Arkin Group
June 30, 2026
•[ ransomware, social, retail ]
Arkin Group was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Country: Turkey. Website: arkingroup.com. CYBERSECURITY: ARKIN HOTEL GROUP SUFFERS MASSIVE DATA BREACH OVER 1 TB OF GUEST AND CASINO DATA STOLENCybersecurity experts from Cyclops Threat Intelligence have reported a critical incident affecting the Arkn Group hotel chain (www.arkingroup.com), including its premium properties The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach in Northern Cyprus. According to preliminary assessments, the attackers managed to exfiltrate over one terabyte of internal documents, customer databases, and transaction logs, including confidential information from the Arkn Palm Beach Casino.Attack detailsAnalysts have established that the attackers gained initial access through a compromised employee account in the reservations department. Using legitimate remote administration tools, they gradually expanded their privileges, bypassed network segmentation, and exfiltrated a dataset totalling approximately 1.4 TB. Some of the stolen information has already surfaced on underground forums and darknet marketplaces.The stolen data includes: Full guest profiles (passport details, phone numbers, addresses, stay history); Financial details of bookings and payment credentials; The internal CRM system with staff notes on VIP clients; Casino database: player IDs, deposit amounts, visit frequency, records of chip exchange transactions and fund movements; Scanned passports, compliance check forms (KYC/AML), including source-of-funds questionnaires for high rollers.Objective and likely operatorBased on the intrusion characteristics and tactics used, experts link the incident to the threat group CryptoRex (tracked since 2023), which specialises in attacking hospitality and gambling businesses in the Mediterranean region. A combination of financial extortion and data sale to multiple buyers is considered likely. So far, no official ransom demand has been received, but portions of the archives have been put up for auction with a starting price of 8 bitcoins.Potential consequences of the leakThe leakage of confidential guest and especially casino client data entails a cascade of risks that go far beyond reputational damage.1. Personal security of high-net-worth guestsThe VIP casino player database, containing passport details, habits, and financial capabilities, serves as a direct directory for kidnappers, extortionists, and organised crime groups. Affected individuals may face real threats to their physical safety, as well as targeted blackmail (e.g., threats to expose gambling activity to business partners or family members in countries where gambling is stigmatised).2. Financial fraudPayment data from hotel guests and credit/debit cards linked to casino accounts will enable unauthorised transactions. Given the high credit limits of casino patrons, the scale of potential phishing and card fraud is assessed as very significant.3. Compliance nightmare and regulatory finesAlthough the international casino operators in Northern Cyprus do not directly fall under GDPR, many guests are citizens of the EU, the UK, and CIS countries. The breach demonstrates a flagrant failure to meet personal data protection standards. Lawsuits by affected individuals in national courts and scrutiny by international payment systems (Visa, Mastercard) are possible, which could suspend acquiring services.4. Risks to the casino itself and the jurisdiction[6/9/2026 1:09 PM] ChatGPT 5 | Deepseek | Claude: The exposure of internal AML records documenting the origin of funds and possible links to politically exposed persons could spark money-laundering investigations. For Northern Cypruss gambling zone, already under close watch by the FATF, this could lead to tighter international financial monitoring and being placed on grey lists.5. Reputational ruinNo wealthy client will entrust their data to a hotel incapable of protecting basic IT infrastructure. Trust in the Arkn brand, which for decades has built an image of secluded luxury, will be undermined for years. Competitors in the elite leisure market, especially in Dubai, Monaco, and the Maldives, will immediately exploit the situation to poach wary clientele.Analysts recommendationsCyclops Threat Intelligence strongly advises all individuals who have ever stayed at Arkn hotels or visited Arkn Palm Beach Casino to: Immediately block and reissue any bank cards used; Monitor credit reports for new applications; Enable additional authentication factors on email and financial services; Be highly critical of any incoming calls or messages demanding identity confirmation or fund transfers these could be targeted attacks using contextual details from the leaked staff notes.The Arkn Group press office has not yet responded to official inquiries. The companys website remains operational, but online booking sections are temporarily unavailable. Northern Cyprus authorities stated that they are aware of the incident and have begun consultations with EU experts under a cyber-resilience programme.Report prepared by the Thomson Reuters cybersecurity desk based on the Cyclops Threat Intelligence analytical brief.
Port Angeles Composite
June 30, 2026
•[ ransomware, manufacturing, technology ]
Port Angeles Composite was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Manufacturing. Country: United States of America. Website: www.pacomposite.com. Port Angeles Composite LLC (PAC) is a leading supplier of advanced structural composite assemblies and components, serving the global commercial and business aerospace markets. Originally founded in 1996 as Angeles Composite Technologies, PAC was acquired by Honda Aircraft Company in October 2025. The company operates from a state-of-the-art manufacturing facility on Washington States Olympic Peninsula, supporting customers such as Boeing, Bombardier, and Honda Aircraft with high-quality composite structures for new aircraft systems. PAC's advanced manufacturing processes and technology ensure the highest quality composite products, offering tailored solutions to meet the unique requirements of each aerospace customer.
