KarmaData
April 28, 2026
•[ ransomware, technology ]
KarmaData was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Technology. Country: United States of America. Website: www.karmadata.com.
Silicon Alley
April 28, 2026
•[ ransomware, technology ]
Silicon Alley was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.siliconalley.co.uk.
Nephrology Associates
April 6, 2026
•[ ransomware, healthcare ]
Nephrology Associates was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-04-06. Sector: Healthcare. Country: United States of America. Website: www.arnapa.com. Nephrology Associates, PA is a leading central Arkansas nephrology practice with seven highly trained physicians across seven locations. They provide compassionate kidney care, accept all insurances, and aim to create a welcoming environment for patients.
cadencepetroleum.com
April 28, 2026
•[ ransomware, energy ]
cadencepetroleum.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Energy & Utilities. Country: United States of America. Website: cadencepetroleum.com. Company management has 48 hours to reach an agreement with us. If no agreement is reached, the filestotaling 400 GBwill be published.
Our objective is to provide our customers with the best products and services. Cadence Petroleum and our suppliers stand behind the products we offer. Regardle
Indonesia's Customs Analytics Platform
April 28, 2026
•[ ransomware, government, technology ]
Indonesia's Customs Analytics Platform was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Government & Defense. Country: Indonesia.
nbd3pl.com
April 29, 2026
•[ ransomware, leak ]
nbd3pl.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Transportation. Country: United States of America. Website: nbd3pl.com. North Bay Distribution has been in the warehousing, order fulfillment, and shipping industry for more than 30 years. They are a full service outsourcing logistics service provider. They are based in northern California's City of Vacaville. The proximity of their facility provides streamlined deliveries from the Port of Oakland for goods manufactured and arriving from the Pacific Rim
https://www.fulcrumre.com/
April 11, 2026
•[ ransomware, finance, leak ]
https://www.fulcrumre.com/ was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-11. Sector: Professional Services. Country: United States of America. Website: fulcrumre.com. 2tb data all company data
boxtopia.co.uk
April 29, 2026
•[ ransomware, retail, manufacturing ]
boxtopia.co.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: boxtopia.co.uk. +44 1476576090 . Boxtopia is the UK's leading supplier of custom cardboard boxes and printed boxes, specializing in short runs for small businesses with no minimum order. Stolen: 166gb 280k files
osoftec.com
April 29, 2026
•[ ransomware, technology, leak ]
osoftec.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Germany. Website: osoftec.com. +91 9717385459 . Optimization Software Technologies, LLP. is an advanced technology solutions development company that focuses on improving operational efficiency and profitability for its clients Stolen: 222gb 113k files
rotak.it
April 29, 2026
•[ ransomware, technology, healthcare ]
rotak.it was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Italy. Website: rotak.it. Rotak (specifically in the context of Rotak Instruments) focuses on the distribution of specialized medical and analytical instrumentation, with related entities in industrial engineering and automation Stolen: 22.5gb 20k files
rainforestclean.com
April 29, 2026
•[ ransomware, retail, leak ]
rainforestclean.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United States of America. Website: rainforestclean.com. Rainforest Carwash and Oil Change, along with its owner, enjoys giving back to our local community. Hopefully you are inspired to help after seeing the ways in which we try to help others. Stolen: 259gb 77k files
primeproperties.com.au
April 29, 2026
•[ ransomware, retail ]
primeproperties.com.au was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: Australia. Website: primeproperties.com.au. Prime Properties (NSW) P/L is a privately owned company based in Sydney, Australia, established in 1982, specializing in property investment, building management, and management consultancy services Stolen: 100gb 81k files
anvilarts.org.uk
April 29, 2026
•[ ransomware, leak, retail ]
anvilarts.org.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: anvilarts.org.uk. Anvil Arts is the largest performing arts organization in Hampshire, operating as an independent charitable trust. It manages three venues in Basingstoke, including The Anvil and The Haymarket, providing a diverse range of performances and cultural events. Stolen: 480gb 299k files
dmschweiz.ch
April 29, 2026
•[ ransomware, technology ]
dmschweiz.ch was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: Switzerland. Website: dmschweiz.ch. Sie haben im Katalog unsere Angebote von installierten und betriebsbereiten Gerten. Die Installationen knnen nach Ihren Wnschen angepasst werden. DM Standard-Installation ist optimiert und ohne Herstellerwerbung. Stolen: 120gb 100k files
stllc.org
April 21, 2026
•[ ransomware, healthcare ]
stllc.org was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-21. Sector: Other. Country: United States of America. Website: stllc.org. Welcome to St. Luke Lutheran Community St. Luke Lutheran Community is a not-for-profit, continuing...
instapack.es
April 28, 2026
•[ ransomware, retail ]
instapack.es was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Professional Services. Country: Spain. Website: instapack.es. Instapack is a professional courier service with over 30 years of experience, offering immediate del...
pricon.com.ph
April 17, 2026
•[ ransomware, manufacturing, technology ]
pricon.com.ph was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Professional Services. Country: Philippines. Website: pricon.com.ph. Pricon Microelectronics, Inc. (PMI) is an Original Equipment Manufacturer (OEM) and a subsidiary of...
