Morula IVF
September 25, 2026
•[ ransomware, healthcare ]
Morula IVF was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: South Africa. Website: morulaivf.co.id. [AI generated] Morula IVF is a network of fertility clinics operating in Indonesia, specializing in in vitro fertilization (IVF) and other assisted reproductive technologies. It operates within the healthcare industry, specifically reproductive medicine, offering services such as fertility consultations, egg and sperm preservation, and infertility treatments. The company has multiple clinic locations across major Indonesian cities, serving patients seeking fertility treatment options.
Securitas Group
September 25, 2026
•[ ransomware, technology ]
Securitas Group was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Professional Services. Country: Sweden. [AI generated] Securitas Group is a Swedish multinational security services company headquartered in Stockholm, Sweden. It operates in the security industry, providing guarding services, electronic security, fire and safety solutions, corporate risk management, and remote monitoring. Founded in 1934, it operates globally across dozens of countries, serving clients ranging from small businesses to large corporations, government agencies, and critical infrastructure providers.
Electrolux & Ontrac
September 25, 2026
•[ ransomware, manufacturing, retail ]
Electrolux & Ontrac was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Manufacturing. Hello Electrolux & OnTrac,
Still no response from you. When we called your IT helpdesk posing as threat researchers and asked about the breach, we were told, "We cannot talk about it."
You have one week before we release more data - starting with information on your employees.
We'd prefer to settle this directly.
Same goes for OnTrac. We recently learned that OnTrac has been paying employees as little as $14.50 an hour. As a result, we will be releasing salary information for all of their employees.
I also managed to get in touch with a former OnTrac employee, chill guy. Said his time there was horrible.
EMAIL: xdlmfao@morke.ru
SESSION: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Retail, Manufacturing, Transportation]
Platinum Healthcare Staffing
September 25, 2026
•[ ransomware, healthcare ]
Platinum Healthcare Staffing was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: United States of America. Website: platinumhs.com. Platinum Healthcare Staffing is a healthcare staffing agency headquartered in Lafayette, USA, founded in 2005. It provides nursing and allied healthcare professionals, including RNs, LPNs, and CNAs, to hospitals, clinics, and medical facilities.
PKF Hadiwinata
September 25, 2026
•[ ransomware, finance ]
PKF Hadiwinata was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Professional Services. Country: Indonesia. Website: pkfhadiwinata.com. PKF Hadiwinata is a top-10 accounting and professional services firm in Indonesia, headquartered in the financial district of Jakarta. Founded in 1987, it is a member of PKF International and provides audit, tax, business solutions, and consulting services.
S...
September 25, 2026
•[ ransomware ]
S... was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-25. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).
N...
September 25, 2026
•[ ransomware ]
N... was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-25. Redacted entry - full company name pending disclosure (FULL DATA TIMER active).
FTAPI Software
September 25, 2026
•[ ransomware, technology, healthcare ]
FTAPI Software was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Technology. Country: United States of America. Website: ftapi.com. ftapi.com zoominfo.com/c/ftapi-software/346927067 FTAPI (founded 2010, Munich, Germany) is a software company offering a secure, GDPR-compliant platform for exchanging sensitive business data and automating workflows encrypted email and file transfer, virtual data rooms, digital forms and no-code process automation. It serves 2,000+ organizations and over a million users, mainly in public administration, healthcare, insurance and industry, with all data hosted exclusively in Germany under strict certifications (ISO 27001, BSI C5, SOC 2) and optional zero-knowledge encryption. Its core selling point is European digital sovereignty a compliant alternative to US cloud tools like Dropbox under GDPR, NIS-2 and DORA regulations. In 2025 it raised 65 million from PE investors Armira and Tikehau Capital, which took control to fund EU expansion and acquisitions. The company employs around 150 people and targets becoming a leading European player in secure data exchange by 202829.
Ligue se Grupo
September 24, 2026
•[ ransomware, technology, finance ]
Ligue se Grupo was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Portugal. Website: grupoligue-se.pt. grupoligue-se.pt Ligue-se Grupo is a Portuguese IT and business-services group founded in 2009 in Funchal, Madeira (born from the merger of accounting firm Contatlntico and IT company Enterformatic). It runs several businesses: Chip7 retail computer stores (Madeira + Lisbon) selling PCs, laptops and accessories with repair services; GoClick, a B2B IT arm handling infrastructure, cybersecurity, cloud/Microsoft 365, ERP software (Sage, PHC, ZoneSoft) and hotel-tech solutions; and Ligue.Gest, offering accounting, payroll and tax consulting. Led by CEO Ivo Herculano Caires and CFO lia Caires, it targets SMEs and private clients across Madeira and mainland Portugal. In short: one group covering everything from hardware sales and repairs to IT management and bookkeeping.
