Groupe APROSEP
September 29, 2026
•[ ransomware, leak, technology ]
Groupe APROSEP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Other. Country: Senegal. Website: groupe-aprosep.com. groupe-aprosep.com guyanasso.org Groupe APROSEP (founded 1994, Cayenne, French Guiana) is a solidarity-economy network (groupement d'conomie solidaire) that unites and professionalizes associations across the region, focusing on employment insertion, training and social innovation. It runs several affiliated structures LIANE (job integration), OFA Guyane (training), GEIQ Jeun'ESS and GEPSL (shared employers for sports/youth/childcare jobs) and the Conciergerie Solidaire all housed in "L'Accordeur," a 1,600 m PTCE-labeled cooperative hub in downtown Cayenne supporting about 500 jobs and 240 associations. Led since 1997 by director Jean-David Poquet under president Jos Othily, the group celebrated its 30th anniversary in June 2025 and runs flagship projects like an AVIP integration crche (30 places), the EVA illiteracy-assessment center and the social enterprise Tisanes de Camopi. Its partner network spans France Travail, ANLCI, Orange
Europrim
September 29, 2026
•[ ransomware, healthcare ]
Europrim was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Healthcare. Country: France. Website: euro-prim.com. euro-prim.com zoominfo.com/c/europrim/1128488637 EURO-PRIM (founded 1998, Grenoble, France) is a local digital printing and reprographics company working together with its sister firm CINRA (est. 2003) as "Europrim & CINRA" two production sites, ~25 staff, serving students, SMEs, large regional companies and property-management firms. Services cover digital color/B&W printing up to A3+, large-format scanning up to A0, graphic design, finishing, personalized mass mailings (including for homeowners' association meetings) and prefecture-approved numbered event tickets. The business was taken over in 2016 by Fleur Henno and Philippe Baffert-Rey, who modernized the equipment and pushed an online store with 200+ products; it holds a solid 4.2/5 rating on 222 Google reviews. However, on 2 July 2025 the Grenoble commercial court opened redressement judiciaire (receivership)
QUALITY SPORT Topsport Italia
September 29, 2026
•[ ransomware, retail ]
QUALITY SPORT Topsport Italia was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Retail & E-Commerce. Country: Italy. Website: topsportitalia.it. topsportitalia.it qualitysport.com Topsport Italia (founded 1972, Savigliano, Piedmont) and Quality Sport Italia S.r.l. (registered 2009, same address) are two sides of one B2B sports-equipment operator in Italy, run today by director Dario Valsania after being spun out of the larger Bongiovanni Sport group. Topsport designs and installs sports facilities "turnkey" courts, suspended ceilings, partitions, bleachers and lighting while Quality Sport sells and services fitness machines, gymnastics gear and accessories to sports schools, associations and public bodies via its qualitysport.com platform. Their model is full-service: consulting, equipment selection, installation, training and after-sales, backed by their own warehouse in Savigliano. The two brands share one multilingual e-commerce platform (6 languages) and a combined catalog. They are a solid mid-sized niche player with 50+ years of heritage
Auren
September 29, 2026
•[ ransomware, finance ]
Auren was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Professional Services. Country: Spain. Website: auren.es. auren.es zoominfo.com/c/auren/1115886722 AUREN (founded 1998, Madrid) is Spain's leading home-grown multidisciplinary professional-services firm audit, legal/tax advisory, consulting and corporate finance with 104 million revenue in Spain and 1,100+ staff in 15 offices (2,500+ people and 62 offices worldwide). Founded and chaired by Mario Alonso Ayala, it sells an integrated "Big Four-style" service portfolio to mid-market companies with a "humanist, close-to-client" culture, plus standout niches in forensic/expert-witness work, public-sector audit and M&A. In March 2025, Dutch private equity fund Waterland took a 49% stake the first PE investment in a Spanish professional-services firm giving it firepower for acquisitions. Revenue is split roughly Legal 42M, Consulting 35M, Audit 24M, Corporate Finance 3.4M, and the firm is now on a buy-and-build spree (1518 deals planned for 2026, its largest being the absorption of Moore Espaa's Madrid and Barcelona offices).
