Aokkef
September 23, 2026
•[ ransomware, leak, technology ]
Aokkef was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-23. Country: France. Website: aokkef.fr. Organization with 137 emails extracted. Domain: aokkef.fr
RECEITA FEDERAL DO BRASIL
September 23, 2026
•[ ransomware, government, finance ]
RECEITA FEDERAL DO BRASIL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: Brazil. MINISTRIO DA FAZENDA
SECRETARIA DA RECEITA FEDERAL DO BRASIL
The archives contain several thousand documents with personnel and customer data,
as well as all user date on gov.br with passwords. [Sector: Finance]
Washington County
September 23, 2026
•[ ransomware, government, leak ]
Washington County was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: United States of America. Website: washingtoncountymaine.com. Government Administration Stolen data: 2 GB.
Smart Eye Care
September 23, 2026
•[ ransomware, healthcare ]
Smart Eye Care was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Healthcare. Website: www.smarteyecare.com. Optometrists Stolen data: 7 GB.
The Merrimack County
September 23, 2026
•[ ransomware, government ]
The Merrimack County was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: United States of America. Website: www.merrimackcounty.net. Government Administration Stolen data: 3 GB.
COSEF - Consorzio di Sviluppo Economico del Friuli
September 23, 2026
•[ ransomware, manufacturing ]
COSEF - Consorzio di Sviluppo Economico del Friuli was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Other. Country: Italy. Website: cosef.fvg.it. Facilities Services Stolen data: 200 GB.
AGROFRUTO SAC
September 23, 2026
•[ ransomware, retail ]
AGROFRUTO SAC was listed as a victim on the leak site of the arcusmedia ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Agriculture and Food Production. Country: Peru. agrofruto.peWe are a Peruvian company in the Agroindustrial sector, dedicated to the expo Deadline: 2026-09-30 09:45:00.000000
Inkript
September 23, 2026
•[ ransomware, technology ]
Inkript was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Technology. Website: www.inkript.com.
Apex Litigation Support
September 23, 2026
•[ ransomware, leak, financial ]
Apex Litigation Support was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Apex Litigation Support is a business that provides comprehensive litigation services to attorn
eys and law firms. Our team of experienced professionals is committed to delivering accurate an
d timely results that exceed our client's expectations.
We will upload 77gb of corporate data soon. Detailed employee and clients personal information
(passports, licenses, names, addresses, phones, emails and so on), personal financials, confide
ntial files, enormous amount of client data, lots of NDAs and so on.
Lemon Law
September 23, 2026
•[ ransomware, leak, finance ]
Lemon Law was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Country: United States of America. Virginia A Lemon PLLC
267 Stratton Aly, Lewisburg, West Virginia, USA
vlemonlaw.com
Leaked data: 16.8 Gb, 42 files
corporate documents, litigation materials, client personal data, financial documents and reporting, personal files of employees, and much more.
Urban Engineering
September 23, 2026
•[ ransomware, manufacturing, financial ]
Urban Engineering was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Manufacturing. Urban Engineering is a company that specializes in providing engineering services. They focus o
n delivering innovative solutions for various projects. Their intended clients include business
es and organizations seeking professional engineering expertise. The company is headquartered i
n Annandale, Virginia.
We will upload 20gb of corporate data soon. Employee information, projects, lots of financial d
ocuments, contracts and agreements, NDAs and so on.
Trump Mobile
September 23, 2026
•[ ransomware, leak, technology ]
Trump Mobile was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Technology. Country: United States of America. Website: trumpmobile.com. Revenue: 4K Users
Trump Mobile is an American mobile virtual network operator (MVNO) that uses a licensed brand from the Trump Organization and was launched by Donald Trump Jr. and Eric Trump. THEY GOT FKED LOL. ONLY 4K USERS? LOL Includes eSIM QR codes and user PII.
ASYAD GROUP
September 23, 2026
•[ ransomware, manufacturing ]
ASYAD GROUP was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Transportation. Country: Oman. Website: www.asyad.com. Asyad Group is Omans global integrated logistics provider, ranked 4th on Forbes 10 Biggest Logistics Companies in MENA list.
