Keystops
July 29, 2026
•[ ransomware, technology, energy ]
Keystops was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-07-29. Sector: Technology. Country: United States of America. Website: keystops.com. Key Oil Company is the largest distributor of branded motor fuels for Marathon Petroleum Compan
y and also holds contracts with major brands like ExxonMobil and ConocoPhillips. They provide a
wide range of products including lubricants, diesel exhaust fluid, antifreeze, and various fue
l delivery solutions.
We will upload 15gb corporate data soon. Employee and client personal information (NAME, PASSPO
RT, DL, SSN and so on), financials, payment details, contracts and agreements and so on.
Planungsgruppe M+M AG
August 17, 2026
•[ ransomware, leak, technology ]
Planungsgruppe M+M AG was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-08-17. Sector: Professional Services. Country: Germany. Website: dieplanungsgruppe.de. Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Bblingen, Baden-Wrttemberg, with approximately 432 employees across 10 offices (Bblingen, Stuttgart, Mnchen, Nrnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately 52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation.
The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data a total of 268 GB across approximately 124,000 files, covering 2006 to 2026.
Foresee Pharmaceuticals
August 18, 2026
•[ ransomware, healthcare, financial ]
Foresee Pharmaceuticals was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: Taiwan. Website: foreseepharma.com. Foresee Pharmaceuticals Co., Ltd.
https://www.foreseepharma.com
Total leak: 1,2TB
Leak includes: Drug Master File, ASMF, FDA/EMA, R&D, Financial statements, Clinical study reports and other confidential information.
Projects: CAMCEVI, SIF, Casppian, NCE, Aderamastat, Linvemastat, FP-045, FP-016, FP-018, FP-014...
Partners: Accord BioPharma, Intas Pharmaceuticals, Primevera Therapeutics, Accord Healthcare...
Type of information: Confidential
SpearFin Ltd
August 18, 2026
•[ ransomware, finance, leak ]
SpearFin Ltd was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Financial Services. Country: Mauritius. SpearFin Ltd
https://spearfin.net
SpearFin offers a wide range of services including fund administration, corporate services, compliance support, and investor relations.
Assets Under Administration US$10 billion.
The leak occurred on June 26, 2026.
Total leak: 416 GB
Leak included: NDA, Correspondence Client, KYC - Passports, Certificates, Investing documents,
Share Registry and Holders, Anti-Money Laundering (AML) audit, Agreements, Application forms, Bank Statements,
Bank Payrolls, Loans Documents, Certificates of GBC (Global Business Company), Register of Directors and many other financial documents.
Clients: YuMee Seven Six, BAMBOO BAY PRIVATE LIMITED, Asio Global Fund, 3B Capital, Abans Group, Amicorp Capital, Apex Fund Services Ltd, Pangaea Fund Limited,
AL Farah Overseas Limited, Zinnia Group, AMG Services Ltd, NEO SEMI SG PTE. LTD, MIC ELECTRONICS LIMITED, Zenbridge Capital Pvt. Ltd., Zinnia Investment Advisers Pvt Ltd,
Onpoint Ventures Limited, Wilson Group, Blue River, Capital Advisors Private Limited, Zenbridge Capital Pvt Ltd,
Topland Group Holdings, Africa Opportunities Fund, Appollo Fund Limited and many other...
Type of information: Confidential
Full publication coming soon...
grecosteel.com
July 9, 2026
•[ ransomware, manufacturing, financial ]
grecosteel.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-07-09. Sector: Manufacturing. Country: Greece. Website: grecosteel.com. How Greco Steel Products Lost Control of Finances and Payroll PROLOGUE: 19 document categories. A co...
Meridian Logistics Group
August 22, 2026
•[ ransomware, financial ]
Meridian Logistics Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-22. Sector: Transportation. Country: United States of America. Website: meridianlogisticgroup.com. Full network image staged. ERP exports, dispatch DB and payroll archives recovered. Pending final inventory before publication.