Medlink Georgia
June 30, 2026
•[ ransomware, healthcare ]
Medlink Georgia was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Healthcare. Country: United States of America. Website: www.medlinkga.org. We have proudly been serving northeast Georgia since 1976. As a federally qualified health center, we are able to offer uninsured and underinsured patients a sliding fee scale. No one is denied services due to lack of income or insurance status.At MedLink Georgia, we strive to provide comprehensive, coordinated, and continuous care to all our patients. We offer a broad array of primary and preventive care services for patients of all ages, including screening, diagnosis, and management of chronic illnesses.
infinedi.net
June 16, 2026
•[ ransomware, technology, healthcare ]
infinedi.net was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Technology. Website: infinedi.net. Clearinghouse The company doctors pay to keep their patients' data safe. This article presents only ...
vcnyhome.com
June 2, 2026
•[ ransomware, retail, leak ]
vcnyhome.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Retail & E-Commerce. Website: vcnyhome.com. THE VCNY HOME ARCHIVE The company that sells home comfort failed to protect its own home its inter...
touredge.com
June 2, 2026
•[ ransomware, manufacturing, retail ]
touredge.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Hospitality. Country: United States of America. Website: touredge.com. The Breaking Point A golf club manufacturer sells precision, durability, and control as a philosophy...
ilex-paysages.com
June 22, 2026
•[ ransomware ]
ilex-paysages.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-22. Sector: Agriculture and Food Production. Country: France. Website: ilex-paysages.com. LANDSCAPE ARCHIVE: How Ilex Paysages et Urbanisme Stores Its Own and Others' Secrets PROLOGUE Th...
owensborograin.com
June 19, 2026
•[ ransomware, manufacturing, financial ]
owensborograin.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-19. Sector: Agriculture and Food Production. Country: United States of America. Website: owensborograin.com. PROCESSING: GRAIN IN SOMEONE ELSE'S MILL PROLOGUE Tax returns filed with the IRS under threat of "fi...
rcfassoc.com
June 23, 2026
•[ ransomware, technology ]
rcfassoc.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-23. Sector: Professional Services. Country: United States of America. Website: rcfassoc.com. R.C. FIELDS & ASSOCIATES: Client Data, Hidden Development Risks, and Uninvestigated Security Inc...
About Todd Hamaker & Johnson
June 30, 2026
•[ ransomware, finance ]
About Todd Hamaker & Johnson was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Todd, Hamaker & Johnson, LLP is a professional tax and accounting firm based in Lufkin, Texas,
dedicated to providing personalized services to both individuals and businesses. The firm offer
s a comprehensive range of services including tax, accounting, audit, and financial guidance.
We will upload 40gb of corporate data soon. Lots of client and employee personal information (p
assports, SSNs, DLs and other information), detailed financials, client financials and other co
nfidential client docs, contracts and agreements, etc.
Yuditec S.A.
June 30, 2026
•[ ransomware, technology ]
Yuditec S.A. was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Technology. Country: Uruguay. Website: yuditec.com.
on-us
June 30, 2026
•[ ransomware, technology ]
on-us was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Technology. Country: Hong Kong. Website: on-us.com.
Pirámide Seguros
June 30, 2026
•[ ransomware, finance ]
Pirmide Seguros was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Financial Services. Country: Venezuela (Bolivarian Republic of). Website: segurospiramide.com.
Sociedad Latina
June 25, 2026
•[ ransomware, education ]
Sociedad Latina was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-25. Sector: Other. Country: United States of America. Website: sociedadlatina.org. Support in education, civic engagement, workforce development, and arts and culture, specifically tailored for multilingual learners
ORA Group Information
June 23, 2026
•[ ransomware, retail ]
ORA Group Information was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-23. Sector: Professional Services. Country: France. Website: groupe-ora.com. Specializing in retail and the point-of-sale experience
Spector and Lenz, PC
June 22, 2026
•[ ransomware, healthcare, finance ]
Spector and Lenz, PC was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-22. Sector: Professional Services. Country: United States of America. Website: spectorandlenz.com. Firm provides legal representation to clients facing disability, injury, or serious illness
Hemmersbach GmbH & Co. KG
June 30, 2026
•[ ransomware, technology ]
Hemmersbach GmbH & Co. KG was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Country: Germany. Website: www.hemmersbach.com.
Chamco
June 30, 2026
•[ ransomware, manufacturing ]
Chamco was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Manufacturing. Website: www.chamco.com.
wilfley.com
June 24, 2026
•[ ransomware, manufacturing, technology ]
wilfley.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Professional Services. Country: United States of America. Website: wilfley.com. SEAL FAILURE A company that builds pumps for chemical and defense production and undertakes to con...
joyconstructionnyc.com
June 24, 2026
•[ ransomware, manufacturing ]
joyconstructionnyc.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Manufacturing. Country: United States of America. Website: joyconstructionnyc.com. Joy Construction Corp: $1.3 Billion in Affordable Housing and $8.7 Million to a Shareholder in Six...
