rubbermill.com
August 15, 2026
•[ ransomware, manufacturing, financial ]
rubbermill.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-08-15. Sector: Manufacturing. Country: United States of America. Website: rubbermill.com.
RUBBERMILL, INC. DUMP: BREAKDOWN OF AN OEM MANUFACTURER LEAK
Target: RubberMill, Inc. (North Carolina, USA) contract manufacturer of non-metallic components for appliance, HVAC, automotive, and heavy equipment. Certifications: ISO 9001:2015, WOSB, WBENC. Probable defense contracts (Mil-Spec).
DUMP SIZE: ~296K files / 276K data objects / 340+ GB
146 GB disk image (.mrimg) full copy of the system
AES PASSWORDS.xlsx file + APWDxx libraries credentials
outlook.pst (487 MB) corporate email archive
creditcard.xls payment data
EMPLOYEE CALL LIST + Employee Information Record Form PII
Insurance data
Tax forms containing SSNs
ENGINEERING DATA:
3,000+ CAD files (.dxf, .stp, .dwg) with client part numbers: 7J314, K2A31, K7K11, V1324, etc.
Complete set of 3D models
Client drawings
FINANCIAL DATA:
Sales analysis.mdb (38 MB) complete sales database
commercial terms
customer segmentation
REGULATORY RISKS:
C-TPAT / NAFTA / Certificate of Origin
Conflict Minerals Reporting Template
Supplier Quality Assurance Manual
Probable Mil-Spec specifications
The dump contains a full cross-section of the business: from passwords and SSNs to automotive OEM drawings and military specifications.
Benshaw, Inc.
August 27, 2026
•[ ransomware, manufacturing, financial ]
Benshaw, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-08-27. Sector: Manufacturing. Country: United States of America. Website: Benshaw, Inc.. [manufacturer, research] Benshaw, Inc. (Pittsburgh) and affiliated UTG entities (Unico, Benshaw Canada, AuCom, Excel, Noble Victoria).
~100+ corporate Visa/PCard records with full PAN + SSN + DOB + home address
637 former employees with full SSN/DOB/address on one spreadsheet
88 active employee folders plus multi-year Canada payroll
Global bank account numbers (PNC, BMO, BNZ, St George, Commerzbank, JPM London, BBVA, GNB)
ACH NACHA files with vendor routing/account numbers
UEdit source with hardcoded XOR key 4148865678 and date-based CalcBackDoor()
Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC)
Rug & Home
September 7, 2026
•[ ransomware, retail, financial ]
Rug & Home was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: United States of America. Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customersfull names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scanssigned delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More
CreateASoft
September 8, 2026
•[ ransomware, technology, financial ]
CreateASoft was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Technology. Inc. is a software company. The company provides dynamic process improvement solutions, predict
ive technology, and end-to-end support to a variety of process-based operations dedicated to im
proving operational efficiency and responsiveness.
We will upload corporate data soon. Employee and customer files, contacts and agreements, finan
cials, projects and so on.
Specchem LLC
September 9, 2026
•[ ransomware, manufacturing, financial ]
Specchem LLC was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: United States of America. Website: specchem.com. About Specchem LLC Specchem LLC is a U.S.-based supplier of concrete repair materials, flooring products, and chemical admixtures. The company offers a range of cementitious and epoxy-based systems. Their distribution network covers domestic commercial and industrial contractors. A cyberattack on Specchem LLC resulted in a massive data breach. As a result of the incident, approximately 500 GB of datacontaining roughly 700,000 files, including confidential personal and financial informationwas stolen.
John Engel Team
September 10, 2026
•[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
Navitrans
September 13, 2026
•[ ransomware, leak, manufacturing ]
Navitrans was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-13. Sector: Transportation. Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. [Size: 223.2 MB | Sector: Manufacturing, Transportation]
Cumar Marble & Granite
September 11, 2026
•[ ransomware, manufacturing, financial ]
Cumar Marble & Granite was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-09-11. Sector: Manufacturing. Country: Turkey. Website: www.cumar.com. About Cumar Cumar Marble & Granite is a leading fabricator and supplier of high-quality marble, granite, limestone, and exotic stones in New England, specializing in luxury kitchens, bathrooms, and custom projects. The company caters to designers, architects, developers, and discerning homeowners, offering a wide range of custom stone products including countertops, sinks, and fireplaces. Their extensive inventory features various natural stones from around the world, ensuring elegance and durability in every project. Cumar is recognized for its commitment to quality and craftsmanship, making it the preferred choice for luxury stone solutions. Cumar Marble & Granite, a company specializing in luxury kitchens, bathrooms, and custom projects, has been the target of a massive cyberattack. Hackers stole 489 gigabytes of data from the companys servers, including personal information, technical drawings, and financial documents. This incident raises serious concerns regarding the theft of intellectual property and potential breaches of employee and customer privacy.
Anderson Industries
September 18, 2026
•[ ransomware, manufacturing, financial ]
Anderson Industries was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: anderson-industries.com. Anderson Industries is a cutting-edge engineering and manufacturing company that assists forwar
d-thinking businesses in bringing innovative products to market. They offer a range of products
including agricultural equipment, trailers, and foundry services.
We will upload 9gb of corporate data soon. Employee personal information, client information, l
ots of projects, specifications, orders, financials, NDAs and so on.
