Nam Dinh Vu Port (container terminal operations)
October 12, 2026
•[ ransomware, leak, manufacturing ]
Nam Dinh Vu Port (container terminal operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Vietnam. Port terminal operations / maritime logistics Vietnam | The full EDI message archive of the terminal's operations server: vessel schedules, container manifests (BAPLIE), gate movement records (CODECO), booking messages (COPARN) covering multiple international shipping lines; Internal system configuration files of the operations server | [NOT PAID EXPOSED: files publish 2026-10-19 13:19 UTC]
NCT Kandla (container terminal operations)
October 12, 2026
•[ ransomware, leak ]
NCT Kandla (container terminal operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: India. Port terminal operations India | Operational EDI correspondence and internal systems logs | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
HPC Hamburg Port Consulting (port operations)
October 12, 2026
•[ ransomware, leak, manufacturing ]
HPC Hamburg Port Consulting (port operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Germany. Port consulting / terminal operations Germany | Operational EDI archives and cargo/bill-of-lading records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
CULines (container shipping)
October 12, 2026
•[ ransomware, technology, manufacturing ]
CULines (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: China. Container shipping China | Operational EDI message archives (booking and container manifest records) | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Premier Alliance (shipping network operations)
October 12, 2026
•[ ransomware, leak, transportation ]
Premier Alliance (shipping network operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Netherlands. Shipping / terminal services Netherlands | Terminal network documentation and operational EDI archives | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Ocean Network Express (container shipping)
October 12, 2026
•[ ransomware, financial ]
Ocean Network Express (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Singapore. Container shipping Singapore | Internal staff directories, operational voyage and fuel-consumption records, and financial-adjacent planning material | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
GlobalNet LCL (port agency operations)
October 12, 2026
•[ ransomware, leak ]
GlobalNet LCL (port agency operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Indonesia. Port agency / logistics Indonesia | Container gate movement and damage management records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
DFK Group
October 13, 2026
•[ ransomware, finance ]
DFK Group was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Germany. Website: www.dfkgroup.de. Germany
The Buckner Company, Inc.
October 13, 2026
•[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
PG Group (Pure Options)
October 13, 2026
•[ ransomware, finance, retail ]
PG Group (Pure Options) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. cannabis operator (US) Lansing, Michigan, USA | Complete directory database of a Michigan cannabis operator: password data for all 577 accounts; Working password corpus for dozens of staff and administrator accounts; Financial and contract backups: payroll reports, general ledgers, signed operating and lease agreements; Complete inventory of the shared data volume | [NOT PAID EXPOSED]
Wolf & Sofsky GmbH
December 10, 2025
•[ ransomware, manufacturing ]
Wolf & Sofsky GmbH was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-12-10. Sector: Manufacturing. Country: Germany. Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrcken, Germany. The company operates on highly complex projects and maintains a significant financial position.
Critical Information We Possess
Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company.
Commercial Information: Contracts with clients, commercial offers, contract terms these form the foundation of Wolf & Sofsky's competitive advantage.
Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation.
Technical Assets: Technical plans, project drawings, architectural solutions the company's unique intellectual property.
Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects.
Excess Baggage
October 5, 2026
•[ ransomware, leak ]
Excess Baggage was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.excess-baggage.com. Baggage Express is a dynamic national and international excess baggage shipping company with a heritage stretching back some 25 years. We're dedicated to the task of moving the holdalls, cartons, computers, bikes, luggage and material lives of students, backpackers, expats and anyone else who has found themselves in the UK needing their belongings sent elsewhere. Flexibility is the key to the company's success, tailoring the company's baggage shipping services to the specific individual needs of the company's customers.
Watermark Retirement Communities
August 24, 2026
•[ ransomware, healthcare, leak ]
Watermark Retirement Communities was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Healthcare. Country: United States of America. Website: watermarkcommunities.com. [AI generated] Watermark Retirement Communities is a U.S.-based senior living company that develops, manages, and operates retirement communities offering independent living, assisted living, memory care, and skilled nursing services. Headquartered in Tucson, Arizona, it operates numerous communities across the United States. The company belongs to the senior care and hospitality-adjacent real estate industry, focusing on resident-centered lifestyle programming and care.
Merrill Iron & Steel
August 13, 2026
•[ ransomware, manufacturing ]
Merrill Iron & Steel was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-13. Sector: Manufacturing. Country: United States of America. Website: merrillsteel.com.