Legis
September 23, 2026
•[ ransomware, technology, finance ]
Legis was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More
vestfrostsolutions.com
August 31, 2026
•[ ransomware, manufacturing, retail ]
vestfrostsolutions.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-31. Sector: Other. Country: Norway. Website: vestfrostsolutions.com. Vestfrostsolutions.com The company sells reliability and precision back bar coolers for Red Bull, ...
Tomix / Grupo JOPER
September 23, 2026
•[ ransomware, manufacturing ]
Tomix / Grupo JOPER was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Manufacturing. Country: Portugal. Website: tomix.com.pt. Tomix Indstria de Equipamentos Agrcolas e Industriais, Lda. is a Portuguese manufacturer of crop-protection equipment, best known for agricultural sprayers, atomizers, dusters and related machinery. Founded in 1924 near Torres Vedras by Francisco Xavier Damio, it grew into a market leader in Portugal for plant-treatment equipment, including rotomoulded tanks and high-pressure washers. Since 1997 Tomix has been majority-owned by JOPER Indstria de Equipamentos Agrcolas, S.A., and today it operates as part of the family-run JOPER Group alongside JOPER and Ribatejo. Together they supply complementary agricultural machinery for transport, soil tillage and crop treatment across Iberia and export markets https://tomix.com.pt/
goldstarfinancial.com
September 23, 2026
•[ ransomware, finance ]
goldstarfinancial.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Financial Services. Country: United States of America. Website: goldstarfinancial.com. [AI generated] N/A
I don't have reliable, verified information about a specific company operating at "goldstarfinancial.com." There are multiple businesses that have used similar "Gold Star Financial" naming conventions in different jurisdictions (this is a fairly generic name used by mortgage brokers, lending companies, and financial services firms in various countries), so I cannot confidently confirm which specific entity this domain refers to, its current operational status, ownership, or verified business details without risking inaccurate attribution.
If you can provide additional context (such as the specific country, registration details, or services advertised on the site), I can help assess it more accurately. Alternatively, if this is for threat intelligence purposes, I'd recommend verifying details through domain registration records (WHOIS), business registries, or regulatory filings relevant to
Abtach Ltd.
September 23, 2026
•[ ransomware, technology, financial ]
Abtach Ltd. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-23. Abtach Ltd. was renamed Intersys Ltd.a Pakistani company engaged in fraud targeting the US. The companys employees charged fees for services that did not actually exist.
The companys founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace.
We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain evidence of Azneem Bilwanis illegal activities.
Will be published soon... | Severity: HIGH | Size: 1.5 TB | Status: selling | $100,000
eTeam
September 24, 2026
•[ ransomware, leak, technology ]
eTeam was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Revenue: Revenue: $229 million
eTeam Inc. is a privately held global workforce solutions and business transformation company. Founded in 1999 by Ben Thakur, the company is certified as a Minority Business Enterprise (MBE). It has grown from a boutique IT staffing agency into a massive global network, managing thousands of internal employees and contract workers across continents. We successfully exfiltrated all employee records (15K), including full names, email addresses, home addresses, DOBs, SSNs, phone numbers, contracts, managers, hire dates, salaries and more. We engaged with eTeam privately some time back, and now we are going public with the announcement as eTeam was negligent of the incident that took place then. We're giving you one more chance. Speak soon or leak soon!
Solucioning S.A.
September 24, 2026
•[ ransomware, leak, energy ]
Solucioning S.A. was listed as a victim on the leak site of the Barracuda ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Argentina. This is a small company of 4-5 people, yet it has big clients in the oil production sector.
Unfortunately, the company neglected data security, allowing us to gain access to all their confidential files - projects, documents, blueprints, and so on.
The company has been ignoring us for five days now, and we will soon publish their files. This is a warning. We do not wish to harm anyone, but we are prepared to inflict maximum damage.
Victim website: https://www.solucioning.com/ | Severity: HIGH | Size: 463 GB | Status: selling | $100,000
