Full List

Search

Search Results (Financial)

• Antah HealthCare Group October 26, 2026 • [ ransomware, healthcare, leak ] Antah HealthCare Group was listed as a victim on the leak site of the crypto24 ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Healthcare. Country: Malaysia. Website: ahcg.com.my. Antah Healthcare Group (AHCG) is one of Malaysia's leading integrated healthcare distribution and commercial partners, specializing in the nationwide marketing, sales, clinical regulatory support, and supply chain logistics of pharmaceuticals, medical equipment, and consumable products to hospitals and clinics.We successfully infiltrated AHCG's network and exfiltrated over 500 GB of highly sensitive data, including human resources and employee records, customer transaction histories, confidential commercial contracts, clinical and regulatory documentation, logistics tracking information, and financial statements.
• acclaimcompanies.com September 8, 2026 • [ ransomware, leak, financial ] acclaimcompanies.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Professional Services. Country: United States of America. Website: acclaimcompanies.com. The Social Security Numbers of both group executives Gerald C. Johnson Jr. and Mark C. Johnson are fully exposed in corporate documents (IRS Form SS-4). The Johnson Family Trust holds an investment portfolio of $1.67 million at First Republic Bank against a margin loan of $280K, while parent company Acclaim Asset Management simultaneously received two different EINs from the IRS per CP212 notice (January 2025). Baboo Properties LLC, in which Mark C. Johnson is a member, failed to file the required Form 940 for 2015, despite receiving IRS notice CP080. A corporate network of 15+ legal ent
• Cascade Flooring America October 21, 2026 • [ ransomware, retail, leak ] Cascade Flooring America was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Retail & E-Commerce. Country: United States of America. Cascade Flooring America is a flooring store located in Vancouver, WA, offering a wide range of products including flooring, furniture, window coverings, and kitchen and bath services. The c ompany caters to homeowners looking for premium flooring solutions, with options such as carpet , hardwood, luxury vinyl, laminate, and tile. We will upload 50gb of corporate data soon. Employee personal information (passports and other personal information), client information, financials, confidential files, NDA, and so on.
• Gamdom October 26, 2026 • [ ransomware, financial, technology ] Gamdom was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million. We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion. The way in was something internal, a machine account that was already sitting in their admin side (Metawin). Issued years back, nobody ever rotated it. Never meant to leave the building. It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores. About your provably fair: what it promised and what it delivered were never the same thing. We demand $15,000,000 in BTC. Emails with instructions will be sent to you directly. To verify, a sample can be found below.
• EWM Group October 28, 2026 • [ ransomware, retail, financial ] EWM Group was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: EWM Group. [fashion] EWM Group the parent group behind Bonmarch, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 20002026. ~21,000 employee records salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details. 100+ GB of Outlook PST email archives complete email histories for named staff members spanning years of business operations. 313+ SQL Server database backups across 122 unique databases the entire digital brain of the retail operation. 83 GB of e-commerce transaction data every online order from January 2021 to August 2026.
• Cipsa Industrias Sa De Cv October 30, 2026 • [ ransomware, manufacturing, financial ] Cipsa Industrias Sa De Cv was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: Mexico. Cipsa Industrias Sa De Cv Compania Industrial Papelera Poblana, S.A. de C.V. (CIPPSA) and Tubos y Empaques de Puebla, S.A. de C.V. (TEPSA / KJAS TEPSA), a Mexican corrugated cardboard, packaging and paper-tube manufacturer. Complete employee HR records: names, dates of birth, home addresses, phone numbers, personal and corporate email addresses, CURP, RFC, IMSS numbers, salaries and employee badge photographs.Payroll records, tax data, fiscal validation files and HSBC payroll-bank files containing employee account and CLABE data.Information showing executive compensation through an **honorarios** arrangement outside the regular payroll system.Financial and industrial reports, sales/procurement/payroll budgets, production costs, operational analytics, invoices and accounting records.Customer complaint records and overdue receivables data.Occupational-safety, psychosocial-risk, industrial-incident and hazardous-waste documentation. More
• SK Capital Partners October 28, 2026 • [ ransomware, financial, manufacturing ] SK Capital Partners was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. Country: United States of America. Website: skcapitalpartners.com. skcapitalpartners.com Revenue $63 Million SK Capital Partners is a New York-based private equity firm founded in 2007 as a spinoff from Apax Partners, managing approximately 10 billion dollars across 60 plus investments in specialty chemicals, pharmaceuticals and ingredients. Led by co-founder Barry Siadat, it targets control investments in companies with 100 million to 1 billion dollars in revenue and has built platforms like Advansix, Sartomer and Cura Particles through buy-and-build strategies. Its portfolio companies employ over 12,000 people and generate more than 5 billion dollars in annual revenue. Recent deals include the July 2026 acquisition of Lorama Group and the October 2026 purchase of Vesuvius Americas refractory assets. Key strengths are deep sector expertise in real-economy industrial businesses and proven IPO and trade sale exits.
