Arkin Group
June 30, 2026
•[ ransomware, social, retail ]
Arkin Group was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Country: Turkey. Website: arkingroup.com. CYBERSECURITY: ARKIN HOTEL GROUP SUFFERS MASSIVE DATA BREACH OVER 1 TB OF GUEST AND CASINO DATA STOLENCybersecurity experts from Cyclops Threat Intelligence have reported a critical incident affecting the Arkn Group hotel chain (www.arkingroup.com), including its premium properties The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach in Northern Cyprus. According to preliminary assessments, the attackers managed to exfiltrate over one terabyte of internal documents, customer databases, and transaction logs, including confidential information from the Arkn Palm Beach Casino.Attack detailsAnalysts have established that the attackers gained initial access through a compromised employee account in the reservations department. Using legitimate remote administration tools, they gradually expanded their privileges, bypassed network segmentation, and exfiltrated a dataset totalling approximately 1.4 TB. Some of the stolen information has already surfaced on underground forums and darknet marketplaces.The stolen data includes: Full guest profiles (passport details, phone numbers, addresses, stay history); Financial details of bookings and payment credentials; The internal CRM system with staff notes on VIP clients; Casino database: player IDs, deposit amounts, visit frequency, records of chip exchange transactions and fund movements; Scanned passports, compliance check forms (KYC/AML), including source-of-funds questionnaires for high rollers.Objective and likely operatorBased on the intrusion characteristics and tactics used, experts link the incident to the threat group CryptoRex (tracked since 2023), which specialises in attacking hospitality and gambling businesses in the Mediterranean region. A combination of financial extortion and data sale to multiple buyers is considered likely. So far, no official ransom demand has been received, but portions of the archives have been put up for auction with a starting price of 8 bitcoins.Potential consequences of the leakThe leakage of confidential guest and especially casino client data entails a cascade of risks that go far beyond reputational damage.1. Personal security of high-net-worth guestsThe VIP casino player database, containing passport details, habits, and financial capabilities, serves as a direct directory for kidnappers, extortionists, and organised crime groups. Affected individuals may face real threats to their physical safety, as well as targeted blackmail (e.g., threats to expose gambling activity to business partners or family members in countries where gambling is stigmatised).2. Financial fraudPayment data from hotel guests and credit/debit cards linked to casino accounts will enable unauthorised transactions. Given the high credit limits of casino patrons, the scale of potential phishing and card fraud is assessed as very significant.3. Compliance nightmare and regulatory finesAlthough the international casino operators in Northern Cyprus do not directly fall under GDPR, many guests are citizens of the EU, the UK, and CIS countries. The breach demonstrates a flagrant failure to meet personal data protection standards. Lawsuits by affected individuals in national courts and scrutiny by international payment systems (Visa, Mastercard) are possible, which could suspend acquiring services.4. Risks to the casino itself and the jurisdiction[6/9/2026 1:09 PM] ChatGPT 5 | Deepseek | Claude: The exposure of internal AML records documenting the origin of funds and possible links to politically exposed persons could spark money-laundering investigations. For Northern Cypruss gambling zone, already under close watch by the FATF, this could lead to tighter international financial monitoring and being placed on grey lists.5. Reputational ruinNo wealthy client will entrust their data to a hotel incapable of protecting basic IT infrastructure. Trust in the Arkn brand, which for decades has built an image of secluded luxury, will be undermined for years. Competitors in the elite leisure market, especially in Dubai, Monaco, and the Maldives, will immediately exploit the situation to poach wary clientele.Analysts recommendationsCyclops Threat Intelligence strongly advises all individuals who have ever stayed at Arkn hotels or visited Arkn Palm Beach Casino to: Immediately block and reissue any bank cards used; Monitor credit reports for new applications; Enable additional authentication factors on email and financial services; Be highly critical of any incoming calls or messages demanding identity confirmation or fund transfers these could be targeted attacks using contextual details from the leaked staff notes.The Arkn Group press office has not yet responded to official inquiries. The companys website remains operational, but online booking sections are temporarily unavailable. Northern Cyprus authorities stated that they are aware of the incident and have begun consultations with EU experts under a cyber-resilience programme.Report prepared by the Thomson Reuters cybersecurity desk based on the Cyclops Threat Intelligence analytical brief.
