J&D Financial
October 6, 2026
•[ ransomware, finance ]
J&D Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services. Website: www.jdfinancial.com.
CORBY ROCK MILL
October 6, 2026
•[ ransomware, manufacturing ]
CORBY ROCK MILL was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Ireland. Website: www.corbyrock.ie.
Michael K Shelby, CPA
October 6, 2026
•[ ransomware, finance, leak ]
Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi
ve range of tax and accounting services. They provide individual tax preparation, estate and tr
ust tax services, and business tax services, ensuring clients meet their tax obligations effici
ently.
We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs
, payment information), projects, client internal information and so on.
Kennametal
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
Morcon Developments
October 6, 2026
•[ ransomware, leak ]
Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A
I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi
October 6, 2026
•[ ransomware, manufacturing ]
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Turkey. Website: www.ciftay.com.tr.
Andersen Group
October 6, 2026
•[ ransomware, technology ]
Andersen Group was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services.
harborpacific.com
October 6, 2026
•[ ransomware, manufacturing ]
harborpacific.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Transportation. Country: United States of America. Website: harborpacific.com. Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs.
Employees: 20
Revenue: $5 Million
Phone Number: (425) 488-7131
acmestamping.com
October 6, 2026
•[ ransomware, manufacturing ]
acmestamping.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: acmestamping.com. Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs.
Employees: 20
Revenue: $5 Million
Phone Number: (412) 771-5720
Danser
November 1, 2026
•[ ransomware, manufacturing ]
Danser was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Other. Country: United States of America. Website: www.danserinc.com.
AmplifAI (GoDaddy instance)
November 1, 2026
•[ ransomware, leak, technology ]
AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump
================================================
URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7
============================================================
USER DATABASE 13,565 unique employees
============================================================
File: all_users.json
Fields per user:
"name": "",
"email": "",
"userseq": ,
"firstname": "",
"lastname": "",
"ad_id": "",
"password": "",
"aduser": "true/false",
"usertype": "1/2/3/4",
"employeenumber": ""
User Type Key:
1 = Admin
2 = Manager
4 = Agent
Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9
============================================================
ORGANIZATIONS 34 total
============================================================
1. Agent Dashboard Organizations
1. DEM Sales_Support - ALL
2. DEM Sales_Support - GDDY
3. DEM Sales_Support - TP
4. GD International Independents
5. GD US Independents
6. Commerce - GDDY
7. Commerce - TP
8. DEM Sales_Support - SGS
9. EMEA Brands - ALL
10. EMEA Brands - GDDY
11. EMEA Brands - TP
12. GAO - GDDY
13. GD Teleperformance
14. Global Messaging Ops - GDDY
15. Global Messaging Ops - Genpact
16. Global Messaging Ops - SGS
17. Global Messaging Ops - TP
2. Performance Dashboard Organizations
18. ROW Sales_Support - ALL
19. ROW Sales_Support - Genpact
20. ROW Sales_Support - SGS
21. Services - SGS
22. US Sales_Support - SGS
3. Analytics Organizations
23. Global Messaging Ops - ALL
24. ROW Sales_Support - TP
25. Services - ALL
26. Services - GDDY
27. Services - TP
28. US Sales_Support - ALL
29. US Sales_Support - GDDY
4. Non Core Care Organizations
30. US Sales_Support - TP
31. Non Core Care - GDDY
32. Non Core Care - Genpact
33. Non Core Care - SGS
34. Non Core Care - TP
============================================================
LOGIN LOGS 4,451 records
============================================================
File: login_logs.json
Fields per record:
"Name": "",
"Title": "",
"Module": "",
"Access Date": "",
"Access Time": "",
"Time Zone": "",
"Access Device": "",
"Primary Program": "",
"Organization": "",
"Location": "",
"Manager Name": "",
"OpsManager Name": ""
Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy
Sample devices: Desktop, Mobile
============================================================
ROSTER DATA 1,201 records (1,193 with @godaddy.com emails)
============================================================
File: roster.json
Fields per record:
"RosterExportID": "",
"companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8",
"employeeid": "",
"email": "",
"fname": "",
"lname": "",
"managerid": "",
"pbxid": null,
"location": "",
"primaryprogram": "",
"title": "",
"recorddate": "",
"hiredate": null,
"termdate": null,
"loginuserid": "",
"customfield1": null,
"customfield2": null,
"customfield3": null,
"customfield4": null,
"customfield5": null,
"customfield6": null,
"customfield7": null,
"customfield8": null,
"customfield9": null,
"customfield10": null,
"otherprogram1": null,
"otherprogram2": null,
"otherprogram3": null,
"otherprogram4": null,
"otherprogram5": null,
"otherprogram6": null,
"otherprogram7": null,
"otherprogram8": null,
"otherprogram9": null,
"otherprogram10": null,
"varcharemployeeid": "",
"varcharmanagerid": "",
"organization": "",
"movedToCosmos": "False",
"glidepathtitle": null,
"gltitleid": null,
"coach": null,
"programstartdate": null,
"RequestID": ""
Roster by Organization:
US Sales_Support - GDDY: 405 records
Global Messaging Ops - Genpact: 191 records
EMEA Brands - GDDY: 176 records
Commerce - GDDY: 135 records
DEM Sales_Support - GDDY: 103 records
ROW Sales_Support - SGS: 101 records
Commerce - TP: 41 records
Non Core Care - Genpact: 37 records
Services - TP: 12 records
----------------------------------------
TOTAL: 1,201 records
25 organizations have no roster data available.
