Gaedke & Partner Steuerberatung
September 22, 2026
•[ ransomware, finance, leak ]
Gaedke & Partner Steuerberatung was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: Germany. Data breach exposes accounting firm's client data.
Clark Hill
September 22, 2026
•[ ransomware, leak, healthcare ]
Clark Hill was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: United States of America. [AI generated] Clark Hill (Clark Hill PLC) is a full-service law firm headquartered in Detroit, Michigan, United States. It operates in the legal services industry, providing counsel across practice areas including corporate law, litigation, labor and employment, intellectual property, cybersecurity, government relations, and healthcare law. The firm serves businesses, governments, and individuals through multiple offices across the United States and internationally.
RECEITA FEDERAL DO BRASIL
September 23, 2026
•[ ransomware, government, finance ]
RECEITA FEDERAL DO BRASIL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: Brazil. MINISTRIO DA FAZENDA
SECRETARIA DA RECEITA FEDERAL DO BRASIL
The archives contain several thousand documents with personnel and customer data,
as well as all user date on gov.br with passwords. [Sector: Finance]
Lemon Law
September 23, 2026
•[ ransomware, leak, finance ]
Lemon Law was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Country: United States of America. Virginia A Lemon PLLC
267 Stratton Aly, Lewisburg, West Virginia, USA
vlemonlaw.com
Leaked data: 16.8 Gb, 42 files
corporate documents, litigation materials, client personal data, financial documents and reporting, personal files of employees, and much more.
Legis
September 23, 2026
•[ ransomware, technology, finance ]
Legis was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Professional Services. Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More
goldstarfinancial.com
September 23, 2026
•[ ransomware, finance ]
goldstarfinancial.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Financial Services. Country: United States of America. Website: goldstarfinancial.com. [AI generated] N/A
I don't have reliable, verified information about a specific company operating at "goldstarfinancial.com." There are multiple businesses that have used similar "Gold Star Financial" naming conventions in different jurisdictions (this is a fairly generic name used by mortgage brokers, lending companies, and financial services firms in various countries), so I cannot confidently confirm which specific entity this domain refers to, its current operational status, ownership, or verified business details without risking inaccurate attribution.
If you can provide additional context (such as the specific country, registration details, or services advertised on the site), I can help assess it more accurately. Alternatively, if this is for threat intelligence purposes, I'd recommend verifying details through domain registration records (WHOIS), business registries, or regulatory filings relevant to
agiliance.fr
August 18, 2026
•[ ransomware, finance, hack ]
agiliance.fr was listed as a victim on the leak site of the ZaWoo ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Professional Services. Country: France. Website: agiliance.fr. Agiliance is a French accounting and business advisory group headquartered across the Haute-Sane and Doubs regions. Its website describes Agiliance as the result of bringing together 8 small-to-medium-sized accounting firms, combining their expertise and tools while retaining a local, client-oriented approach.
Revolut
September 24, 2026
•[ ransomware, finance, leak ]
Revolut was listed as a victim on the leak site of the ImNotAVillain ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: revolut.com. Revolut data on sale. Contact information at the bottom of the page.
Includes 680 high-value networth users.
Inversiones Bolívar
September 24, 2026
•[ ransomware, finance ]
Inversiones Bolvar was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Financial Services. Country: Colombia. Website: www.proyectosdevida.com.
NEAD Pro
September 24, 2026
•[ ransomware, finance, legal ]
NEAD Pro was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-24. NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services.What it is: a network share belonging to two Italian professional firms located at Via Roma 20, Gorizia (Friuli-Venezia Giulia):NEAD SRL (NORTH EAST ADVISORS S.R.L.) - an accounting firm, dottore commercialista, P.IVA 01114220310, REA GO-72906;NEAD PRO - PROFESSIONISTI RIUNITI - a law firm, P.IVA 01157140318.Volume: ~575,000 files / ~253 GB. The root contains a single branch Nuova directory\NEAD\ (plus an empty Documenti folder and a scatter of PDF scans at the root level).Structure and contents:Branch Volume ContentsNEAD PRO SITE - Documenti 231,137 files / 193.5 GB Law firm: 03.PRATICHE (46,620 files: CIVILE 9,665, PENALE 537, SOVRAINDEBITAMENTO 1,208), 04. INCARICHI (85,321: FALLIMENTI 22,492, ESECUZIONI 28,509, ADS 14,547, TRUST, CURATELE), SEGRETERIA with CREDENZIALI VARIE.xlsx (~40 firm accounts: SPID, PEC, banks, 2 cards with full PAN+CVC, safe code), bank scans (BANCOMAT PIN, BCC agreements)NEAD SRL SITE - Documenti 101,125 / 55.3 GB Accounting firm: 03.CLIENTI - 199 active + 184 former client folders (730, CU, F24, contracts), 44 private SOGEI Entratel .P12 keys (signing clients' tax returns), ISA/IRAP tax filings 20192020, client master data, Account.xlsxPRIMA NOTA - Documenti 1,885 / 871 MB Cash books 20192026 (21 xlsx): CASSA / CONTO CORRENTE / POS / CARTA / SISTERPOWERBI - Documenti 548 / 627 MB 37 financial BI models .pbix (BI_ISIDE, BI_NEAD, ATHENA, PNAI)ARCHIVIO 921 / 2.6 GB MPS bank statements 20202024, NEAD SRL account closure, firm mail archivePOSTA SARDAMAR / PANEGIOCHI / ISIDE / ADMIN SRL ~165+ / ~174 MB Client and firm mail: IVECO Capital leasing, accertamento Agenzia Entrate, Capitaneria di Porto, verbali poliziaES. IMM. 112-2024 10 files Real-estate enforcement proceedings (Tribunale di Gorizia): bank statements and CIE (ID cards) of auction participantsNEAD root ~85 PDF / 127 MB Scanned bank statements, F24 forms, IPZS envelope with the PIN/PUK of a CIE cardMost sensitive data: client dossiers with tax codes (codici fiscali), court case files (civil/criminal/bankruptcy), medical documents (Art. 9 GDPR), the firm's credential database with full PAN+CVC of two cards and the safe code, 52 Entratel electronic signature keys, ~100 SEPA mandates with IBANs and signatures, client PST archives (7.5 GB), a client's Huawei phone backup (Facebook/Gmail/Telegram databases), passports of foreign shareholders. More
Armada Credit Bureau
September 24, 2026
•[ ransomware, finance ]
Armada Credit Bureau was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Financial Services. Country: Uganda. Website: www.armadacrb.co.ug. Armada Credit Bureau Limited is a duly licensed credit reporting and analytics company
taspenlife.com
September 22, 2026
•[ ransomware, leak, healthcare ]
taspenlife.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Healthcare. Country: Kazakhstan. Website: taspenlife.com. Taspen Life offers a range of insurance products including health protection, group protection, and...
