Horn of Africa Regional Environment Centre and Network
October 23, 2026
•[ ransomware, technology ]
Horn of Africa Regional Environment Centre and Network was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Other. Country: Ethiopia. Environmental NGO Ethiopia | The complete SAP Business One production database of the organization: 15,275 journal transactions with 89,929 journal lines, 1,007 business partner records of regional partner organizations with contacts, 333 general ledger accounts, procurement and inventory records; A verified full backup of the production ERP database and a fresh copy of the landscape database; The complete financial and operational record of a donor funded environmental organization | [NOT PAID EXPOSED]
Trevi Technology
October 23, 2026
•[ ransomware, technology ]
Trevi Technology was listed as a victim on the leak site of the Orova ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: Taiwan. Website: www.trevi.cc. 2017TreviTrevi-Fontana di Trevi
Aryza
October 23, 2026
•[ ransomware, technology ]
Aryza was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: Argentina. Website: www.aryza.com.
JB Hunt
October 23, 2026
•[ ransomware, technology, manufacturing ]
JB Hunt was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Transportation. Country: United States of America. J.B. Hunt is a major North American transportation and logistics company providing intermodal, dedicated, and truckload services via its digital freight marketplace.
We hold 140,838 employee records with PII and national IDs, 1.7M carrier contacts, 38.2M invoices, 187K RBAC permission records, 3,196 ranked account-takeover targets, 973 M365 mailboxes, 374K organizations.
Our demand: $5,000,000, in BTC or XMR. Instructions to follow by email.
To verify, samples can be found below.
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Whirlpool
October 21, 2026
•[ ransomware, manufacturing, leak ]
Whirlpool was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: United States of America. Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion.
We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public.
We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed.
Samples:
https://biteblob.com/Information/mNTP6w0lBW8P9l/#samples.zip
Contact:
whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
mlh.com.lb
October 23, 2026
•[ ransomware, healthcare ]
mlh.com.lb was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Professional Services. Country: Lebanon. Website: mlh.com.lb. Mount Lebanon Hospital University Medical Center (MLHUMC) is a healthcare institution that offers a...
whitearmor.cc
October 23, 2026
•[ ransomware, technology ]
whitearmor.cc was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Website: whitearmor.cc. Hi!
We now have a clearnet domain for easy-access.
WhiteArmor.cc
i2r Packaging Solutions Limited
October 8, 2026
•[ ransomware, manufacturing ]
i2r Packaging Solutions Limited was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. i2r Packaging Solutions Limited manufactures aluminium packaging and containers for the food industry. HQ: Capital House, Hadley Park East, Telford, Shropshire, TF1 6QJ, UK Phone: +44 845 371 5111...
Asisken Asistencia Médica S.A.
October 24, 2026
•[ ransomware, healthcare ]
Asisken Asistencia Mdica S.A. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Healthcare. Country: Argentina. health insurance administration Guayaquil, Ecuador | Identity and contact records of 139,006 named insurance clients, including identity document numbers and dates of birth; 383,159 policy beneficiary records with insured amounts; 402,988 medical and insurance claims with diagnosis codes and dollar amounts, current through 20 October 2026; Policy billing, home and work addresses and bank account details | [NOT PAID EXPOSED]
GPIC Projectos Con Instalacoes Lda
October 24, 2026
•[ ransomware, manufacturing, technology ]
GPIC Projectos Con Instalacoes Lda was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Portugal. engineering design and installations Portugal | The full project archive of an engineering design office, spanning 2000 through 2026, including tender submissions, client proposals and technical drawings; Project folders for named clients including hospital installations for a private hospital group; Scanned office documents with activity through October 2026; A company bank account document with the full IBAN and tax number; Staff curricula with photos and personal details | [NOT PAID EXPOSED]
MODON Developments S.A.E
October 24, 2026
•[ ransomware, manufacturing ]
MODON Developments S.A.E was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Egypt. Website: MODON Developments S.A.E. MODON Developments S.A.E. (MODON For Urban Development) is an innovative Egyptian real estate development and management...
Hisense
October 24, 2026
•[ ransomware, technology, leak ]
Hisense was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Technology. Country: China. Website: Hisense.com. Hisense is a Chinese multinational electronics and appliance manufacturer, founded in 1969, known globally for televisions and home appliances.
