Server 10.110.4.216 hosts **six named SQL instances**, each dedicated to a specific distribution system operator: - **PORVOO** Porvoon Energia - **KERAVA** Keravan Energia - **KSOY** Koillis-Savon Yhtit - **CST03, CST04** Municipal DSOs - **TEST** Test environment Each instance contains: CDAPIDB, VisionAir, and VisionAir_History databases. The per-client isolation model means every DSO's operational data was independently compromised. ![DSO Client Instances](10_DSO_CLIENTS_vantage.png) --- ## Infrastructure Overview Eight SQL Server instances were compromised on the 10.110.4.0/24 network: | Server | Role | Key Databases | |--------|------|---------------| | 10.110.4.191 | **Main SQL Server** | AidonReports, Meteringware (11 shards), SecurityManager, UserManager, DataCollector, EventManager, Gateware, Linkware, Middleware | | 10.110.4.216 | Multi-instance (6 DSOs) | CDAPIDB, VisionAir, VisionAir_History per client | | 10.110.4.239 | Vantage Platform | Vantage Data + BR/CR/LP/ME + ReportServer | | 10.110.4.234 | CDAPI + READyManager | READyManagerDB (contains Secrets table), CDAPI_DriverQuartz | | 10.110.4.226 | MSSQL15 | Gateware | | 10.110.4.70 | MSSQL13 | Gateware, meshnet, MitoxAMRReportingDb, RKGateware | | 10.110.4.32 | Gateware | Gateware replica | | 10.110.4.12 | meshnet | Mesh network database | Total: **42 databases**, **5,535 user tables**, **67,888 views**, approximately **2.4 TB** of structured data. ![Server Infrastructure](12_SERVER_INFRASTRUCTURE.png) ![Database Inventory](05_DATABASE_INVENTORY.png) ![File Tree](02_FILE_TREE_servers.png) ![Backup Files](03_BACKUP_FILES_listing.png) --- ## Corporate Structure **Aidon Oy** (Y-tunnus: 1881960-4) is a Finnish smart metering company headquartered in Jyvskyl. Aidon manufactures smart electricity meters and operates head-end platforms (Meteringware, Gateware, Linkware) as managed services for distribution system operators across Finland and the Nordics. In **September 2023**, Aidon acquired the Smart Meter Operations (SMO) business the compromised platform from Enerim Oy. The SMO platform provides automated reading services for smart meters across Finland. In **November 2023**, Aidon was itself acquired by **Gridspertise S.r.l.**, a joint venture between **Enel Group** (Italy, 70B+ revenue) and **CVC Capital Partners**. Gridspertise manages over 100 million smart meters worldwide. The Aidon board includes: - **Marco Zallocco** Chairman (Gridspertise representative) - **Francesca Pizzarello** Board member (Gridspertise/Enel) - **Tommi Blomberg** CEO --- ## Affected Organizations The following energy companies are confirmed clients on the compromised platform, with their customer data present in the extracted databases: | Organization | Type | |-------------|------| | Porvoon Energia | Municipal electricity utility (Porvoo) | | Keravan Energia | Municipal electricity utility (Kerava) | | KSOY (Koillis-Savon Yhtit) | Regional electricity utility | | Etel-Savon Energia (ESE) | Regional electricity utility (Mikkeli) | | Savon Voima | Regional electricity utility | | PBE (Porvoon Energia subsidiary) | Electricity distribution | | KEOY | Electricity distribution | | Voimatel | Energy services | | Joroisten Energialaitos | Municipal utility (Joroinen) | | Helen Oy | Helsinki electricity utility | The Vantage platform alone lists **3,037 customer entries** across dozens of Finnish energy companies, municipalities, and housing associations. --- ## Regulatory Exposure | Regulation | Impact | |-----------|--------| | **GDPR** | ~1.5 million data subjects. Art.33: 72-hour DPA notification. Art.34: mandatory individual notification. Fines up to 4% of global turnover. | | **NIS2 Directive** | Smart metering = critical infrastructure. Mandatory incident reporting to Traficom / NCSC-FI. Fines up to 10M or 2% of turnover. C-level personal liability. | | **Finnish Law** | Shkmarkkinalaki (Electricity Market Act). Tietosuojalaki (Data Protection Act). Fingrid Datahub connection obligations. | Each affected DSO has **independent GDPR notification obligations** once they become aware their customer data was compromised on a third-party platform. This creates a cascade of mandatory regulatory disclosures. **Estimated total exposure: >20,000,000** across GDPR fines, client contract losses, meter key rotation costs, and reputational damage to Gridspertise's global operations. ![Regulatory Impact](13_REGULATORY_IMPACT.png) --- ## Timeline ![Breach Timeline](01_BREACH_TIMELINE.png) | Date | Event | |------|-------| | 19 April 2026 | Initial access to SQL cluster | | 19 Apr 1 May | Continuous exfiltration: 9,899 files, 8.41 TB | | 1 May 2026 | Exfiltration complete | | July 2026 | Initial contact sent to wrong entity (legacy domain confusion) | | 15 August 2026 | Attribution corrected Aidon Oy identified as platform operator | | ~20 August 2026 | CEO and CFO of Aidon contacted directly with proof | | September 2026 | **No response received** | --- ## Proof Samples The following are representative samples only. Full datasets are retained. - **AES-128 encryption keys** masked samples from SecurityManager.KeyInfos (520,796 records) - **User accounts** Aidon, Enerim, and DSO operator accounts with masked credentials - **GPS metering points** addresses and coordinates of 91,430+ installations - **Consumer PII** names, addresses, meter serials, phone numbers (partially masked) - **Backup file listing** 368 full backups + 9,079 transaction logs with timestamps - **Server certificate** MS_AgentSigningCertificate with verifiable GUID - **DSO client instances** per-utility SQL databases (PORVOO, KERAVA, KSOY, CST03, CST04) Data will not be published while a resolution remains possible.
Zito Marketi September 4, 2026 Zito Marketi was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-04. Sector: Retail & E-Commerce. Country: North Macedonia. # The Neighborhood Shop That Conquered a Nations Retail Landscape ## How a single familys modest grocery store in Veles evolved into a 70-strong national network by proving that scale and community trust are not mutually exclusive. In the retail industry, there is a persistent myth that to scale nationally, a brand must inevitably shed its local soul. The prevailing logic dictates that as a chain expands, the neighborhood warmth of its origins is replaced by sterile corporate efficiency, and the familiar faces behind the counter are swapped for standardized kiosks. But in North Macedonia, a retail network that now spans dozens of towns and employs over 850 people is quietly dismantling that assumption. They are proving that the secret to dominating a national market might just be remembering exactly what it feels like to run a single corner store. ## The Story ### A Dream in Veles The year was 1988. The retail landscape of the Balkans was on the precipice of massive change, but in the town of Veles, the Doevski family was focused on a much smaller canvas. They opened a modest neighborhood shopa traditional local grocery. At the time, it was not merely a business adventure; it was the physical manifestation of a family dream. Starting a retail business in any era requires a leap of faith, but doing so with a clear vision for a future that had not yet arrived requires something more. The Doevski family possessed an unwavering belief in their community. They understood early on that a grocery store is not just a place to exchange currency for goods; it is a daily touchpoint in people's lives. By treating every customer not as a transaction, but as a neighbor, they laid a foundation of trust that no amount of corporate marketing could buy. As the years passed, the knowledge gained from those early days behind the counter became their greatest asset. They learned the rhythms of the town, the preferences of the locals, and the exact meaning of relentless dedication to service. This deep, localized understanding allowed them to expand their horizons, opening several more sales facilities throughout Veles. They were no longer just a single shop; they were a local institution. ### The Capital Leap and the Turning Point Growth, however, demands evolution. The quality of their offerings and the fierce loyalty of their buyers eventually pushed the family to take a significant strategic step: opening their first market in Skopje, the capital of North Macedonia. Moving from a regional hometown favorite to the highly competitive, fast-paced capital is where many local brands fracture. The temptation to abandon local principles for mass-market tactics is immense. Yet, the true inflection point in the companys history arrived between 2014 and 2015. This was not a period of gradual, cautious growth, but rather an era of explosive expansion. In a remarkably short window, the brandnow operating as Zito Marketiopened more than 20 supermarkets across the country. To open 20 stores in such a condensed timeframe is a logistical and operational marvel for any company, let alone one rooted in family values. It