Tower Insurance
August 22, 2026
•[ ransomware, financial ]
Tower Insurance was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-08-22. Sector: Financial Services. Country: New Zealand. Website: tower.co.nz. [AI generated] Tower Insurance is a New Zealand-based insurance company offering a range of personal and business insurance products, including home, contents, car, travel, and commercial coverage. Founded in 1869, it operates primarily in New Zealand and the Pacific Islands. Tower is listed on the New Zealand Stock Exchange and is known for its digital-first approach, providing customers with online policy management and claims services.
FactoryFive
August 23, 2026
•[ ransomware, manufacturing, financial ]
FactoryFive was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-08-23. Sector: Manufacturing. Country: United States of America. Website: factoryfive.com. Factory Five Racing Inc kit-car manufacturer (Cobra replicas, GTM, Type 65 Coupe, 33 Hot Rod). 9 Tow Road, Wareham MA 02571-1086. ~90 employees, 158 endpoints. Revenue $5.5-6.5M/yr (credit card processing ~$4.3M, avg ticket $1245).
Exfiltrated data categories (~130GB): correspondence (PST archives), CRM contacts (GoldMine), ERP/pricing, engineering CAD (SolidWorks/Rhino), banking statements, insurance policies, tax documentation, legal contracts/NDAs, database backups. Includes detailed materials on several ongoing lawsuits parties, witnesses, testimonies, and related case files, alongside private correspondence.
Risk zones: PCI DSS (card processing $4.3M/yr), MA 201 CMR 17.00 (Massachusetts personal data protection), GDPR (EU clients), CCPA (California clients), active IRS audit, active MA Sales Tax audit, FTC Safeguards Rule. Reputational: customer warranties, partner contracts (SEMA supplier), licenses, litigation exposure. CEO: David T. Smith.
Criba
August 24, 2026
•[ ransomware, financial, technology ]
Criba was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Technology. Country: Argentina. Website: criba.com.ar. (release includes data on Argentina, Uruguay, and other countries, as well as financial documents and client documentation, including a vast amount of information not intended for public disclosure) CRIBA Empresa Constructora Argentina specializes in providing comprehensive solutions for every stage of construction projects, leveraging over 70 years of experience. The company focuses on quality, efficiency, and safety, ensuring that they can execute even the most ambitious architectural designs. Their portfolio includes a variety of projects such as commercial offices, healthcare facilities, and residential buildings. CRIBA is committed to maintaining a zero-accident policy, prioritizing the safety of their workforce.
The Liberty Group
August 24, 2026
•[ ransomware, retail, financial ]
The Liberty Group was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-24. Country: United States of America. Website: libertygrp.com. About The Liberty Group Companys offerings include local, long distance, and international moving, lab relocation services, and logistics solutions. They cater to a diverse range of clients, providing professional and comprehensive assistance to both residential and commercial customers. Investigators are working to identify the perpetrators and assess the full scope of the damage. A company has suffered a major cyberattack resulting in the theft of approximately 27,000 internal files. The leaked documents include financial records, internal working materials, and personal data of employees. Attackers encrypted the company's systems following the breach, severely disrupting operations
Pump Engineering Company
August 25, 2026
•[ ransomware, manufacturing, leak ]
Pump Engineering Company was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Manufacturing. Country: United States of America. Website: www.pumpengineering.net. About Pump Engineering Company Pump Engineering Company is a full-service distributor and supplier of industrial pumps, parts, and fluid handling systems, serving Southern California since 1946. During the cyberattack, 120,000 files (115 GB) were stolen, including an extensive customer database, insurance documents, confidential financial documents, and a vast number of project drawings.
ERPIS LLC
August 26, 2026
•[ ransomware, technology, financial ]
ERPIS LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-08-26. Sector: Professional Services. Website: ERPIS LLC. [software] ERPIS LLC (doing business as ShipERP) a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers.