We hold Hisense's entire GCRM production document store, the full warranty-claims archive for Malaysia/Singapore: customer names, phones, emails, ID numbers, 2,549 suppliers, hundreds of invoices, payments, contracts, RMA forms, claim evidence, plus their internal CRM app binary.
Our demand is $500,000 in BTC. Good luck.
Contact: whitearmorrxd@proton.me
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Andrews Advisory Group LLC
October 25, 2026
•[ ransomware, healthcare, finance ]
Andrews Advisory Group LLC was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Financial Advisory & Restructuring (US) Chicago, Illinois, USA | Patient records with names and dates of birth from the patient database backup of December 2025 (3,698 records), taken from the office network; The complete patient database backup history, 2018 through 2025; More than 13,000 patient eye examination records with full ocular, medical and social history; OCT eye scan files from the imaging server on the network; Workstation profiles of office staff including stored system credentials | [NOT PAID EXPOSED]
Mach Law APC (San Diego family law and divorce practice)
October 25, 2026
•[ ransomware, leak, finance ]
Mach Law APC (San Diego family law and divorce practice) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Legal Services - Family Law (US) California, USA | Client case files of a San Diego family law practice: divorce, custody and support matters with California court filings (FL-150 financial declarations, FL-300 requests for orders, FL-335 proofs of service) and XSpouse support calculations; Client intake records with Social Security numbers and dates of birth; Client bank statements (Navy Federal, Discover and other institutions) and the practice trust account statements; Client billing roster with balances | [NOT PAID EXPOSED]
Technoleads Services Inc.
October 25, 2026
•[ ransomware, technology, hack ]
Technoleads Services Inc. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Technology. media production (audio description and accessibility media) Montreal, Quebec, Canada | Current 2026 client production files from your work in progress library, including active projects modified in October 2026; A job candidate resume with full personal contact details from your human resources records; Your archive of finished productions from 2016 through 2021, including a 2.1 GB demonstration archive; Internal technical documentation of your media production platform | [NOT PAID EXPOSED]
TOPLIVO AD
October 25, 2026
•[ ransomware, energy, leak ]
TOPLIVO AD was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Energy & Utilities. Country: Bulgaria. fuel trading and construction materials Bulgaria | The complete counterparty ledger of a fuel trading company: 694 companies with full legal names, addresses, managing persons, national company numbers, tax numbers and bank account details; More than 3,100 live customs and fuel movement documents from December 2025 through October 2026, and a 12 year archive of more than 46,000 documents from 2014 through 2025; Records of 611 drivers and 651 tanker trucks with registration plates; More than 2.6 million automated tank gauge readings from fuel storage tanks; Named staff accounts of the accounting system | [NOT PAID EXPOSED]
Astrana Health
October 25, 2026
•[ ransomware, healthcare, financial ]
Astrana Health was listed as a victim on the leak site of the Falcon ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Healthcare. Country: United States of America. Healthcare services NASDAQ: ASTH - Our 738 GB extraction includes internal documents, regulatory audit reports, payer financial dispute trackers, internal operational readiness reviews, acquisition pipelines, detailed reimbursement tables, internal system evaluations, regulatory notifications, funds transfer records showing liquidity status, company financial statements, user credential lists, client contact lists, employee PII decks and much more. Contacted us then timewasted, re-attacks incoming.
Weitz & Luxenberg
October 25, 2026
•[ ransomware, finance, healthcare ]
Weitz & Luxenberg was listed as a victim on the leak site of the Falcon ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Mass tort litigation law firm - Our 82 GB extraction includes confidentiality agreements, stipulations, NDAs, internal board documents, privileged attorney-client communications, client rosters detailing medical conditions and settlement eligibility, active-case strategy documents, liability estimations, mediation term sheets, internal financial data, settlement payout memos, detailed bankruptcy settlement summaries, regulatory correspondence, internal board minutes and much more. Contacted us then timewasted, re-attacks incoming.
Ooredoo Myanmar
October 25, 2026
•[ ransomware, technology ]
Ooredoo Myanmar was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Technology. Country: Myanmar. Website: www.u9.com.mm.
J.B Hunt
October 25, 2026
•[ ransomware, leak ]
J.B Hunt was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Transportation. Country: United States of America. You are so stupid JB Hunt. Instead of getting in contact with us & starting the negotiation process, not only did you not announce the breach, you silently email customers demanding them to update their passwords..
Fuck you... ;/
