Undisclosed organization investigated by CyberMaxx (Event B)
September 15, 2026
•[ ransomware, financial, technology ]
In a second distinct incident-response case, CyberMaxx observed attackers abuse N-able N-central to execute commands on a domain controller, change an administrator password and establish an interactive session using the altered credentials. They installed SimpleHelp, moved to another server through RDP and staged additional tools. No completed exfiltration or ransomware encryption was confirmed. CyberMaxx linked the operation to Storm-1175 with high confidence; Criminal and Financial are supported by the ransomware-preparation context. September 15 is a report-date fallback, not the known attack date.
Undisclosed Singapore company
September 17, 2026
•[ ransomware, financial ]
Singapore Police described a ransomware attack on an unnamed business whose systems were reportedly breached and years of data became unavailable. The attacker demanded a million-dollar ransom to restore the data; the currency was not specified. The owner sent staff away, disconnected servers and contacted police. The business sector, intrusion method, disruption duration and recovery outcome were not disclosed. Complete system encryption, permanent data destruction and data exfiltration were not confirmed. The incident date and year are unknown; September 17, 2026 is the publication-date fallback, not a verified occurrence date.
Burnaby School District 41
September 21, 2026
•[ ransomware, education, financial ]
The district discovered ransomware on September 21, 2026 and later confirmed theft of personal-information files. Network and phone services were affected. September 21 is a discovery proxy; initial access and extraction dates are unknown. The official page was first published September 23 and updated October 14. Neither encryption nor the stolen-data source host was specified, so technical subtypes remain undetermined. Financial motive is inferred from ransomware.
Photopea
September 24, 2026
•[ ddos, financial, technology ]
Photopea experienced service failures beginning the evening of September 24, 2026 and confirmed suspected traffic flooding. Its developer published an extortion email demanding US$10,000 in bitcoin. The sender used the alias Lumen Cyber, but responsibility was not independently verified. Criminal and Financial are supported by the extortion demand. Some users regained access while others still reported failures. No intrusion or data theft was established.
Duelbits
September 24, 2026
•[ financial, hack, technology ]
Curaao-registered crypto casino Duelbits confirmed on Sept. 24, 2026 that attackers drained about $7M from its hot wallets on Ethereum, BNB Chain, Tron and Bitcoin, likely via a compromised private key. The site went offline; the company said user funds were safe.
The Official College of Architects of León (COAL)
October 2, 2026
•[ ransomware, financial, leak ]
The Official College of Architects of Len (COAL) was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Professional Services. Country: Mexico. The Official College of Architects of Len (COAL) was established on July 12, 1931, encompassin
g the regions of Len, Asturias, and Galicia. The College of Galicia was legally separated in 1
973 and the College of Asturias in 1981.
We will upload 77gb of corporate data soon. Detailed personal information (passports), financia
ls, students and clients information and so on.
PANCARIBBEAN LOGISTICS GROUP
October 5, 2026
•[ ransomware, financial ]
PANCARIBBEAN LOGISTICS GROUP was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: Trinidad & Tobago. Panamanian logistics company operating
in the field of international cargo transportation.
Financial documents, personal and customer data. [Sector: Transportation]
Jampac Alimentos
August 18, 2026
•[ ransomware, retail, financial ]
Jampac Alimentos was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Agriculture and Food Production. Country: Brazil. Website: jampac.com.br. Jampac Alimentos is a leading producer and distributor of food products in Brazil, with over 20
years of experience and a commitment to quality and efficiency. The company serves more than 6
,500 clients, including restaurants, supermarkets, and industrial kitchens, delivering a wide r
ange of products such as poultry, beef, pork, dairy, and fish.
We will upload 35gb of corporate data soon. Personal information (passports, payment informatio
n and other information), financials, clients information and so on.
Wesmar
October 1, 2026
•[ ransomware, manufacturing, technology ]
Wesmar was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. Country: United States of America. WESMAR specializes in advanced marine technology, offering a range of products including thrust
ers, propulsion systems, and commercial fishing sonar. Their innovative solutions cater to vari
ous clients, from cruise boats and luxury yachts to commercial fishing operations, ensuring enh
anced stability, comfort, and efficiency at sea.
We will upload 66gb of corporate data soon. Employee personal documents (passports, DLs, death
certs), financials, lots of projects, credit cards, payment details, client information, NDAs a
nd so on.