The exposed material includes:
Complete product source code all versions (2.05.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog)
Live QuickBooks financial database (705 MB) complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger
Full customer contract register exact pricing for all 88 enterprise customers with $20.6M in deferred revenue
SAP installation media (245 GB) full HANA, S/4HANA, and kernel distributions
Oral and Maxillofacial Surgery
August 26, 2026
•[ ransomware, healthcare, financial ]
Oral and Maxillofacial Surgery was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-26. Sector: Healthcare. Oral and maxillofacial surgeons Dr. Catrambone and Dr. August , Brockton, MA practice a full sc
ope of oral and maxillofacial surgery with expertise ranging from corrective jaw surgery to wis
dom tooth removal.
We will upload 14gb of corporate data soon. Employee personal information (passports, phone con
tacts), client information, financials, patients and so on.
Gill Rock Drill
August 14, 2026
•[ ransomware, manufacturing, financial ]
Gill Rock Drill was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Manufacturing. Website: gillrockdrill.com. Gill Rock Drill Company, Inc., located in Lebanon, PA, is a family-owned manufacturer and distr
ibutor specializing in drilling equipment and tools for the drilling industry. The company offe
rs a range of services including contract drilling, rentals, and technical support, focusing on
building strong customer relationships based on integrity and trust.
We will upload 5gb of corporate data soon. Employee personal information (passports, DLs, w-9 c
omplete forms), client information, financials, payment details, CCs, NDAs and so on.
Rohloff Group
August 27, 2026
•[ ransomware, manufacturing, retail ]
Rohloff Group was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-27. Sector: Manufacturing. Country: South Africa. KFC
Rohloff Group franchise partner
Total leak: 536 GB, 103,196 Files, 30,805 Folders
Data: Employees personal , Loan applications, Employees banking details, ID's,
Bank account statements, Employees ACKNOWLEDGEMENT OF DEBT, RESULT OF THE DISCIPLINARY HEARING,
Financial documentation for royalties, Food Cost Reconciliation and a lot of other documentation.
Data type: Confidential
Full publication coming soon.
Hanwha Renewables
August 28, 2026
•[ ransomware, energy, financial ]
Hanwha Renewables was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-08-28. Sector: Energy & Utilities. Country: South Korea. The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha.
We extracted around 12GB of highly sensitive information relating to the following projects:
- Bonanza Peak (3GB)
- Boulder Solar III (0.7GB)
- Obreron Portfolio (4.8GB)
- Project Sprout (3.7GB)
In the data we found highly sensitive information including:
- PPAs
- Financial models
- Interconnection agreements
- Engineering designs of the assets
- Personal identifiable information
- Sensitive reports, budgets, financial information
Reach out to prevent the leak.
Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. [Size: 11.7 GB | Sector: Energy]
BEPeterson
August 28, 2026
•[ ransomware, manufacturing, technology ]
BEPeterson was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-28. BEPeterson is a full-service metal fabricator specializing in custom solutions for vessels, tan
ks, and heavy-gauge metal parts since 1935. The company serves a diverse range of industries in
cluding defense, medical, energy, and industrial sectors, providing high-quality products throu
gh advanced manufacturing techniques.
We will upload 20gb of corporate data soon. Employee personal information, client information,
projects, financials, NDAs and so on.
Berlin, Germany
August 28, 2026
•[ ransomware, government, technology ]
Berlin, Germany was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-08-28. Country: Germany. Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: GebudeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 20252026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/MLLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQL dumps 20202026, PST archives, leadership private data (IBANs, ID cards, Behrendt's bank card).NDA: 3,226 documentsLegal violation map (GDPR Art. 32/9/33, VSA/StGB upon VS classification confirmation, BSIG/KRITIS) More
wittmann
August 29, 2026
•[ ransomware, manufacturing, financial ]
wittmann was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Manufacturing. Country: Mexico. Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation.NDA files
Uniguacu
August 29, 2026
•[ ransomware, education, financial ]
Uniguacu was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Other. Country: Brazil. Website: uniguacu.com.br. full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! [Size: 151.0 MB | Sector: Education]