Datacomm Services
September 29, 2026
•[ ransomware, technology, government ]
Datacomm Services was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Country: United States of America. Website: dscdatacomm.com. dscdatacomm.com zoominfo.com/c/datacomm-services-corp/347799114 Datacomm Services Corporation (DSC) (operating since 1988, Memphis, Tennessee) is a low-voltage systems contractor serving the Memphis/Mid-South region (TN, MS, AR) for nearly 40 years. It designs and installs structured cabling (Cat 5eCat 6A and fiber optics), outside-plant networks, access control, CCTV, intrusion alarms and paging/AV systems acting as a single point of contact for all low-voltage building systems. Led by President Allen Hendry and EVP/CEO Chuck Jennings, it runs a lean ~22-person team with two certified RCDD designers on staff and revenue around $10 million/year. Clients range from small service tickets to $1M+ projects offices, industrial sites and especially school systems and government buyers (it holds TIPS purchasing contracts through 2028). It carries an A+ BBB rating and clean legal record, with strong reviews for workmanship and service. Main limits: purely regional footprint and dependence
Defencebit
September 29, 2026
•[ ransomware, technology, government ]
Defencebit was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Government & Defense. Country: United Kingdom of Great Britain and Northern Ireland. Website: defencebit.com. defencebit.com zoominfo.com/c/defencebit/532842616 DefenceBit (founded 2018, Lisbon) is a boutique cybersecurity consulting firm self-described "hackers, but the good ones" spun off from Bullray-CIT, an Angolan-government-focused critical-systems integrator. It provides offensive-security services: penetration testing, vulnerability assessments, hardening, source-code and web/API audits, mobile app audits, social-engineering tests and full Red Team engagements, working to PTES/OWASP/OSSTMM standards with manual verification. The team holds top certifications (CEH, CISSP, PMP, Checkpoint CCSE, ISO 27001) and its co-founder later moved to a senior role at the NATO Communications and Information Agency. A notable credential is its contract with Portugal's National Cybersecurity Centre (CNCS) to run the "Cidado Ciberseguro" course for government workers on the state NAU platform. It remains a very small company (110 staff)
Samwumed
September 29, 2026
•[ ransomware, healthcare, finance ]
Samwumed was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Healthcare. Country: South Korea. Website: samwumed.org. samwumed.org zoominfo.com/c/samwumed/346685548 SAMWUMED (founded 1952, Cape Town) is a closed, self-administered medical aid scheme serving South African municipal workers roughly 35,000 members and 73,000 covered lives. It collects about R1.9 billion/year in contributions, kept reserves over R1.3 billion and posted a R14.3 million surplus in 2024 (solvency 68% vs the 25% legal minimum). Plans are income-banded and cheap (from ~R750/month with a 60% employer subsidy), covering hospitals, doctors, medication, dentistry and optics. Led by Principal Officer Francina Mosoeu with a union-appointed board, it administers benefits with Medscheme across a network of private hospital groups. Key problems right now: membership shrinking ~15%/year as young people leave, and an ongoing court battle with the Melomed hospital group over contract exclusions plus the long-term threat of national health insurance reform.
Gardeners' Guild
September 30, 2026
•[ ransomware, leak ]
Gardeners' Guild was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Agriculture and Food Production. Country: United States of America. Website: gardenersguild.com. Gardeners' Guild is a full-service landscaping company based in the SF Bay Area, specializing in both interior and exterior landscape maintenance and construction. Founded in 1972 and employee-owned, they offer a range of services including irrigation repair, sustainable landscaping, and fire fuel reduction. Their clients include multi-family communities, commercial buildings, business parks, hospitality venues, and residential properties. The company is dedicated to transforming and maintaining landscapes while promoting water conservation and drought-tolerant designs.
The company headquarters is located in 2780 Goodrick Avenue, Richmond, CA 94801, United States.
51-200 Employees
West County Health Centers
September 30, 2026
•[ ransomware, healthcare ]
West County Health Centers was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Country: United States of America. West County Health Centers provides comprehensive, quality and accessible health care services to the communities of western Sonoma County.The company is a cohesive team of health care providers, support staff and volunteers dedicated to wellness, compassion, affordability and excellence of care. The company believes in non-judgmental and equal care for all members of the company's diverse community.