FinSoft (Kolibri retail back-office software)
September 22, 2026
•[ ransomware, technology, retail ]
FinSoft (Kolibri retail back-office software) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Retail & E-Commerce. Country: Uzbekistan. Retail software vendor / IT services Uzbekistan | Client databases of 10+ retail chains (keddo, marc, lancaster, comf_rus, ek, cr, bas_at, bas_juk, bas_nov, bas_zar): sales, stock, pricing, financial records; Back-office platform and API service data | One client database publishes per day after the deadline, starting with keddo. Their clients will know exactly whose software failed them. | [ACTIVE: deadline 2026-09-25 01:06 UTC]
DI.C.S.EL. S.R.L.
September 22, 2026
•[ ransomware, manufacturing, financial ]
DI.C.S.EL. S.R.L. was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Manufacturing. Country: Italy. Introduction DI.C.S.EL. S.R.L., founded in 2005, is an Italian company headquartered in Milan a
nd operating throughout Lombardy, specializing in the provision of technical solutions for the
electrical and measurement sectors.
We will upload 9gb of corporate data soon. Employee personal information (drivers licenses, EU
IDs), financials, payment details, projects, NDAs and so on.
TDMI
September 22, 2026
•[ ransomware, manufacturing, leak ]
TDMI was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-22. TDMI has an in-house sample department for outstanding product development and quality testing.
The company stay alert to emerging trends and develop innovative textiles based on constant ma
rket research analyses.
We will upload 33gb of corporate data soon. Detailed employee personal information (SSNs, drive
rs licenses, passports), financials, credit cards, projects, client data, NDAs and so on.
Coe Press Equipment
September 22, 2026
•[ ransomware, manufacturing, financial ]
Coe Press Equipment was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Manufacturing. Country: United States of America. COE Press Equipment designs and manufactures a complete line of premiere coil handling and serv
o roll feed equipment from stand-alone roll feeds, precision straighteners, and reels to comple
te integrated feed systems and cut-to-length lines.
We will upload 25gb of corporate data soon. Detailed employee personal information (SSNs, drive
rs licenses, passports and other HR files), financials, projects, confidential client docs, NDA
s and so on.
Apex Litigation Support
September 23, 2026
•[ ransomware, leak, financial ]
Apex Litigation Support was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Apex Litigation Support is a business that provides comprehensive litigation services to attorn
eys and law firms. Our team of experienced professionals is committed to delivering accurate an
d timely results that exceed our client's expectations.
We will upload 77gb of corporate data soon. Detailed employee and clients personal information
(passports, licenses, names, addresses, phones, emails and so on), personal financials, confide
ntial files, enormous amount of client data, lots of NDAs and so on.
Urban Engineering
September 23, 2026
•[ ransomware, manufacturing, financial ]
Urban Engineering was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Manufacturing. Urban Engineering is a company that specializes in providing engineering services. They focus o
n delivering innovative solutions for various projects. Their intended clients include business
es and organizations seeking professional engineering expertise. The company is headquartered i
n Annandale, Virginia.
We will upload 20gb of corporate data soon. Employee information, projects, lots of financial d
ocuments, contracts and agreements, NDAs and so on.
Abtach Ltd.
September 23, 2026
•[ ransomware, technology, financial ]
Abtach Ltd. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-23. Abtach Ltd. was renamed Intersys Ltd.a Pakistani company engaged in fraud targeting the US. The companys employees charged fees for services that did not actually exist.
The companys founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace.
We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain evidence of Azneem Bilwanis illegal activities.
Will be published soon... | Severity: HIGH | Size: 1.5 TB | Status: selling | $100,000
Wallatec
September 24, 2026
•[ ransomware, manufacturing, financial ]
Wallatec was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Wallatec creates high-performance carbonation systems for restaurants and busy kitchens. Their
equipment is built to handle intense daily use, working perfectly even in the most hectic envir
onments.
We will upload 15gb of corporate data soon. Employee information (passports), projects, financi
als, client information and so on.
Knit
September 28, 2026
•[ ransomware, technology, financial ]
Knit was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. One of our essential beliefs is that architecture changes lives. This belief guides our path ev
ery day. We seek clients and relationships who are equally interested in improving their city,
their business, their school, their neighborhood or the place they call home.
We will upload 175gb of corporate data soon. Employee information (passports, DLs, credit cards
), projects, financials, client information, NDAs and so on.
Geebee Garments
September 28, 2026
•[ ransomware, retail, manufacturing ]
Geebee Garments was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Retail & E-Commerce. Geebee Garments is a renowned apparel manufacturer with over 130 years of experience, operating
facilities in the UAE and Bangladesh. The company specializes in a wide range of products, inc
luding casual wear, formal wear, and workwear, catering to leading brands globally.
We will upload 100gb of corporate data soon. Employee information (passports, SSN), financials,
client information, NDAs and so on.
Amazon Informatica
September 28, 2026
•[ ransomware, technology, government ]
Amazon Informatica was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. Country: Brazil. Amazon Informtica LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995.
Amazon Informtica's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Braslia/DF (to service the federal government cluster) and Belm/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions.
Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information!
Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data.
TOX ID: 3D6EF83C3C4517FE42B212A934D4B08579A5F20522828C4E4818EA117F53063377C4D769640B
SESSION: 052a5fe97f7b1822c2225ba884b5f719c07ec99da7d838421a20958938f54cb539 [Sector: Government, Technology]