Palma
October 6, 2026
•[ ransomware, manufacturing, leak ]
Palma was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: palmainc.com. palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy flooring manufacturer and installer founded in 1927 in Whippany, New Jersey now in its third generation (CEO Fred Palma III). It generates estimated annual revenue of $2542M with only ~1015 direct employees (heavy use of subcontractors), completing millions of square feet of industrial flooring over 99 years. The company is a rare single-source formulator/applicator it develops its own products (PalmaLite, PaliKrete, PaliFlake) and installs them, with every square meter personally approved by a family member. Its average project size is $15.3M (Procore data: 122 projects, 76 active simultaneously), serving auto dealerships, jails, hospitals, chemical plants, and government facilities across the U.S. and Canada. Key differentiators: 5-year industry-leading warranty, no membrane required (3040% cost savings), and full ASTM C722-89 compliance. The company's name "A Palma, Manton, Palma Co
The Law Office of James R Walsh
October 6, 2026
•[ ransomware, leak ]
The Law Office of James R Walsh was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Country: United States of America. Website: jrwalshlaw.com. jrwalshlaw.com The Law Office of James R. Walsh is a small plaintiff-side law firm in Lynnwood, WA (north of Seattle), specializing in workers' compensation (L&I claims), personal injury, maritime, and Social Security cases. Founder James R. Walsh (admitted 1981) has practiced for 44+ years and was named to "Top Attorneys of North America 2015-16." The firm fights for injured workers against Washington's Dept. of Labor & Industries and self-insured employers, with published precedents including Elliott v. L&I (2009) and ITT Rayonier v. Dalman (1992). It acts as a talent incubator attorney Joshua L. Hughes (UW Law, JD with honors) rose from paralegal (2017) to attorney (2022), following the path of earlier associates.
Potomac Animal Hospital
October 6, 2026
•[ ransomware, healthcare ]
Potomac Animal Hospital was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Healthcare. Country: United States of America. Website: potomacanimalhospital.com. potomacanimalhospital.com zoominfo.com/c/potomac-animal-hospital/183255483 Potomac Animal Hospital is a family-owned, full-service small animal medical and surgical facility at 10020 River Road in Potomac, Maryland, an affluent Washington, DC suburb, founded in 1973 and led since 1983 by Air Force veteran Dr. Michael Scott (CSU DVM 1969; former officer in charge of the Europe Military Working Dog Referral Center in Ramstein). His son Dr. Jason Scott joined in 1999 hooded at graduation by his father exactly 30 years to the day after his own and now leads a team including Dr. Sarah Orloff (2021) and Dr. Kimber Wagner (2025); Dr. Michael retired in 2018 but remains owner. Beyond medicine (wellness exams, international health certificates, laser surgery, dentistry with digital oral radiography, in-house lab), the hospital runs a separate boarding kennel ($42.50$72.50/night, dogs exercised every 23 hours, VIP suites) and a grooming salon all powered through outages by an industria
Machine sro
October 6, 2026
•[ ransomware, manufacturing, automotive ]
Machine sro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Czechia. Website: k2machine.cz. k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~2550 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~4M), though 2024 saw a sharp 18.7% revenue decline (operating revenue 27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtn campus (since 2020).
University of Buraimi
October 6, 2026
•[ ransomware, education ]
University of Buraimi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: Oman. Website: uob.edu.om. uob.edu.om zoominfo.com/c/university-of-buraimi/464061196 University of Buraimi (UOB) is a private higher education institution founded in 2016 (originally College of Banking & Financial Studies, upgraded to university status in 2024) in Buraimi, Oman, just 5 minutes from the UAE border (Al Ain). Licensed by Oman's Ministry of Higher Education (MOHERI), it operates 4 faculties (Computing & IT, Engineering, Business, Health Sciences) with 11 departments offering programs in AI, cybersecurity, civil/electrical/mechanical engineering, nursing, architecture, business, and MBA. It serves ~5001,500 students from 40+ countries (3040% international) with ~5082 staff (PhD-holders from UK, USA, Canada, Malaysia). Tuition runs ~$6,00012,000/year with extensive scholarships. The university follows a US academic model, earned a spot in UI GreenMetric World Rankings 2025 (289th for sustainability), and is currently undergoing OAAA accreditation. Led by Chancellor HE Sheikh Saif Al-Mamari
Refako Autodele
October 6, 2026
•[ ransomware, manufacturing, retail ]
Refako Autodele was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Denmark. Website: refako.dk. refako.dk REFAKO ApS (Refako Autodele) is a Danish family-owned truck and trailer parts retailer founded in 1975 in Odense, Denmark, celebrating its 50th anniversary in 2025. It operates 13 stores nationwide with 200,000+ SKUs (290,000 for B2B) and employs 5970+ people. Annual gross profit is ~2627M DKK (~$3.7M), but the company has been loss-making for 6 consecutive years (20202025), with equity saved by owner injections (16.3M DKK in 2025) after hitting a crisis low of 2.7M in 2022. It turned operationally profitable in 2024 (+0.46M DKK) under new sole owner Klaus Allan Jrgensen (KJ Holding took 100% in May 2024), but slipped back into losses in 2025. Refako is Denmark's only authorized SAF-Holland partner (global leader in trailer axles/suspension) and carries premium brands like WABCO, Knorr-Bremse, JOST, Dinex, and Exide. Customer reputation is excellent Trustpilot 4.8/5 from 2,695 reviews with same-day shipping and 30-minute Click & Collect across its store network.