• grifosespinoza.com October 31, 2026 • [ ransomware, retail, financial ] grifosespinoza.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Peru. Website: grifosespinoza.com. Headquartered in Lima, the company manages fuel stations that serve individual motorists, commercial customers and other transportation-related businesses. Its core
• Hudson & Hudson Sign Products October 30, 2026 • [ ransomware, manufacturing, financial ] Hudson & Hudson Sign Products was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Hudson & Hudson is a second generation sign company, located in the heart of Houston. From its humble beginnings, in the back of a garage near downtown Houston, it has grown to one of the pr emier sign manufacturing facilities in the US. We will upload 14gb of corporate data soon. Employee information, contracts and agreements, cli ent information, financials, drawings and so on.
• Digital Triumph October 31, 2026 • [ ransomware, leak, technology ] Digital Triumph was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Technology. Country: Malaysia. telecommunications services Malaysia | Employee payroll records with names, national identity numbers and wages, statutory filings 2016 to 2025; Audited financial statements, tax filings and company bank account numbers; 2,552 customer invoices and delivery orders; The full customer service data room covering 309 organizations including banks, an embassy and government offices; The CRM customer database and the company mail archive, 8,700+ verified business emails with customer correspondence | [NOT PAID EXPOSED]
• Phoenix Charter Academy October 31, 2026 • [ ransomware, education, financial ] Phoenix Charter Academy was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: United States of America. Website: phoenixcharteracademy.org. Phoenix Charter Academy Phoenix Charter Academy Network is a public charter school network in Massachusetts, USA, operating three campuses (Chelsea, Lawrence, Springfield) and serving mainly low-income and immigrant families.36,829 files, 445.1 GB of data.Domain controller (password hashes of ~170+ staff accounts)File server, helpdesk server, print serverPowerSchool test server the student databaseStudent special-education records of named minors: signed IEP/504 plans for the 20252026 school year, BASC-3 psychological protocols, three-year re-evaluations, speech-therapy files, discipline recordsImmigration records of students' families: official CBP I-94 entry records, parole application statements, immigration cover lettersStaff personal and financial data: W-2 forms with SSNs and salaries, US passport card and foreign passport scans, bank statements with account numbers (Bank of America / Tremont Credit Union), signed direct deposit authorizations, CORI background-check filesMedical data: MassHealth cards and applications, immunization recordsMunicipal compliance files: Lawrence Board of Health licenses and inspections (20222024), Fire Department inspection certificatesInternal HR material: network-wide salary bands More
• CP Manufacturing, Inc. October 30, 2026 • [ ransomware, manufacturing, financial ] CP Manufacturing, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Website: CP Manufacturing, Inc.. [manufacturer] CP Manufacturing, Inc. a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems) operating since the 1970s under the CP Group / CPG Sorting Technologies brand, with subsidiaries MSS Inc. (Nashville, TN), IMS Electronics Recycling, IMS Logistics, IMS Recycling Services, Material Sales, HMM, and UK partner Recycleye. The dataset includes complete server mirrors from HR, finance, engineering, legal, operations, and sales infrastructure, capturing the company's entire digital footprint: Sage/Epicor ERP accounting system for 8 entities (CPM, MSS, HMM, IMSR, IMSRE, MSIRE, CPGH, CP Global) with consolidated P&L showing $109.1M revenue, $10.2M net income, and $12.1M EBITDA for FY2024, plus multi-year budgets (20212024), daily cash reports, and AR/AP data ~340 Social Security Numbers with full identity packages (name, DOB, health coverage status, premium amounts, tax withholdings) across 4 entities via ACA 1095-C filings (20162022), biweekly payroll registers, 401(k) participant records, 10-year salary histories (20132023), and benefits administration across 5 carriers (Anthem, Blue Shield, SIMNSA, UNUM, Western Dental) Truist bank account details routing number 053101121 and account number 1180009812409 for CP Manufacturing LLC, plus ACH payment batch files spanning August 2025 through August 2026 277+ GB of proprietary engineering IP 22G of AutoCAD Electrical MRF designs