required a supply chain that could handle massive volume, a hiring apparatus that could onboard hundreds of staff, and a management structure that could maintain quality control across vast distances. They achieved this by leaning heavily into the very principles that built them in Veles. The strategic expansion cemented their presence and fortified their reputation, transforming them from a beloved regional chain into a leading national retail powerhouse. ### The Architecture of Trust Today, the network boasts more than 70 markets spread across 20 towns and municipalities. Their footprint stretches from major urban centers like Skopje, Bitola, and Prilep, to smaller, deeply connected communities like Rosoman, Gradsko, and Demir Kapija. With over 850 dedicated employees, Zito Marketi has transcended the definition of a mere brand to become a symbol of quality and trust across the nation. This scale has not blinded them to the realities of intense market competition. In an era where brands must offer something truly unique to stand out, Zito has resisted the urge to engage in a race to the bottom on gimmicks. Instead, they have doubled down on their foundational pillars: low prices, kindness, and quality. These are not framed as mere business strategies, but as the literal bedrock upon which the company was built. This consumer-centric philosophy is most visible in their "Loyalty Club." Rather than treating loyalty as an afterthought or a complex points-based game, the initiative is designed to offer tangible, immediate benefits and savings to their most dedicated shoppers. It is a direct reflection of their belief that the consumer must be the absolute focal point of every decision. The market has validated this approach. Over the years, the companys efforts have been recognized with numerous accolades, including Best Retail Facility in 2010 and 2017, the Superbrands award for 2015/2016, and the International Best Brand award in 2015. Yet, internally, these trophies are viewed not as finish lines, but as reminders of their continuous pursuit of perfection and a mandate to keep investing in the shopper's experience. ## Why It Matters The stakes in modern retail are existential, particularly in emerging and transitional markets. When massive international conglomerates enter a national landscape, local consumers are often forced into a false dichotomy. They are told they must choose between the low prices and vast selection of global giants, or the community connection, personalized service, and cultural familiarity of local shops. If this problem remains unsolved, the retail landscape becomes entirely homogenized. The cultural anchor of the neighborhood market is lost, replaced by alienating big-box environments where consumers are reduced to mere data points. Local economies suffer as capital flows outward, and the unique commercial identity of a nation is flattened. Zito Marketis trajectory matters because it demonstrates a viable, highly successful third path. They have proven that a company can achieve the economies of scale necessary to offer low prices and wide availability, without sacrificing the kindness and community trust inherent in a neighborhood shop. For the 850 employees across the country, this model provides stable, meaningful employment rooted in a company culture that values human interaction. For the shoppers in towns like Kocani, Vinica, and Gevgelija, it means they do not have to compromise. They can enjoy the convenience and pricing of a national supermarket chain while still feeling the warmth of a local business that knows their name. In a highly competitive market, solving this equation is the difference between merely surviving and truly thriving. ## The Future of the Familiar As the global retail sector braces for further consolidation, the rise of automated checkout, and the increasing dominance of frictionless, algorithm-driven shopping, the human element of commerce is often the first casualty. Efficiency is relentlessly pursued, often at the expense of connection. Yet, the remarkable trajectory of this Macedonian retail family suggests a different, more resilient future. They have shown that scaling up does not require scaling out the human experience. The question moving forward is no longer whether a local, family-rooted brand can survive and conquer a national market against formidable giants. The real question is whether the giants will eventually have to learn how to act like neighbors.