Bayou Title, Inc.
April 29, 2026
•[ ransomware, finance, leak ]
Bayou Title, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Financial Services. Country: United States of America. Website: bayoutitle.com. [insurance] Bayou Title, Inc. the largest title insurance agent and closing/settlement services provider in Louisiana, with 19 full-service locations statewide.
The exfiltrated data spans 20+ years of operations (20042026) and includes:
70,000100,000+ Social Security numbers paired with names, addresses, and sale proceeds from 1099-S real-estate closing worksheets covering all 19 offices across three tax years (20182020), plus W-2 and 1099-MISC filings.
Complete employee payroll databases 10+ instances of Sage 50 EMPLOYEE.DAT files containing SSNs, bank account numbers, routing numbers, pay rates, tax withholding, and direct deposit details for current and former employees.
103 GB of title abstracts ~34,000+ PDFs documenting ownership chains, liens, and mortgages for properties across Louisiana.
44 GB of GreenFolders DMS transaction packages (2012, 2013, 2019) complete closing file archives containing HUD-1 settlement statements, identity verification documents, SSN cards, and tax records. Filenames contain encoded tags (ssn, hud, soc, tax).
Plaintext credentials for government portals a file literally named Lafayette Assessors lcmenard Password4321.url, plus a PDF containing Orleans Parish system login credentials.
Attorney-client privileged documents wills, attorney engagement letters, and legal opinions prepared by licensed Louisiana attorneys.
Costa Solutions, LLC
April 29, 2026
•[ ransomware, financial, technology ]
Costa Solutions, LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United States of America. Website: costasolutions.com. [warehouse] Costa Solutions, LLC a privately held managed-labor and warehousing company headquartered in San Antonio, Texas, with ~$140M annual revenue and 2001,000 employees.
The file server contained the complete operational, financial, legal, and human resources infrastructure of the company:
3,0008,000+ individuals' personal data current employees, former employees (12 years of records), independent contractors, employee dependents, and job applicants. SSNs on W-2s, W-4s, 1099s, I-9s, background checks. Bank account and routing numbers on 200+ direct deposit forms.
Medical and injury records 150+ employee injury/medical files from 20132026, FMLA medical certifications, drug test results (random, reasonable suspicion, post-incident, promotional), and workers' compensation claims for 23+ named individuals.
CEO's entire file system Josh Wean's Documents folder (5.3 GB) including P&L statements, a 17-subfolder "Confidential" directory, legal correspondence, strategic plans, a C-12 peer advisory group archive, and a $RECYCLE.BIN with 60+ deleted items.
Client contracts and competitive intelligence pricing, SLAs, and contract terms for HEB, CVS, Sysco, Amazon, McLane, Labatt, Valvoline. Competitor pricing intelligence. RFP bid documents with cost models.
Active legal case files litigation records (20212022), HR internal investigation notes (20182021), arbitration files, active investigations marked "DO NOT DELETE" all subject to attorney-client privilege.
Infrastructure secrets an HEB production server TLS certificate, a Cisco AnyConnect VPN installer, and the CEO's Remote Desktop connection file.
Corporate financials multi-year budgets, valuation & sale documents (indicating possible M&A activity), PPP loan forgiveness records, Form 5500 ERISA filings, and annual reporting.
Atlas Metal Industries Inc
April 29, 2026
•[ ransomware, leak, manufacturing ]
Atlas Metal Industries Inc was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: Canada. Website: atlasfoodserv.com. [food, metal] Atlas Metal Industries Inc. a privately held commercial-foodservice-equipment manufacturer headquartered in Miami, Florida.
The dataset is a complete Microsoft Dynamics GP environment: production databases, payroll records, system credentials, Autodesk Vault product-design backups, CNC fabrication programs, and all supporting infrastructure configuration. The exfiltration occurred on or about April 8, 2026; the attack was identified April 22, 2026.
The exposed material includes:
15.8 GB of payroll-records database (PYREC) full Employee Master with SSNs, DOBs, addresses, direct-deposit bank routing numbers, salary, W-4 tax data, garnishments, and check history dating to at least 2018.
30+ SQL Server login accounts with password hashes in a sp_help_revlogin dump named employees, system admins (DYNSA, sa), service accounts, and Active Directory domain accounts.
74 GB of Autodesk Vault Professional backup complete product-design history from 2019 through 2026, covering every product line Atlas Metal manufactures.
Hundreds of CNC fabrication programs laser-cutter and Amada punch-press G-code for the full catalogue of sheet-metal components.
A base64-encoded SQL credential for the TimeClock Plus timekeeping system, stored in plaintext XML.
8 SQL Server databases with full backup chains ATLAS (primary), PYREC (payroll), DYNAMICS (system), TEST (18 GB dev clone), TWO, AMIT, plus system databases (master, msdb, DynamicsGPSecurity).