About Todd Hamaker & Johnson
June 30, 2026
•[ ransomware, finance ]
About Todd Hamaker & Johnson was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Todd, Hamaker & Johnson, LLP is a professional tax and accounting firm based in Lufkin, Texas,
dedicated to providing personalized services to both individuals and businesses. The firm offer
s a comprehensive range of services including tax, accounting, audit, and financial guidance.
We will upload 40gb of corporate data soon. Lots of client and employee personal information (p
assports, SSNs, DLs and other information), detailed financials, client financials and other co
nfidential client docs, contracts and agreements, etc.
Pirámide Seguros
June 30, 2026
•[ ransomware, finance ]
Pirmide Seguros was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Financial Services. Country: Venezuela (Bolivarian Republic of). Website: segurospiramide.com.
Spector and Lenz, PC
June 22, 2026
•[ ransomware, healthcare, finance ]
Spector and Lenz, PC was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-22. Sector: Professional Services. Country: United States of America. Website: spectorandlenz.com. Firm provides legal representation to clients facing disability, injury, or serious illness
Roger D. Mason II, P.A.
April 16, 2026
•[ ransomware, legal, finance ]
Roger D. Mason II, P.A. was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-04-16. Sector: Professional Services. Country: United States of America. Website: flautolawyer.com. Florida Auto Dealership Fraud Attorney
CrediElite
May 1, 2026
•[ ransomware, finance ]
CrediElite was listed as a victim on the leak site of the fulcrumsec ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Financial Services. Country: United States of America. Website: credielite.com.
MCO
May 1, 2026
•[ ransomware, finance ]
MCO was listed as a victim on the leak site of the fulcrumsec ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Financial Services. Country: United States of America. Website: mycomplianceoffice.com. [AI generated] N/A
The acronym "MCO" is too ambiguous to identify a specific company with confidence. Multiple organizations share this abbreviation across different industries and countries. Please provide additional context such as the full company name, industry, or country of operation to allow for an accurate and reliable description.
youX / Drive IQ
May 1, 2026
•[ ransomware, technology, automotive ]
youX / Drive IQ was listed as a victim on the leak site of the fulcrumsec ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Technology. Country: Australia. Website: youxpowered.com.au. [AI generated] youX, formerly known as Drive IQ, is an Australian technology company specializing in connected vehicle data and mobility intelligence. The company collects and analyzes telematics and driving behavior data to deliver insights for insurers, fleet operators, and automotive businesses. Its platform enables usage-based insurance and risk assessment solutions. youX operates primarily in Australia and positions itself within the insurtech and automotive data analytics sectors.
TSYS
May 2, 2026
•[ ransomware, finance, technology ]
TSYS was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-05-02. Sector: Financial Services. Country: United States of America. Website: tsys.com. [AI generated] TSYS, or Total System Services, is a US-based payment solutions company headquartered in Columbus, Georgia. It operates in the financial technology and payment processing industry, providing services such as credit and debit card processing, merchant services, and payment management solutions to financial institutions, businesses, and consumers worldwide. TSYS became a subsidiary of Global Payments following a merger in 2019.
arc-reins.com + fidelityunited.ae
May 1, 2026
•[ ransomware, finance, financial ]
arc-reins.com + fidelityunited.ae was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Financial Services. Country: United Arab Emirates. Website: fidelityunited.ae. We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets.
cgcsa.co.za
May 3, 2026
•[ ransomware, leak, finance ]
cgcsa.co.za was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-03. Sector: Professional Services. Country: South Africa. Website: cgcsa.co.za. endor & Corporate Data ( Name-Email-Numbers/PMS NAME ), Financial Accounting Records , sales Order Reports , Database Systems , SQL Server , Sage 200 Evolutuion SQL, operational Security Data Full Sage 200 Evolution backups including all transaction history, tax records, and payroll.CRM & Legal Archives Over 151,000 sensitive documents, contracts, and internal communications from the CRM database.Full access to GS1 South Africa SharePoint, including GDSN protocols and partnership data with global entities like Unilever, Nestle, and L'Oreal.Complete PII (Personally Identifiable Information) of administrative staff and executive members, including private emails and mobile numbers.