Chicago History Museum September 8, 2026 Chicago History Museum was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Education. Country: United States of America. # CHICAGO HISTORY MUSEUM DATA BREACH ![CHM Logo](logo_color.svg) **Organization:** Chicago History Museum (formerly Chicago Historical Society) **Location:** 1601 N Clark Street, Chicago, IL 60614 **Website:** chicagohistory.org **CEO:** Michael J. Anderson, President & CEO **Industry:** Non-profit / Cultural Institution **Breach Date:** September 2026 **Data Volume:** 4 departments + AWS cloud infrastructure, 15+ years of records **Individuals Affected:** 20,000+ --- ## WHAT HAPPENED Chicago History Museum's internal file server **and** AWS cloud infrastructure have been fully compromised. Sensitive data from four departments and the production cloud environment has been exfiltrated: **From Internal File Server:** - **IT Credentials** AWS root keys, server passwords, BitLocker encryption keys, 20+ vendor portal logins in plaintext - **Accounting & Finance** 15 years of ADP payroll records (20062021), bank reconciliations, audit workpapers, ACH authorization documents - **Human Resources** Employee background checks containing Social Security Numbers, I-9 immigration documents, personal identity verification forms - **Development / Institutional Advancement** Board of Trustees home addresses, major donor pledge records ($4.4M+ in named donations), corporate funder relationships, donor CRM exports **From AWS Cloud (Account 187824323586):** - **Production Database** Full access to Aurora MySQL containing the museum's website, 27,422 form submissions with visitor personal data - **14 EC2 Servers** Complete control of production, staging, and scaling infrastructure - **S3 Backups** 20 GB of website backups (146,000 files) the only cloud backup - **27,422 Public Records** Names, emails, phone numbers, and personal details of museum visitors, event clients, school field trip contacts, donor applicants, interns, and volunteers collected over 7 years --- ## DATA SAMPLES ### IT Credentials Exposed in Plaintext AWS root account access keys, BitLocker disk encryption recovery key, and passwords for Adobe, Microsoft, Blackbaud (donor payment platform), Symantec, and 20+ grant portals including Boeing, ComEd, Exelon, MacArthur Foundation, SAM.gov, and City of Chicago. *See: Screenshots 0105* ### Board of Trustees Home Addresses Full names, home addresses, ZIP codes, and spouse names for 40+ members of the Board of Trustees, including prominent Chicago families residing in Lake Shore Drive, Winnetka, Lake Forest, Hinsdale, and Gold Coast neighborhoods. *See: Screenshot 06* ### Donor Pledge Records Named Amounts Capital Campaign Endowment pledge details totaling $4,460,684 from Board of Trustees members, including individual named amounts ranging from $2,000 to $700,650. Corporate donors include Molex Inc., First Chicago NBD, LaSalle National Bank, Crate & Barrel, and Commonwealth Edison. Notable: Donald Rumsfeld $50,000 pledge documented. *See: Screenshot 07* ### 15 Years of Payroll Data ADP payroll general ledger reports from 2006 through 2021 containing employee compensation details, benefit allocations, and salary breakdowns for all museum staff. *See: Screenshot 08* ### Employee SSN & Background Checks Background check documents for 20+ employees including SSA-89 Social Security verification forms, I-9 immigration employment authorization documents, and personal identification records. Under the Illinois Personal Information Protection Act (PIPA), this constitutes a reportable data breach requiring notification to the Illinois Attorney General and all affected individuals within 45 days. *See: Screenshot 09* ### Complete IT Infrastructure Server inventory (20 servers, VMware ESXi environment), full Cisco network topology (5 switches, 450+ patch panel mappings), VLAN architecture, external IP ranges, and firewall configuration. Multiple Windows Server 2003 systems still operational. *See: Screenshots 1011* ### Banking Records & Prior Fraud 14 years of bank reconciliation files (BMO Harris, Northern Trust), ACH authorization lists, W-9 tax forms, and documentation of a prior ACH fraud incident in April 2015. *See: Screenshot 12* --- ### AWS Cloud Full Infrastructure Control Using the AWS root access keys found on the file server, we accessed the museum's entire cloud environment: - **AWS Account 187824323586** root-level access, no MFA - **Aurora