with proprietary component catalogs (1.2G), 195G of Artec 3D scanner data for manufactured equipment, 38G of CNC laser fabrication data (Amada LCG3015 AJ / FabriWin), PCB board designs (5 boards), SolidWorks Electrical templates, and Epicor ERP Bill of Materials with proprietary part numbers 60+ customer contracts and 30+ NDAs with Republic Services, Waste Management, Recycleye/Nestl, Cal-Waste, Balcones, Wasatch, and international partners, plus Declaration Partners acquisition due diligence documents, competitor proposals (BHS, Machinex, MISTRAL), and a complete project green list Privileged legal materials active litigation subpoena (Hans Ouellet), Coastal Resources MWS settlement agreement with UCC1 financing statements, separation/termination documents for named employees, restrictive covenant cease-and-desist letters, PIIAAs (invention assignment agreements), wage garnishment orders, and corporate equity documents 200+ named job applicant resumes, 51 employee headshot photographs, 400+ vendor records with Tax IDs (including 3+ individual contractors with potential SSNs), and a 7.8G Microsoft SQL Server backup (IMSROM) of undetermined contents
• wagyu.xyz unfairness October 28, 2026 • [ ransomware, financial, technology ] wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence: 1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json). 2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json). Evidence to support this can be found below:
• Noelker and Hull October 28, 2026 • [ ransomware, financial, healthcare ] Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
• Algra Group August 14, 2026 • [ ransomware, technology, manufacturing ] Algra Group was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Other. Country: Switzerland. Website: algragroup.ch. Algra Group specializes in customized input systems, front panels, and industrial labels, provi ding tailored solutions for various industries. Their product range includes agnostic touch sys tems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation, wellness, medical technology, and transportation. We will upload corporate data soon. Employee personal information (passport numbers, DLs), clie nts and partners information, contacts and agreements, financials, NDAs.
• ScrubaDub Auto Wash Centers September 2, 2026 • [ ransomware, retail, financial ] ScrubaDub Auto Wash Centers was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Retail & E-Commerce. Country: United States of America. ScrubaDub Car Wash is New England's leading auto wash, offering customizable tunnel and touchle ss washes, interior cleaning, and detailing services across over 20 locations in Massachusetts, New Hampshire, Maine, and Rhode Island. We will upload corporate data soon. Employee personal information (passport numbers, DLs of 22 employees, contact information), clients information (addresses, contacts and so on), company f inancials, payment details.
• Flex1 September 1, 2026 • [ ransomware, technology, financial ] Flex1 was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-01. Flex1 is an innovative provider of desktop-as-a-service solutions that enables businesses to cr eate secure and cost-effective digital workspaces. Their platform combines cloud architecture w ith productivity tools and managed support services to ensure employees can work efficiently fr om any device, at any time. We will upload 402gb of corporate data and their client soon. Employee personal information, cl ients information (lawyers clients (passports, DLs, SSNs and so on), pet's clinic, etc), financ ials and so on.
• Marlborough Partners September 2, 2026 • [ ransomware, financial ] Marlborough Partners was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Major data breach at a capital solutions advisory firm.
• neolife.com August 18, 2026 • [ ransomware, healthcare, financial ] neolife.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: United States of America. Website: neolife.com. COMPLETE DATA BREACH Golden Neo Life: Mexican MLM Network with Legal Problems, Financial Collapse an...
• Worrell August 21, 2026 • [ ransomware, retail, financial ] Worrell was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-21. Website: worrellcorp.com. Worrell Corporation is a family-owned business based in Indianapolis that specializes in promot ional products, marketing, and print services. They assist clients in finding impactful promoti onal items while offering tailored marketing strategies and webstore solutions. We will upload 45gb of corporate data soon. Employee and client information, contacts and agree ments, financials, projects and so on.