Giti Corp
September 18, 2026
•[ ransomware, manufacturing ]
Giti Corp was listed as a victim on the leak site of the killsec ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: Singapore. Website: giti-corp.com.
ANYTHINGIT
September 18, 2026
•[ ransomware, technology, government ]
ANYTHINGIT was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Website: www.anythingit.com. Certified IT Asset Disposition (ITAD) and e-waste management for federal agencies, defense contractors, and enterprise organizations demanding the highest chain-of-custody standards.
AT&T
September 18, 2026
•[ ransomware, technology ]
AT&T was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: United States of America. Website: att.com. Revenue: $125.6 billion
Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!
Accela.com
September 18, 2026
•[ ransomware, government, technology ]
Accela.com was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: United States of America. Website: Accela.com. Revenue: $144.4 million
Accela is a comprehensive cloud based software platform used by state and local governments to manage internal agency operations. We have successfully extracted over 50 GB of data from Accela. Data includes over 2 million lines of user data with PII, and 6 million user requests (from their citizen engagement portal where citizens report everyday non-emergencies in/around their neighbourhoods) also with PII. There is a lot of government data, from FBI agents to cops to regular government workers. Speak soon or Leak soon!
First Secure Bank and Trust
September 18, 2026
•[ ransomware, finance ]
First Secure Bank and Trust was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: firstsecurebank.com. First Secure Bank and Trust was founded in Palos Hills, Illinois in 1977 to serve the financial needs of the company's friends and neighbors. Today, the company is still in the neighborhood and continuing with that mission. The company is the only "true" locally owned bank in the area. The company care about the community because the company live here, too. This local knowledge and commitment gives the company a tremendous advantage when it comes to helping you with your financial needs. Other nearby bank branches have headquarters miles away and employees that move from location to location as the need arises. The company is always here to listen to you and then use the company's years of experience to help you achieve your financial goals, whether it is a simple free checking account or sophisticated investment advice. The company will always give you the right service-right here, right now.
The company headquarters is located in 10360 S Roberts Road, Palos Hills, IL 60465, United States. 11-50 Employees
The State Bank
September 18, 2026
•[ ransomware, finance ]
The State Bank was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: thestatebankgroup.com. The State Bank Group is comprised of Wonder Lake State Bank (east), Wonder Lake State Bank (west), Johnsburg State Bank, Spring Grove State Bank, Lakemoor State Bank and Hebron State Bank. The company is proud to have directorship of local business owners and professionals. It has always been the company's focus as a community bank to provide the best banking services available. The company has selected the company's banking locations by identifying areas that were at the time unserviced. Therefore, each of the company's bank locations represents the first bank in their respective community. The company's group of banks has grown since the company's inception in 1979. The company currently have a staff of more than 80 employees. In addition to myself, the company has a teller who has been servicing the company's customers banking needs since 1979. The company thrive on building relationships with the company's customers and believe the company's slogan, "Bank Where You're Known", promotes the company's continuing mission and commitment to providing true "Community Banking". The company's extended lobby and drive-up hours provide the company's customers with the most flexible banking hours in McHenry County. All of the company's locations are full service banks, staffed with loan officers and new accounts representatives. In addition, all the company's locations have safe deposit boxes. Each of the company's loan officers have "real" lending authority, meaning that you will always be dealing with the decision makers. This makes your experience both personal and efficient. To the company's customers who are visiting the company's web site, "Thank You Very Much". If you are not currently a customer, the company invite you to "Bank Where You're Known".
The company headquarters is located in 7526 Hancock Drive, Wonder Lake, IL 60097, United States.11-50 Employees
Johnson Investment Counsel
September 18, 2026
•[ ransomware, finance ]
Johnson Investment Counsel was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: johnsoninv.com. Johnson Investment Counsel is an independent, employee-owned wealth management firm founded in 1965 and headquartered in Cincinnati, Ohio. The company provides comprehensive financial services to individuals, families, businesses, corporations, retirement plans, foundations, and nonprofit organizations. Its services include investment management, financial planning, retirement and cash-flow planning, estate planning, trust services, charitable planning, and business solutions. Johnson Investment Counsel operates as a fee-only Registered Investment Advisor and emphasizes fiduciary responsibility, long-term relationships, and customized financial strategies. As of June 30, 2026, the firm manages approximately $23 billion in assets and has 159 employees, serving clients across all 50 U.S. states.