MySQL Production Database** full DBA privileges with GRANT OPTION. Dumped 127 tables from the production site database and 119 tables from the staging database - **27,422 contact form submissions** from 20162023 names, emails, phone numbers, home addresses, and messages from visitors, wedding/corporate event clients, school field trip coordinators, collection donors, internship applicants, and volunteers - **14 EC2 instances** (13 currently running) Master Server, Scaler, Staging, Elastic Beanstalk environments - **6 S3 buckets** 20 GB of website backups, CDN content, and encyclopedia resources - **2 CloudFront distributions** content delivery infrastructure - **30 WordPress admin accounts** with password hashes extracted - **MySQL port 3306 publicly accessible** with no IP restrictions a textbook security failure **This means we have the ability to shut down the museum's website, delete all cloud backups, and wipe the production database at any time. The museum's RDS instance has zero snapshots deletion is permanent.** *See: Screenshots 1617* ### Public & Visitor Data 20,000+ Individuals The production database contained form submissions from 54 different contact forms spanning 7 years: | Form | Records | Data Collected | |------|---------|---------------| | Contact Us | 11,779 | Name, email, message | | Event Inquiries (weddings, corporate) | 4,848 | Name, phone, email, company, event details | | School Field Trip Reservations | 3,887 | School name, teacher name, phone, email, student count | | Collection Donations | 2,263 | Donor name, contact info, item descriptions | | Internship Applications | 458 | Personal details of applicants | | Volunteer Applications | 138 | Personal details | | COVID-19 Submissions | 420 | Personal health-related data | | Other forms | 3,629 | Various PII | | **TOTAL** | **27,422** | | This is not just an employee data breach. **Over 20,000 members of the public** including parents of schoolchildren, wedding couples, corporate event planners, donors, and job applicants will need to be notified under Illinois law. *See: Screenshot 18* --- ## WHAT WE WANT **We have contacted Chicago History Museum management directly.** They have been given a deadline to respond and begin negotiations. **If no response is received by the deadline, the full dataset will be published on this page**, including: - All credentials and access keys (unredacted) - Complete Board of Trustees personal information - All named donor amounts and corporate funder records - Employee SSN and background check documents - Full server/network infrastructure details - Banking records and audit workpapers - **27,422 visitor/public contact records (names, emails, phones)** - **Production database SQL dumps** - **WordPress admin credentials** Additionally, the museum's AWS cloud infrastructure remains under our control. Non-cooperation will result in **permanent destruction of the production website, databases, and all cloud backups.** --- ## COUNTDOWN **Publication deadline: [DATE + 4 DAYS]** The museum's management has been notified. The clock is ticking. --- ## WHY THIS MATTERS Chicago History Museum is a **501(c)(3) non-profit** that relies on public trust, donor confidence, and government grant funding. A public data leak of this scale would: 1. **Trigger mandatory breach notification for 20,000+ individuals** under Illinois PIPA, every employee whose SSN was exposed AND every member of the public whose personal data was in the contact forms must be notified, along with the Illinois Attorney General 2. **Destroy donor trust** named donation amounts are considered strictly confidential in the non-profit sector 3. **Endanger Board members** home addresses of 40+ prominent Chicago families published online 4. **Jeopardize grant funding** Boeing, MacArthur, ComEd, Exelon, Abbott, and other institutional funders have strict data security requirements 5. **Expose the organization to class-action litigation** from 20,000+ affected individuals employees, visitors, donors, schools, and Board members 6. **Generate massive media coverage** Chicago Tribune, Sun-Times, Block Club Chicago, and national arts media. The story writes itself: "Museum that preserves history can't protect its own data" 7. **Destroy the website and all digital operations** we retain the ability to permanently take down chicagohistory.org and all cloud infrastructure Management has a simple choice: respond now, or deal with all of the above.
