Source Energy Services
November 5, 2026
•[ ransomware, energy, financial ]
Source Energy Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-11-05. Sector: Energy & Utilities. Country: Canada. Source Energy Services is a leading provider of oilfield logistics, specializing in efficient s
upply chain solutions for the energy sector. The company offers a comprehensive range of servic
es including proppant supply, last-mile logistics, and well site sand storage, tailored to meet
the evolving needs of its clients.
We will upload 93gb of corporate data soon. Detailed employee personal information (passport, D
Ls, SSNs and so on), contracts and agreements, lots of financial papers, projects, NDAs and so
on.
Hudson & Hudson SignProducts
November 6, 2026
•[ ransomware, manufacturing, financial ]
Hudson & Hudson SignProducts was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-11-06. Sector: Manufacturing. Country: United States of America. Hudson & Hudson is a second generation sign company, located in the heart of Houston. From its
humble beginnings, in the back of a garage near downtown Houston, it has grown to one of the
premier sign manufacturing facilities in the US.
Here is the access to 14gb of corporate data. Employee information, contracts and agreements,
client information, financials, drawings and so on.
Click the download button.
You will find several password-free archives. Click on any of them to start the download.
Houston Machine and Thread
November 6, 2026
•[ ransomware, manufacturing, financial ]
Houston Machine and Thread was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-11-06. Sector: Manufacturing. Country: United States of America. Houston Machine and Thread was founded by industry veterans in 2024 to bring a simplified, high
quality experience to the procurement and manufacturing of studs, tap ends, and machined parts
.
We will upload 10gb of corporate data soon. Employee personal information (passport, DLs, SSNs,
I9 complete forms and so on), contracts and agreements, financial, confidential agreement, ND
As and so on.
Ligne Roset
November 6, 2026
•[ ransomware, retail, financial ]
Ligne Roset was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-11-06. Sector: Retail & E-Commerce. Country: France. Since 1973, Ligne Roset has stood by these intrinsic values and has worked with only the most e
xciting and talented designers.
We will upload 150gb of corporate data soon. Employee personal information (passport, DLs), con
tracts and agreements, financial, confidential files, NDAs and so on.
metalloidcorp.com
October 16, 2026
•[ ransomware, manufacturing, financial ]
metalloidcorp.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Manufacturing. Country: United States of America. Website: metalloidcorp.com. On April 7, 2025, the IRS issued Metalloid a final demand, LT11: $3,567.31 on a 2022 civil penalty, with a threat of property seizure and a federal tax lien. The same day, in a separate letter, the IRS revoked the company's Form 637 excise registration "AL" (No. 2013-002535-AL) for a "failure to maintain a satisfactory payment, deposit and/or filing history for all federal taxes." In its 2024 return the company claimed an overpayment of $271,980 the IRS computed $256,688, assessed $4,695.60 in penalties and $5,051.01 in interest. In 2019, the insurer paid $110,000 on a claim from the Sycam
lakelawnresort.com
October 6, 2026
•[ ransomware, financial ]
lakelawnresort.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Hospitality. Country: United States of America. Website: lakelawnresort.com. The group's consolidated financials: equity of $6,146,251.02 as of 07/31/2026; the parent Delavan Lake Lawn, LLC shows equity of $23,923,085.29 with negative total assets ($747,067.98) balance sheets that fail to balance by millions of dollars (a $3,705,652.64 discrepancy in January 2024). The management company DLLM extracts ~$1.9 million a year from its loss-making owner: December 2023 DLLM +$543,231 while the owner lost $1,283,995; December 2024 +$993,562 against $1,454,773. Dave Sekeres, CEO of the management company, sits on the condominium association's board and votes to rai
SILIKO d.o.o.
November 4, 2026
•[ ransomware, manufacturing, financial ]
SILIKO d.o.o. was listed as a victim on the leak site of the Aoqin ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: Slovenia. Siliko d.o.o. is a development supplier and manufacturer of technical products made of elastomers and thermoplastics with over 30 years of tradition. During this period, production program expanded substantially and nowadays includes activities which offer customers a comprehensive range of services from draft design and construction to tool making and mass production. 70 percent of our production is being exported to the European Union markets, predominantly to buyers from the German automotive industry. At the same time, we are an important supplier for the household appliances industry on the European market, also cooperating with partners in the electrical, sanitation and construction industries. With state-of-the-art technology, knowledge and experience, we strive to offer the best products and to go beyond our customers expectations. Status: Not paid. Data publication: 2026-11-09 14:00 UTC. Revenue: $61.6M. Employees: 130. Data type: banking, clientsData, confidential.
Food Bank of Central Louisiana
November 4, 2026
•[ ransomware, leak, financial ]
Food Bank of Central Louisiana was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Agriculture and Food Production. Country: United States of America. Website: www.fbcenla.org. About Food Bank of Central Louisiana\ The Food Bank of Central Louisiana is a nonprofit organization dedicated to alleviating hunger in Central Louisiana through collaboration and food distribution programs. They provide assistance to over 42,500 households annually, offering resources such as SNAP applications and mobile pantry services. Their initiatives include programs aimed at strengthening children and nourishing seniors, addressing the specific needs of vulnerable populations. The organization encourages community involvement through donations and volunteer opportunities to support their mission. The Central Louisiana Food Bank was the victim of a cyberattack, resulting in the theft of more than 130 GB of confidential data. The stolen data includes documents such as banking and financial information, personal data of employees and clients, databases, and other important company information.
Unilever
November 4, 2026
•[ ransomware, manufacturing, leak ]
Unilever was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Unilever is a British multinational consumer goods company headquartered in London. It owns over 400 brands, including Dove, Knorr, Hellmann's, and Rexona, spanning beauty, personal care, home care, and foods, serving consumers in around 190 countries worldwide.
We hold 665K contacts, 5.5K OTM accounts with roles and logins, 14M locations, 3.8M shipments, 229M status records, 13.8K invoices, plus 838K distributor loyalty profiles and ledgers. 79 gigabytes, 1.8 million files, three regions.
Unilever7.z is about 79GB decompressed.
Our ransom demand is only $15,000,000 in BTC
Emails with instructions will be sent to you shortly, if you have failed to receive them,
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Undisclosed AT&T customers
May 1, 2018
•[ insider, financial, technology ]
An AT&T store worker in Portland, Oregon used his access to AT&T systems from May 2018 to Nov 2019 to SIM-swap customers' numbers to co-conspirators' devices, letting them intercept login codes and access bank accounts (~$600,000 intended losses). He got 16 months in prison.
Undisclosed French business-software hosting company (Software; pseudonym)
June 24, 2021
•[ ransomware, financial, technology ]
During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
Undisclosed companies
September 1, 2021
•[ phishing, financial, technology ]
Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
Syrian National Army Military Police Investigation Section, Suluk
May 10, 2023
•[ leak, malware, government ]
A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
Excelsior Orthopaedics
January 7, 2025
•[ ransomware, healthcare, financial ]
Excelsior Orthopaedics suffered a ransomware attack attributed to the Monti threat group, which disrupted operations across all seven of its facilities in Western New York. The attackers exfiltrated approximately 300GB of sensitive data, including medical and financial records, and rendered core systems nonfunctional for several weeks, forcing staff to rely on manual processes during recocery
Optima Tax Relief
May 1, 2025
•[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
Upper Township
October 5, 2025
•[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
Upbit
November 27, 2025
•[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