Pacific Tank Lines
September 26, 2026
•[ ransomware, financial ]
Pacific Tank Lines was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-26. Sector: Transportation. Country: United States of America. Website: pacifictanklines.com. Pacific Tank Lines, Inc. is a premier full-service petroleum carrier focused on safety and cust
omer service. They offer reliable petroleum cargo services with a professional team of drivers
and efficient dispatchers. The company operates a modern fleet aimed at reducing their carbon f
ootprint and has received multiple awards for their service excellence.
We will upload 13gb of corporate data soon. Detailed personal information of 118 employees (pas
sports, DLs, addresses, phones, payment details and so on), financials, clients and so on.
The Official Collegeof Architects of León (COAL)
October 3, 2026
•[ ransomware, leak, financial ]
The Official Collegeof Architects of Len (COAL) was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-03. Sector: Professional Services. Country: Mexico. The Official College of Architects of Len (COAL) was established on July 12, 1931, encompassi
ng the regions of Len, Asturias, and Galicia. The College of Galicia was legally separated in
1973 and the College of Asturias in 1981.
Here is the access to 77gb of corporate data. Detailed personal information (passports), finan
cials, students and clients information and so on.
Click the download button.
You will find several password-free archives. Click on any of them to start the download.
Philander Smith University
October 6, 2026
•[ ransomware, education, financial ]
Philander Smith University was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: United States of America. Website: philander.edu. Revenue: $25.3 million annual
Philander Smith University is a private, historically Black liberal arts institution in Little Rock, Arkansas, founded in 1877 and affiliated with the United Methodist Church. They provide undergraduate and graduate education with a focus on academic excellence, social justice, and leadership development for a diverse student body. We successfully exfiltrated 500GB+ worth of data which includes VERY confidential information about students and staff, as well as financial information. Alongside, we have encrypted files across the entire network.
Shalom Christian Academy
October 9, 2026
•[ ransomware, education, leak ]
Shalom Christian Academy was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Education. Country: United States of America. Website: shalomca.com. As a school, Shalom Christian Academy is legally and ethically obligated to maintain a wide range of confidential information. However, they are grossly negligent in protecting their own security and that of their students and staff. Consequently, we provide you with student grades, disciplinary and special education records, health and immunization records, financial aid and tuition information, donation history, employee background checks, salary data, and internal security documents. This leak into the public domain constitutes an unacceptable betrayal that can lead to identity theft, financial fraud, extortion, harassment, and devastating harm to children and families. The school is culpable for this act and must be held accountable to the fullest extent of the law.
Polaris Shipping (dry bulk shipping)
October 12, 2026
•[ ransomware, financial ]
Polaris Shipping (dry bulk shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: South Korea. Dry bulk shipping South Korea | Internal financial records (sales vouchers) and vessel operational reports | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Engineers Contractors Fabricators Inc. (ECF)
October 12, 2026
•[ ransomware, manufacturing, financial ]
Engineers Contractors Fabricators Inc. (ECF) was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Manufacturing. Country: United States of America. Website: https:ecfinc.net. ECF, Inc., a piping and insulation contractor specializing in the design and construction of terminals for the transshipment of liquid hydrocarbons such as asphalt, crude oil, and renewable fuels, has completely failed to ensure the security of its systems and is unwilling to compromise. Therefore, we are providing you with access to confidential information (proprietary pipeline designs, CAD drawings, customer lists, pricing models, financial data, employee information, and trade secrets), which violates the Complaints and Abuse Act (CFAA) and state civil liability laws and may result in injunctions, damages, fines, mandatory notices, class actions, loss of competitive advantage, and possibly termination of operations.
huntcompanies.com
October 11, 2026
•[ ransomware, financial ]
huntcompanies.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-11. Country: United States of America. Website: huntcompanies.com. [AI generated] N/A
I don't have verified, reliable information about a specific company at "huntcompanies.com" to describe accurately. Providing fabricated details about a company's operations, industry, or location would risk spreading misinformation in a threat intelligence context, where factual accuracy is critical. If you can share additional context or verified source material about this company, I can help analyze or summarize that information instead.
Ocean Network Express (container shipping)
October 12, 2026
•[ ransomware, financial ]
Ocean Network Express (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Singapore. Container shipping Singapore | Internal staff directories, operational voyage and fuel-consumption records, and financial-adjacent planning material | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Company #14
October 11, 2026
•[ ransomware, financial ]
Company #14 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-11. Country: Canada. Financial services Canada | [HONORED: settled 2026-10-07 17:00 UTC before their deadline]
Samjoo Maritime (ship management)
October 12, 2026
•[ ransomware, financial ]
Samjoo Maritime (ship management) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: South Korea. Ship management South Korea | Internal financial records (expense applications and bunker cost calculations) | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