Promantra, Inc. November 12, 2026 • [ ransomware, technology, healthcare ] Promantra, Inc. was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-11-12. Sector: Technology. Country: United States of America. Website: promantra.us. ProMantra, Inc. is a US-based healthcare IT and business process outsourcing (BPO) company founded in 2003 and headquartered in Somerset, New Jersey. The company specializes in Revenue Cycle Management (RCM), medical billing, medical coding, claims processing, and healthcare administrative services. It serves hospitals, physician groups, medical practices, and other healthcare organizations, primarily in the US, with operational delivery centers in India. Data size: 50 GB Revenue: USD 50M
cey-tech.com November 12, 2026 • [ ransomware, technology, manufacturing ] cey-tech.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-11-12. Sector: Technology. Country: Cyprus. Website: cey-tech.com. Ceytech Makina Sanayi ve Ticaret A.. is a Turkish manufacturer of industrial machinery and equipment, established on A...
Female Daily Network November 5, 2026 • [ ransomware, retail, technology ] Female Daily Network was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-05. Sector: Retail & E-Commerce. Country: Indonesia. digital beauty community and commerce Indonesia | Community member records of an Indonesian beauty platform: full names, email addresses, dates of birth, phone numbers and password hashes for hundreds of thousands of members; 651,641 forum accounts, 4,873,512 forum posts and 195,328 private member messages; 910,397 giveaway participant records from December 2024, and event entrant lists with full home addresses; 10,370 job applicant resumes from 2025 and 2026 with home addresses and phone numbers; 35,458,383 member activity events, 1,203,613 beauty concern profiles and 773,115 product reviews | [NOT PAID EXPOSED] Initially listed anonymously by N0n as "Company #135" on 2026-11-05.
LEO Pharma A/S November 5, 2026 • [ ransomware, healthcare, leak ] LEO Pharma A/S was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-05. Sector: Healthcare. Country: Denmark. pharmaceutical (dermatology and thrombosis) Denmark | A patient companion analytics corpus of 315,150,416 patient records, one row per patient: age, gender, three digit ZIP, prescription counts by channel, payer and plan detail, prescriber links and more than 100 diagnosis and prescription condition indicators per patient; 441,129 rows of transaction level patient support program records with ICD codes, payer and plan names, pharmacy and prescriber identifiers | [NOT PAID EXPOSED] Initially listed anonymously by N0n as "Company #136" on 2026-11-05.
Native Touch Inc. November 5, 2026 • [ ransomware, technology, leak ] Native Touch Inc. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-05. Sector: Other. Country: Canada. mobile advertising and audience data Canada | The consumer audience data assets of a Canadian mobile advertising company: device movement records for Canadian consumers at multibillion record scale, each carrying device advertising identifiers, coordinates and IP addresses; Location ping records with device advertising identifiers, precise coordinates, carriers and IP addresses; Consumer IP geolocation tables at billion row scale mapping IP addresses to cities, postal codes, coordinates and internet providers; Live ad serving logs through October 2026 carrying consumer IP addresses, device advertising identifiers and coordinates; Device intelligence files received from the company's telecom data partner, and partner audience delivery records; The company's platform user directory with staff and client agency accounts, and its platform configuration records | [NOT PAID EXPOSED] Initially listed anonymously by N0n as "Company #137" on 2026-11-05.
Texas Truck Center November 5, 2026 • [ ransomware, retail ] Texas Truck Center was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-05. Sector: Transportation. Country: United States of America. commercial truck dealership United States | Customer relationship database of a commercial truck and equipment dealer: 34,863 named customer contact records with emails, phones and addresses; Customer tax references with social security numbers of named contacts; Sales and inventory records with vehicle identification numbers, stock numbers and prices, plus 112,755 customer and staff messages; A complete document share of 31,995 files with deal paperwork: orders, titles, vehicle history reports, credit card authorizations, credit applications and driver license scans of customers | [NOT PAID EXPOSED] Initially listed anonymously by N0n as "Company #134" on 2026-11-05.

« Back to Start Next »