Pajulahti
September 21, 2026
•[ ransomware, manufacturing, education ]
Pajulahti was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Finland. Website: pajulahti.com. pajulahti.com zoominfo.com/c/pajulahti/369113600 Pajulahti Sports Institute is one of Finland's oldest and largest sports institutes, founded in 1929 and located on 110 hectares by Lake Iso-Kukkanen in Nastola (Lahti), about an hour from Helsinki. It is Finland's only official Olympic and Paralympic Training Center, known for its focus on endurance sports and paralympic athletics. Since January 2025, Pajulahti has been merged with Kisakallio and the Helsinki-based Urhea campus into Kolmen kampuksen urheiluopisto the largest sports institute in Finland, with 3 campuses, ~200 employees, 73,000 m of sports facilities, 320,000 visitors per year, and ~500 students in professional sports education. The merged group generates about 26 million in annual revenue, operates on a non-profit basis (owned by foundations)
Craisa
September 21, 2026
•[ ransomware, retail, manufacturing ]
Craisa was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Website: craisa.com. craisa.com zoominfo.com/c/craisa/345610542 CRAISA S.A. is a Costa Rican distributor of agricultural, construction, and industrial machinery, founded in 1981 and headquartered in Heredia. It is the official exclusive dealer of CASE IH (agriculture) and CASE Construction Equipment in Costa Rica, covering the entire country through branches in Heredia, San Carlos, Gupiles, and Cartago. The company also distributes specialty brands including Antonio Carraro (Italian specialty tractors), Hangcha (forklifts), XAG agricultural drones, and precision farming systems (Raven/Trimble), while offering in-house service workshops, genuine parts supply, and equipment financing. It employs around 43 people with a highly loyal management core (many directors with 1522 years of tenure), operates under SAP Business One, and holds official "Carbono Neutral" certification from the Costa Rican government.
Brancoptica
September 21, 2026
•[ ransomware, retail, healthcare ]
Brancoptica was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: Portugal. Website: brancoptica.pt. brancoptica.pt Brancptica, Lda is a family-owned optical retail chain founded in 1961 in Cartaxo, Portugal (Ribatejo region) by Jos Francisco Branco de Oliveira, originally as "Oculista do Cartaxo." Now led by the founder's son Rui Oliveira, the company operates 20+ stores across three districts Santarm, Lisbon, and Leiria under the banner of the international Opticalia alliance (part of EssilorLuxottica). Beyond selling eyewear (Ray-Ban, Gucci, and designer brands), it provides professional optometry and orthoptics services with a team of 20+ qualified specialists, and runs its own e-commerce store on Shopify. The company employs roughly 3151 people with estimated revenue in the 210 million range. It is a rare example of a family optical chain that has survived and grown amid the mass decline of independent opticians in Portugal, winning the pticaPro 2024 Social Responsibility Award.
PuroClean
September 21, 2026
•[ ransomware, leak ]
PuroClean was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Other. Country: United States of America. Website: puroclean.com. puroclean.com purocleanfranchise.com PuroClean is North America's largest privately owned property damage restoration franchise, known as "The Paramedics of Property Damage", with 500+ franchise locations across the U.S., Canada, and Puerto Rico, headquartered in Tamarac, Florida. It provides 24/7 emergency services water damage mitigation, fire and smoke restoration, mold remediation, biohazard cleanup, and reconstruction responding within two hours, and is a preferred provider for 3 of the top 5 U.S. insurance carriers. The brand was launched in 2001 under the legal entity PuroSystems, LLC; in 2015 it was acquired by Mark W. Davis (former co-founder/CEO of Belfor North America) and Frank Torre, who grew the network from 222 to 500+ locations. The franchisor's audited revenue is $31.8 million (FY2025), while system-wide franchise sales exceed $400 million, with an average franchise unit generating ~$942K per year.
Markisol
September 21, 2026
•[ ransomware, manufacturing ]
Markisol was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Sweden. Website: markisol.se. markisol.se zoominfo.com/c/markisol-ab/357807356 Markisol Group is a Swedish family-owned manufacturer of window blinds (roller, venetian, pleated, roman, and panel) headquartered in Ronneby, Sweden, founded in the late 1960s by Bo Persson, who started making blinds at age 6 alongside his father and built the company into one of the world's leading blind producers. The company has been a supplier to IKEA since 1983 and is fully vertically integrated it designs and builds its own patented assembly machines (up to 400 blinds per hour), produces its own components, and weaves and prints its own fabrics at its textile plant in Narva, Estonia (in the historic Krenholm factory).