============================================================
PROGRAMS 227 unique GoDaddy call center programs
============================================================
File: programs.json
Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services
============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================
Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)
AD User Identity Format:
"Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, username@godaddy.com, EMAIL format
Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie
November 1, 2026
•[ ransomware, healthcare, technology ]
fzmb GmbH, Forschungszentrum fr Medizintechnik und Biotechnologie was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Healthcare. Country: Germany. Website: www.fzmb.de.
deom.be
November 2, 2026
•[ ransomware, manufacturing ]
deom.be was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: Belgium. Website: deom.be. The company specializes in the distribution, installation, customization and maintenance of lifting equipment, truck-mounted cranes, forestry machinery and material-handling systems.
Laboratorios Roemmers SAICF
October 1, 2026
•[ ransomware, healthcare, manufacturing ]
Laboratorios Roemmers SAICF was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Healthcare. Country: Argentina. Website: roemmers.com.ar. Laboratorios Roemmers SAICF Argentina's #1 pharmaceutical company by revenue, with 1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries.
The exposed material includes:
4,207 employees' national identity numbers (CUIL) Argentina's equivalent of a Social Security Number combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce.
Psychotropic drug dispensing records employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data.
COVID-19 health tracking with clinical symptoms individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive.
Pre-employment medical exam results with full DNI (national identity document) numbers.
82 GB of drug formulations the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications.
193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain.
14 GB of internal drug pricing strategy and competitive intelligence
Dynamic Office Solutions
October 1, 2026
•[ ransomware, technology ]
Dynamic Office Solutions was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.dynamicos.co.uk.
Post Metal Recycling
October 1, 2026
•[ ransomware, manufacturing ]
Post Metal Recycling was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. Country: United States of America. Post Metal Recycling specializes in buying scrap metal from businesses and individuals, offering both ferrous and non-ferrous recycling services. They provide on-site scales for accurate measurements and facilitate various recycling options including yard drop-off, roll-off service, and site clean-up. The company emphasizes the environmental benefits of recycling, such as energy conservation and resource preservation. With a commitment to honesty and excellent customer service, Post Metal Recycling aims to create jobs and generate income through their operations.
VPNE
September 24, 2026
•[ ransomware, technology, leak ]
VPNE was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Technology. Website: .. A company that specializes in managing people, transportation and other services for its clients in various industries
Rimrock Foundation
October 1, 2026
•[ ransomware, healthcare ]
Rimrock Foundation was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Other. Country: United States of America. Website: rimrock.org. Rimrock is the largest drug and alcohol addiction treatment center in the region, offering a comprehensive range of services for adults dealing with substance use and co-occurring disorders. The organization approaches addiction as a holistic illness that affects an individual's emotional, physical, spiritual, and social well-being. Their innovative and compassionate care includes various treatment options such as inpatient and outpatient programs, counseling services, and specialized therapies. Rimrock aims to create opportunities for recovery and balance in the lives of those impacted by addiction and mental illness.
Terca
August 21, 2026
•[ ransomware, leak ]
Terca was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-08-21. Sector: Other. Country: Brazil. Website: www.terca.com.br. TERCA Zilli is a leading logistics operator in Esprito Santo, Brazil, offering innovative solutions and synonymous with logistical efficiency. The company provides a wide range of services including general warehousing, customs areas, and specialized storage for hazardous chemicals and vehicles. With a rich history and extensive experience, TERCA Zilli caters to diverse client needs while optimizing operations to reduce costs.
Raleigh Family Medicine
October 2, 2026
•[ ransomware, healthcare ]
Raleigh Family Medicine was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Healthcare. Country: United States of America. Website: www.rfppa.com. Hospitals and Health Care Stolen data: 1 GB.