The company headquarters is located in 7755 Montgomery Road, Suite 180, Cincinnati, OH 45236, United States.51-200 Employees
American Casting Company
September 18, 2026
•[ ransomware, manufacturing, technology ]
American Casting Company was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: americancastingco.com. American Casting Company is an ISO 9001 and AS9100 certified investment casting foundry located in Hollister, California, specializing in premier quality investment castings for the aerospace and medical industries. The company offers a variety of castings made from super alloys and other high-performance materials, ensuring the industry's shortest lead times through advanced manufacturing processes, including 3D printing and vacuum melting. Their services include design for manufacturability, NADCAP heat treating, and non-destructive testing, catering to clients in sectors such as medical, aerospace, defense, and industrial applications. With a focus on innovation and quality, American Casting Company commits to delivering precise, durable, and strong investment castings perfect for complex geometries.
The company headquarters is located in 205 Apollo Way, Suite A, Hollister, CA 95023, United States. 51-200 Employees
Inland and Offshore Contractors
September 18, 2026
•[ ransomware, energy ]
Inland and Offshore Contractors was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Energy & Utilities. Country: Trinidad & Tobago. Website: www.iocltt.com.
Grupo Juste
September 18, 2026
•[ ransomware, healthcare ]
Grupo Juste was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Mexico. Website: www.grupojuste.com.
Futuro Forestal
September 18, 2026
•[ ransomware, manufacturing ]
Futuro Forestal was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Chile. Website: www.futuroforestal.com.
Ceres Tolvas
September 18, 2026
•[ ransomware, manufacturing ]
Ceres Tolvas was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Argentina. Website: www.cerestolvas.com.ar.
Ascend Com
September 18, 2026
•[ ransomware, technology ]
Ascend Com was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Singapore. Website: www.ascendcom.com.sg.
www.kendallhunt.com
September 18, 2026
•[ ransomware, education ]
www.kendallhunt.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: www.kendallhunt.com. Founded in 1944, Kendall Hunt Publishing is a publisher of hands-on, inquiry-based science, mathematics, and gifted curricula for grades PreK-12. Their research and standards-based programs are available in both print and digital components that encompass students, teachers, and parents. Kendall Hunt is headquartered in Dubuque, IA.
www.roancampingholidays.com
September 18, 2026
•[ ransomware, retail, leak ]
www.roancampingholidays.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Hospitality. Country: Netherlands. Website: www.roancampingholidays.com. Roan Luxury Camping Holidays is a Dutch tour operator specializing in deluxe mobile home and tent rentals at 4- and 5-star campsites across Europe
Anderson Industries
September 18, 2026
•[ ransomware, manufacturing, financial ]
Anderson Industries was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: anderson-industries.com. Anderson Industries is a cutting-edge engineering and manufacturing company that assists forwar
d-thinking businesses in bringing innovative products to market. They offer a range of products
including agricultural equipment, trailers, and foundry services.
We will upload 9gb of corporate data soon. Employee personal information, client information, l
ots of projects, specifications, orders, financials, NDAs and so on.
United Federation of Teachers
September 18, 2026
•[ ransomware, education ]
United Federation of Teachers was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: uft.org. Education / Labor Union US New York | The unions complete legal case archive approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named for a member; Contract documents: CBAs, MOUs, MOAs and side letters; Nurse-federation and health-benefit-fund case materials; Teacher evaluation and class-size complaint files; Staff search and case-view audit logs | Publication proceeds in batches after the deadline. The victim can verify everything and settle in their private negotiation room. | [ACTIVE: deadline 2026-09-19 14:58 UTC]
BeLi Teacher / FSC education centers (AWS)
September 18, 2026
•[ ransomware, education, technology ]
BeLi Teacher / FSC education centers (AWS) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: Vietnam. Website: beliteachers.com. Education / edtech Vietnam | The complete CRM lead database: 152,044 contact records names, emails, +84 phone numbers, cities, study interests, engagement history; The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 02:47 UTC]
AstraZeneca Türkiye
September 18, 2026
•[ ransomware, healthcare, manufacturing ]
AstraZeneca Trkiye was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: Turkey. Website: astrazeneca.com.tr. Pharmaceutical manufacturing (GxP) Trkiye | Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings; 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications | All sites are enforcing a total network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Argentem Creek Partners (investment firm)
September 18, 2026
•[ ransomware, finance, technology ]
Argentem Creek Partners (investment firm) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: argentemcreek.com. Investment management / private credit United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
