Full List

Search

Search Results (Ransomware)

• Hygiena October 27, 2026 • [ ransomware, healthcare, hack ] Hygiena was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Healthcare. Country: United States of America. Website: www.hygiena.com. United States
• VPC Builders October 27, 2026 • [ ransomware, manufacturing ] VPC Builders was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Country: United States of America. Website: www.vpcbuilders.com. United States
• wagyu.xyz unfairness October 28, 2026 • [ ransomware, financial, technology ] wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence: 1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json). 2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json). Evidence to support this can be found below:
• Meleghy Automotive & Cie. GmbH October 28, 2026 • [ ransomware, manufacturing, automotive ] Meleghy Automotive & Cie. GmbH was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: Germany. Website: Meleghy Automotive & Cie. GmbH. [automotive] The exposed material includes: Passport/visa/student-admission dossiers Tesla Model Y/Opal tooling, CAD and DFM tree Employee contract and HR folders MEB/BMW NCAR metrology and plant-layout trees PLC/SPS/robot backups and cross-reference DBs TISAX/IATF audit and corrective-action records Restricted management meeting/WLAN record Browser profile SQLite databases
• Insurance Services October 28, 2026 • [ ransomware, finance, leak ] Insurance Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a uto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv es over 20,000 policyholders across Ontario. We will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs and other personal docs), projects (client personal information and other documents (~250 perso ns (DL numbers, name, addresses, phones and so on)), contracts and agreements, NDA, etc.
• Noelker and Hull October 28, 2026 • [ ransomware, financial, healthcare ] Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
• ClaimTek Systems October 29, 2026 • [ ransomware, healthcare, finance ] ClaimTek Systems was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Financial Services. Website: claimtek.com. ClaimTek Systems ClaimTek Systems specializes in preparing individuals for successful entry into the medical billing and practice management business with a comprehensive training and support system. They offer a range of scalable products and services, including state-of-the-art billing software and marketing tools, targeted towards aspiring entrepreneurs in the healthcare industry. More
• MAA Group Consulting Engineers October 29, 2026 • [ ransomware, technology, manufacturing ] MAA Group Consulting Engineers was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975, with over 1,000 professionals operating across East and Southeast Asia. The group provides comprehensive integrated solutionsranging from conceptual planning and engineering design to project managementacross infrastructure, buildings, land resources, environment, and information technology. Renowned for its industry-leading expertise in Building Information Modeling (BIM), MAA Group has successfully completed major high-speed rail, mass rapid transit (MRT), and tunnel projects throughout Taipei, Hong Kong, Bangkok, and Singapore. The client data and internal documents youve leaked go well beyond what youve seen here. We have taken several terabytes of filesthis is just a small sample. In fact, we have obtained sensitive documents pertaining to virtually all of your clients. Warning: You have 3 days to enter negotiations. Once the deadline passes, the negotiation window will be permanently closed and all exfiltrated data will be published. Additionally, the encrypted data will be rendered completely unrecoverable. sample files: https://mega.nz/file/CgxxTKCZ#PzGFlZt67HDF2oLsP4jn_W_QdrquHJpNAfVm-jXGYxo https://mega.nz/file/2ogzwAyY#r8F31SFQTqyW6bzQA-e8HNzgw-rEW_gn7fhwY5TAByg https://mega.nz/file/2gIRXQwY#-4IzU70FjqvSYotZoaJuod_H2P5sXoGTvsja9Patte0 https://mega.nz/file/alQU0JaT#2GgaPb1Z-z1xB1FfAd_NohXbfkbfRfhfZ_OwtxPd0cc [Sector: Construction]
• Programs for Parents, Inc. October 29, 2026 • [ ransomware, education ] Programs for Parents, Inc. was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Education. Country: United States of America. Website: www.programsforparents.org. Non-profit Organizations Stolen data: 95 GB.
• Udima October 28, 2026 • [ ransomware, education ] Udima was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Education. Country: Spain. Website: www.udima.es.
• corp-smart.com October 29, 2026 • [ ransomware, technology ] corp-smart.com was listed as a victim on the leak site of the everstake ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: corp-smart.com. Corporate Compliance
• lyserp.com October 29, 2026 • [ ransomware, technology, leak ] lyserp.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: www.lyserp.com. ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.
• Grupo Ciosa, SAPI de CV October 30, 2026 • [ ransomware, hack, automotive ] Grupo Ciosa, SAPI de CV was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Other. Country: Mexico. Website: www.ciosa.com.
• Light Rail Manila October 30, 2026 • [ ransomware, leak ] Light Rail Manila was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Transportation. Country: Philippines. Website: www.lrmc.ph.
• Richland Resources Corporation October 30, 2026 • [ ransomware, energy, hack ] Richland Resources Corporation was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Energy & Utilities. Country: United States of America. Website: rrcokc.com.
• Moritt Hock & Hamroff LLP October 30, 2026 • [ ransomware, finance, retail ] Moritt Hock & Hamroff LLP was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. [AI generated] Moritt Hock & Hamroff LLP is a United States law firm based in Garden City, New York. It provides legal services across practice areas including commercial finance, bankruptcy and creditors' rights, litigation, real estate, transportation law, labor and employment, and corporate matters. The firm operates within the legal services industry, representing businesses, lenders, and individuals, primarily serving clients throughout the New York metropolitan area and nationally.
• Aliqout Association October 30, 2026 • [ ransomware, technology ] Aliqout Association was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Country: United States of America. Website: aliquot.com. A multi-disciplinary civil engineering firm based in Walnut Creek, CA.
• Psychometrics Canada October 30, 2026 • [ ransomware, technology ] Psychometrics Canada was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: Canada. Website: psychometrics.com. A company that works in the science of objective assessments for over 35 years.
• ArentFox Schiff October 30, 2026 • [ ransomware, leak ] ArentFox Schiff was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. ArentFox Schiff LLP is a prominent national law firm and lobbying firm formed on March 1, 2022, throug
• NOVADATA October 30, 2026 • [ ransomware, technology, finance ] NOVADATA was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: Argentina. Website: novadata.com.ar. novadata.com.ar NOVADATA S.A. is an Argentine IT integration group founded in 1994 in Buenos Aires, comprising Novadata, Net Service and Compaa Global de Servicios with 130 plus certified professionals. It provides IT infrastructure, business continuity, AI, pay-per-use HPE GreenLake, microinformatics and 24/7 Service Desk services to major corporations across Argentina. It holds HPE Platinum, Microsoft Gold, Cisco Silver, VMware Enterprise and Symantec Gold partner certifications, adding Huawei Enterprise Authorized Reseller status in 2026. Major clients include Bayer, Veolia, La Annima, Petrobras, Citibank, Roche and Bimbo, many with over 10 years of partnership. The group completed a financial restructuring agreement from 2014, declared fulfilled by court in March 2026. Recent strategic moves include an AI alliance with AYI Group, Fortinet cybersecurity training and launch of Novadata GREEN IT asset disposition services.