Cult Wines
May 4, 2026
•[ ransomware, retail, finance ]
Cult Wines was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-04. Sector: Hospitality. Country: United Kingdom of Great Britain and Northern Ireland. Website: cultwines.com. Cult Wines is revolutionizing the fine wine industry by leveraging expertise, digital platforms, and innovative technology to enhance the buying, selling, investing, and collecting experience for producers and consumers. Their services support the entire life cycle of fine wine, ensuring transparency and secure transactions. Recognizing fine wine as a unique investment, Cult Wine Investment provides clients with a wealth of possibilities, combining heritage with cutting-edge technology to enrich portfolios and enhance lives. Targeting both new generations of wine drinkers and seasoned collectors, Cult Wines aims to build a global community around fine wine appreciation.
Standard Bank Group
February 27, 2026
•[ ransomware, leak, finance ]
Standard Bank Group was listed as a victim on the leak site of the PrinzEugen ransomware group; the attack is estimated to have taken place on 2026-02-27. Sector: Financial Services. Country: South Africa. Website: standardbank.com. Beginning on February 27th 2026, The 3 week long attack on both Standard Bank and Liberty has resulted in 1.2TB of data being exfiltrated from internal servers.
Rizzuto Law Firm
May 4, 2026
•[ ransomware, finance ]
Rizzuto Law Firm was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-04. Sector: Professional Services. Country: United States of America. Website: www.rizzutolawfirm.com.
Foxstone Financial
May 4, 2026
•[ ransomware, finance ]
Foxstone Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-04. Sector: Financial Services. Country: Australia. Website: www.foxstonefinancial.com.
Studio Marchi - Studio Professionale Associato
May 5, 2026
•[ ransomware, finance ]
Studio Marchi - Studio Professionale Associato was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Professional Services. Country: Italy.
Adelante Soluciones Financieras (Addi.com)
May 5, 2026
•[ ransomware, finance, leak ]
Adelante Soluciones Financieras (Addi.com) was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Financial Services. Country: Colombia. Website: Addi.com. Over 16M unique persons records containing significant PII, financial/transactions (credit cards), KYC and data from TransUnion and Experian (background checks) . The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Size: 518GB+ (compressed) | Updated: 5 May 2026 | SHA256: 520d50dc384fc474e419fdd19cb3517ed6ce778a187ae7d6f44b93ccef5687db
Punch & Associates Investment Management
May 5, 2026
•[ ransomware, finance, leak ]
Punch & Associates Investment Management was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Financial Services. Country: United States of America. Punch & Associates is a boutique investment advisory firm based in Edina, MN. They offer specia
lized investment advisory services tailored for private clients and institutions. The firm focu
ses on providing personalized financial strategies to meet the unique needs of their clients. W
ith a commitment to excellence, Punch & Associates aims to help clients achieve their financial
goals.
We will upload 10gb of corporate data soon. Detailed client personal information (passports, SS
Ns, DLs and so on for almost 80 ppl), employee personal files, lots of confidential files (fina
ncials and personal docs), contracts and agreements, projects, NDAs, etc.
Positiwise Infotech Pvt
May 5, 2026
•[ ransomware, technology, healthcare ]
Positiwise Infotech Pvt was listed as a victim on the leak site of the sinobi ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Technology. Country: India. Positiwise Software Pvt Ltd is a software development company based in India and the USA, specializing in a wide range of services including web development, eCommerce solutions, mobile app development, and custom software development. They cater to various industries such as healthcare, retail, real estate, finance, and hospitality, providing tailored solutions to meet specific business needs. With over two decades of experience, their team of top-tier developers is dedicated to delivering high-quality, scalable, and innovative software solutions. Positiwise aims to help businesses digitize their operations effectively while ensuring data security and timely project delivery.
Cazh.id
May 5, 2026
•[ ransomware, finance, technology ]
Cazh.id was listed as a victim on the leak site of the Icarus ransomware group; the attack is estimated to have taken place on 2026-05-05. Sector: Financial Services. Country: Indonesia. Website: bkdp.cazh.id. - User DB: 300,000 Users (Email, Hash, Phone, Address, DOB) for https://bkdp.cazh.id/.
- KYC Vault: 7,800 Government IDs + 4,200 Selfies (including "Hold-to-Face" ID selfies).
- 34 SQL Databases for associated schools (Students/Parents/Staff).
- Corporate/Financial: Full Investor Database + partner documents
- Collateral documents (Vehicle Registration Documents & Property Deeds)
- Billing Proofs
- Full src code of their services
Data stolen: PII, SOURCE CODE, KYC