Grupo MARSAN
September 21, 2026
•[ ransomware, manufacturing, automotive ]
Grupo MARSAN was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Mexico. Website: grupomarsan.com. grupomarsan.com zoominfo.com/c/grupo-marsan/460771135 Grupo Marsan is a Spanish Tier 2 automotive supplier founded in 1951 in Vigo, Spain, specializing in industrial surface coatings cataphoresis (e-coating), powder and liquid painting plus metal stamping, assembly, and JIT logistics, with a capacity of 300,000 parts per day. The company operates plants in Spain (Vigo, Zaragoza), Portugal, and Mexico, and also builds and runs dedicated in-house coating lines inside clients' facilities, supported by its own technology center M-Tech. It works under IATF automotive quality standards within supply chains of major OEMs and Tier 1 suppliers. After a liquidity crisis in 2024, the group was recapitalized with private and Galician public funds (~47.5% held by Xesgalicia and Vigo Activo), and Marcos Oubia was appointed CEO. FY2024 revenue exceeded 28 million with ~450 employees, and in 2025 the company acquired KATA Aragn, growing to ~500 employees
Progeny
September 21, 2026
•[ ransomware, technology ]
Progeny was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Technology. Country: Antigua & Barbuda. Website: progenyag.com. progenyag.com zoominfo.com/c/progeny-ag/351504348 Erwin-Keith, Inc. (Progeny Ag Products) is a family-owned seed and grain company founded in 1984 in the Arkansas Delta (Wynne, Arkansas, USA), operating under the Progeny brand since 1997. The company develops and markets its own varieties of soybeans, corn, wheat, and rice, selling across 1011 Southern U.S. states. Its rice brand ProGold is licensed from the University of Arkansas and ProGold L4 and M3 varieties are now included in the university's official 2026 recommended planting list. Beyond seeds, the company runs grain elevators (including a rail facility), a trucking fleet across 9 states, and grain marketing programs (HTA, basis-only, and average pricing contracts). Estimated revenue is around $26 million with roughly 100+ employees (seasonal workforce included), and the business remains led by the founding Erwin and Keith families.
ANP Health
September 21, 2026
•[ ransomware, healthcare ]
ANP Health was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Healthcare. Country: Brazil. Website: anphealthsolutions.com. anphealthsolutions.com ANP Health Services Inc. is a Florida-based recruitment agency specializing in placing foreign-trained nurses into U.S. hospitals, with a strong focus on Latin America (especially Venezuela). Founded in 2019 by Nelson Hurtado, a Venezuelan immigrant and registered nurse, the company provides an end-to-end service: credential validation, NCLEX exam preparation, English training, direct-hire placement with 150+ partner hospitals, and visa sponsorship (EB-3 Green Card for the nurse and family). It has helped over 2,000 nurses from 28 countries, with candidates typically earning $70100K per year plus sign-on bonuses. The company is a Certified Ethical Recruiter (CGFNS Alliance) one of only about 16 accredited firms in the U.S. and employs roughly 3050 people across 9 countries. Estimated revenue is $1050 million annually.
Magnetos y Refacciones
September 21, 2026
•[ ransomware, manufacturing, retail ]
Magnetos y Refacciones was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Manufacturing. Country: Mexico. Website: magnetos.com.mx. magnetos.com.mx zoominfo.com/c/magnetos-y-refacciones-sa-de-cv/1288761434 Magnetos y Refacciones, S.A. de C.V. is a Mexican trading and service company founded in 1977 and headquartered in Guadalajara, Jalisco. Its core business is supplying magnet wire, bearings, insulating varnishes, electric motors, and spare parts for motor repair wholesale and retail, serving customers across all 32 Mexican states. Its second key business is a nationwide network of authorized service centers performing warranty and post-warranty repair for Groupe SEB brands (Krups, T-Fal, Rowenta, Moulinex) and Taurus in 810 Mexican cities. The company employs around 129 people and is part of a small group operated by Corporacin Rodaja. It also exports to Central America (mainly El Salvador), with about US$4.2 million in shipments over the last five years. Despite nearly 50 years on the market, it has virtually no digital presence its website is an empty placeholder.
StMicroelectronics
September 21, 2026
•[ ransomware, technology, manufacturing ]
StMicroelectronics was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Technology. Country: Italy. Website: st.com. st.com zoominfo.com/c/stmicroelectronics/114508234 Revenue $13.1 Billion STMicroelectronics (ST) is one of the world's largest semiconductor companies and Europe's biggest chipmaker, headquartered in Geneva, Switzerland. Formed in 1987 through the merger of Italian and French state-owned chip companies, it is a fully integrated manufacturer it designs, produces, and sells its own chips. Its core products are microcontrollers (the flagship STM32 family), sensors, analog and power chips, silicon carbide devices for electric vehicles, and chips for data centers and satellites. The company serves over 200,000 customers worldwide including Apple, Tesla, Bosch, Samsung, and SpaceX supplying components for cars, smartphones, industrial equipment, and data centers. It operates 14 manufacturing plants across Europe and Asia, employs about 49,000 people, and invests roughly 17% of its revenue in R&D.
Magna Legal Services
September 24, 2026
•[ ransomware, technology, finance ]
Magna Legal Services was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Country: United States of America. Website: magnals.com. Magna Legal Services is a nationwide provider of comprehensive litigation support and legal services, serving law firms, corporations, insurance companies, and government organizations. Founded in 2007 and headquartered in Philadelphia, Pennsylvania, the company supports clients throughout the entire litigation process. Its services include court reporting, deposition services, medical record retrieval, jury consulting, trial presentation, legal graphics, video production, investigations, service of process, interpreting and translation, and virtual proceedings. Magna combines legal expertise with technology to help attorneys manage complex cases efficiently. The company has expanded its national presence through strategic acquisitions and currently operates across numerous locations throughout the United States.
The company headquarters is located in 1635 Market Street, 8th Floor, Philadelphia, PA 19103, United States. 501-1000 Employees