Majani Insurance Brokers
September 25, 2026
•[ ransomware, finance ]
Majani Insurance Brokers was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Financial Services. Country: Kenya. Website: majaninsure.com. Majani Insurance Brokers is an independent insurance broker serving both businesses and individuals. It arranges insurance products across areas including general business insurance, motor, medical, life, investment, marine, liability, property and agricultural-related covers
Reliance Audit
September 25, 2026
•[ ransomware, finance ]
Reliance Audit was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Professional Services. [AI generated] N/A
I don't have verified, reliable information about a specific company named "Reliance Audit." This name is generic and could refer to multiple small firms or local audit/accounting practices in different countries, so I cannot confirm details about its services, industry positioning, or country of operation without risking inaccurate information.
Tobin & Company
September 25, 2026
•[ ransomware, finance ]
Tobin & Company was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Financial Services. Country: United States of America. Website: tobinandco.com. Tobin & Company, CPAs is a small accounting firm based in Harrison, New York, providing accounting, tax, auditing, and business consulting services, with a particular focus on nonprofit organizations.
PKF Hadiwinata
September 25, 2026
•[ ransomware, finance ]
PKF Hadiwinata was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Professional Services. Country: Indonesia. Website: pkfhadiwinata.com. PKF Hadiwinata is a top-10 accounting and professional services firm in Indonesia, headquartered in the financial district of Jakarta. Founded in 1987, it is a member of PKF International and provides audit, tax, business solutions, and consulting services.
FTAPI Software
September 25, 2026
•[ ransomware, technology, healthcare ]
FTAPI Software was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Technology. Country: United States of America. Website: ftapi.com. ftapi.com zoominfo.com/c/ftapi-software/346927067 FTAPI (founded 2010, Munich, Germany) is a software company offering a secure, GDPR-compliant platform for exchanging sensitive business data and automating workflows encrypted email and file transfer, virtual data rooms, digital forms and no-code process automation. It serves 2,000+ organizations and over a million users, mainly in public administration, healthcare, insurance and industry, with all data hosted exclusively in Germany under strict certifications (ISO 27001, BSI C5, SOC 2) and optional zero-knowledge encryption. Its core selling point is European digital sovereignty a compliant alternative to US cloud tools like Dropbox under GDPR, NIS-2 and DORA regulations. In 2025 it raised 65 million from PE investors Armira and Tikehau Capital, which took control to fund EU expansion and acquisitions. The company employs around 150 people and targets becoming a leading European player in secure data exchange by 202829.
Ligue se Grupo
September 24, 2026
•[ ransomware, technology, finance ]
Ligue se Grupo was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Other. Country: Portugal. Website: grupoligue-se.pt. grupoligue-se.pt Ligue-se Grupo is a Portuguese IT and business-services group founded in 2009 in Funchal, Madeira (born from the merger of accounting firm Contatlntico and IT company Enterformatic). It runs several businesses: Chip7 retail computer stores (Madeira + Lisbon) selling PCs, laptops and accessories with repair services; GoClick, a B2B IT arm handling infrastructure, cybersecurity, cloud/Microsoft 365, ERP software (Sage, PHC, ZoneSoft) and hotel-tech solutions; and Ligue.Gest, offering accounting, payroll and tax consulting. Led by CEO Ivo Herculano Caires and CFO lia Caires, it targets SMEs and private clients across Madeira and mainland Portugal. In short: one group covering everything from hardware sales and repairs to IT management and bookkeeping.
Magna Legal Services
September 24, 2026
•[ ransomware, technology, finance ]
Magna Legal Services was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Professional Services. Country: United States of America. Website: magnals.com. Magna Legal Services is a nationwide provider of comprehensive litigation support and legal services, serving law firms, corporations, insurance companies, and government organizations. Founded in 2007 and headquartered in Philadelphia, Pennsylvania, the company supports clients throughout the entire litigation process. Its services include court reporting, deposition services, medical record retrieval, jury consulting, trial presentation, legal graphics, video production, investigations, service of process, interpreting and translation, and virtual proceedings. Magna combines legal expertise with technology to help attorneys manage complex cases efficiently. The company has expanded its national presence through strategic acquisitions and currently operates across numerous locations throughout the United States.
The company headquarters is located in 1635 Market Street, 8th Floor, Philadelphia, PA 19103, United States. 501-1000 Employees
Willatt & Flickinger
September 27, 2026
•[ ransomware, finance ]
Willatt & Flickinger was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-27. Country: United States of America. Website: www.wfaustin.com.