The company headquarters is located in 14045 Mill Street, Guerneville, CA 95446, United States. 51-200 Employees
clicks digital GmbH Information
September 30, 2026
•[ ransomware, technology ]
clicks digital GmbH Information was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Germany. clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More
MCAP — MortgageHub commercial lending platform
September 30, 2026
•[ ransomware, finance ]
MCAP MortgageHub commercial lending platform was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Financial Services. Country: Canada. Mortgage securitization and servicing (Canada) Canada | The complete MortgageHub borrower database of a major Canadian mortgage company: seven years of records with social insurance numbers, dates of birth, full addresses, and complete loan and payment histories; The daily commercial servicing book: the full national portfolio of active commercial mortgages with balances, interest rates, credit scores, insurer policy numbers, arrears, and investor reporting fields; The full backup archive of the platform, 2019 through today | [ACTIVE: deadline 2026-10-03 15:00 UTC]
Altmannshofer Sicherheits-Videotechnik
September 30, 2026
•[ ransomware, manufacturing, technology ]
Altmannshofer Sicherheits-Videotechnik was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: Germany. Website: altmannshofer.de. Altmannshofer Sicherheits-Videotechnik OHG is a German installer of electronic security systems from Affing near Augsburg, Bavaria. Since 1999 it plans and installs CCTV, burglar alarms (EMA), access control, electronic locks, fingerprint scanners
PROJAHN
September 30, 2026
•[ ransomware, manufacturing ]
PROJAHN was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Other. Country: Germany. Website: projahn.de. German manufacturer and distributor of professional precision
and hand tools (drill bits, masonry/wood/steel tools, thread tools, measuring tools, sockets, wrenches, screwdrivers, pliers, flashlights, workbenches).
Virtual Ideas
September 30, 2026
•[ ransomware, technology ]
Virtual Ideas was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Australia. Website: virtualideas.com.au. Virtual Ideas is an Australian 3D visualisation and digital content studio based in
Sydney. It specialises in architectural visualisation (CGI), 3D animation, marketing
films, product visualisation, shadow and visual-impact studies etc.
Becker Logistik
September 30, 2026
•[ ransomware, manufacturing ]
Becker Logistik was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Transportation. Country: Germany. Website: becker-logistik.de. German logistics and transportation company specializing in national and international freight transport, particularly bulk goods. The company operates its own fleet and provides reliable transport services across Germany and Europe.
Vinco Energy
September 30, 2026
•[ ransomware, energy ]
Vinco Energy was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Energy & Utilities. Country: United States of America. Website: vincoenergy.com. Vinco Energy Services is a Mexican oilfield services company providing engineering and operational solutions for the oil and gas sector. The company specializes in services like wireline logging, telemetry.
Astidental di Sabbione
September 30, 2026
•[ ransomware, manufacturing ]
Astidental di Sabbione was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: Italy. Website: bquadro.it. is a leading Italian distributor with over 60 years of experience specializing in dental equipment, instruments, and dental laboratory supplies. The company provides comprehensive services, including dental office turnkey design, digital workflow
Dr Damiel Pugliese
September 30, 2026
•[ ransomware, finance, healthcare ]
Dr Damiel Pugliese was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Website: pugliese.lo. Dr. Daniel P. Pugliese is a certified Argentine accountant graduated from the prestigious University of Buenos Aires (U.B.A.). He is officially registered with the Professional Council of Economic Sciences of Buenos Aires (C.P.C.E.C.A.B.A.), which
dfiretailgroup.com
September 8, 2026
•[ ransomware, leak, retail ]
dfiretailgroup.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Retail & E-Commerce. Country: United States of America. Website: dfiretailgroup.com. DFI RETAIL GROUP 27 Years of Email Archives + 397 Illegal Stores + 40,000 Medical Files Over 160 mai...
Buford-Thompson Company, LTD
September 30, 2026
•[ ransomware, manufacturing, financial ]
Buford-Thompson Company, LTD was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: United States of America. Website: Buford-Thompson Company, LTD. [construction] Buford-Thompson Company, LTD, a Texas construction general contractor with 30+ years of history building schools for K-12 districts across the state.
The exposed dataset totals 1.707 TB and includes:
5 years of W-2 EFW2 files (20212025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees every SSN readable without any decryption.
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation legal strategy, discovery responses, and counsel communications.
Complete Frost Bank infrastructure four account numbers, ACH routing credentials, line-of-credit agreements (renewed April 2026), signature cards, and monthly bank statements spanning 20222026.
36+ active school construction projects blueprints, bid estimates, cost structures, subcontractor pricing, and change orders for ISD projects across Texas. A competitor's dream dataset.
2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts.
QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accounting, donor, and likely payroll data.
Thompson family personal records owner personal insurance, loans, ranch property (Jack County), airplane ownership, bond dividends, and personal tax documents.
