Bernath & Rosenberg
September 13, 2026
•[ ransomware, finance ]
Bernath & Rosenberg was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-13. Sector: Professional Services. Country: United States of America. Website: .. A full service CPA firm
Better Accounting Solutions
September 14, 2026
•[ ransomware, finance ]
Better Accounting Solutions was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Professional Services. Wall Street accountants data breach.
Dang Invest Group
September 14, 2026
•[ ransomware, finance, retail ]
Dang Invest Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Financial Services. Country: Vietnam. Website: danginvestgroup.com. danginvestgroup.com Dang Invest Group zech family restaurant group from Ostrava, founded in 1998 by Vietnamese immigrants the force behind the country's biggest Asian fast-food network: brands GUTY ("Taste of Modern Asia" bnh m, bao, rice bowls), Multifood (the original, 1998), Rakki Sushi, Tuk Tuk and Amart cafs, running 70+ company-owned outlets across Czechia, Slovakia and Germany, mostly on shopping-mall food courts, with a central kitchen and no franchise/PE money. The Vietnamese-diaspora ladder: one stall in 1998 mall standard in the 2000s sub-brands in the 2010s three countries in the 2020s, with the GUTY trademark registered at EUIPO/UKIPO for future European expansion.
Agenzia Vittoria Assicurazioni
September 14, 2026
•[ ransomware, finance, leak ]
Agenzia Vittoria Assicurazioni was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Financial Services. Country: Italy. Website: assicurazionilodi.it. assicurazionilodi.it zoominfo.com/c/agenzia-vittoria-assicurazioni-lodi-stazione/1342235416 Vittoria Assicurazioni "Lodi Stazione" agency (#393 in the network) a private insurance agency owned by Massimo Garati in Lodi, Lombardy (Via Nino dall'Oro 28/30, RUI A000169373, registered 30.11.2010, Section A agent under IVASS supervision). Garati's story: he ran an ITAS agency for years, then in 2016 executed a full portfolio transfer (travaso di portafoglio) from ITAS to Vittoria Assicurazioni a rare mandate switch carrying his entire client base and built an unusual digital edge for provincial Italy: a generic city domain ("assicurazioni Lodi" = local SEO gold), Google Ads/My Business management and a content-rich FAQ site. He sells the full Vittoria line: auto/mobility, home, family, pets, savings, pensions, legal protection, agriculture, crafts, offices/hotels, transport. Behind it stands the parent Vittoria Assicurazioni S.p.A. (Milan, founded 1921 )
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC
September 15, 2026
•[ ransomware, leak, finance ]
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Professional Services. Country: United States of America. Website: www.wigginschilds.com. Large U.S. plaintiffs firm with Alabama, D.C., and Florida offices. Since 1985, its been known for excellence in discrimination, consumer protection, and employment law, leading class actions that advance protections for victims.
Community Property Management
September 16, 2026
•[ ransomware, leak, finance ]
Community Property Management was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-16. Sector: Other. Country: United States of America. Website: cpm1.com. full data 200 GB+
We have been in business since 1978 as a management firm specializing in the management of common interest developments including condominiums and planned unit developments.
CPM rapidly evolved into one of the premier association management firms in the industry and is on the forefront of innovative and specialized services. Our reputation for attentiveness to the needs of each association is one of which Community Property Management is very proud.
Our dedication to excellence and our staffs skills and professionalism have become the trademark at Community Property Management. Management level personnel attend courses offered through Community Associations Institute, a national organization of community association, and California Association of Community Managers. CPM has also earned its Accredited Management Organization designation with IREM, and Certified Property Manager from CAI, the industries highest designation.
We are responsive and dedicated to our Associations and their unique service requirements. We have found, over the years that association needs are constantly changing. Therefore, we analyze and formulate objective plans for the guidance and support of the Association through its Board Members.
Our company has developed expertise in all areas of association management and keeps Board Members updated on law changes. We stand ready to assist you with all your Associations requirements.
budgetms.com
September 1, 2026
•[ ransomware, finance, hack ]
budgetms.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Financial Services. Country: Montserrat. Website: budgetms.com. CLEAN WORK The company that cleans other people's buildings and supplies janitorial products left ev...
pacificabs.com
August 28, 2026
•[ ransomware, healthcare, finance ]
pacificabs.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-28. Sector: Professional Services. Country: Australia. Website: pacificabs.com. Documents: Pacific Global Solutions / PABS / Atteign LLC PROLOGUE 40+ American businesses medical ...
First Secure Bank and Trust
September 18, 2026
•[ ransomware, finance ]
First Secure Bank and Trust was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: firstsecurebank.com. First Secure Bank and Trust was founded in Palos Hills, Illinois in 1977 to serve the financial needs of the company's friends and neighbors. Today, the company is still in the neighborhood and continuing with that mission. The company is the only "true" locally owned bank in the area. The company care about the community because the company live here, too. This local knowledge and commitment gives the company a tremendous advantage when it comes to helping you with your financial needs. Other nearby bank branches have headquarters miles away and employees that move from location to location as the need arises. The company is always here to listen to you and then use the company's years of experience to help you achieve your financial goals, whether it is a simple free checking account or sophisticated investment advice. The company will always give you the right service-right here, right now.
The company headquarters is located in 10360 S Roberts Road, Palos Hills, IL 60465, United States. 11-50 Employees
The State Bank
September 18, 2026
•[ ransomware, finance ]
The State Bank was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: thestatebankgroup.com. The State Bank Group is comprised of Wonder Lake State Bank (east), Wonder Lake State Bank (west), Johnsburg State Bank, Spring Grove State Bank, Lakemoor State Bank and Hebron State Bank. The company is proud to have directorship of local business owners and professionals. It has always been the company's focus as a community bank to provide the best banking services available. The company has selected the company's banking locations by identifying areas that were at the time unserviced. Therefore, each of the company's bank locations represents the first bank in their respective community. The company's group of banks has grown since the company's inception in 1979. The company currently have a staff of more than 80 employees. In addition to myself, the company has a teller who has been servicing the company's customers banking needs since 1979. The company thrive on building relationships with the company's customers and believe the company's slogan, "Bank Where You're Known", promotes the company's continuing mission and commitment to providing true "Community Banking". The company's extended lobby and drive-up hours provide the company's customers with the most flexible banking hours in McHenry County. All of the company's locations are full service banks, staffed with loan officers and new accounts representatives. In addition, all the company's locations have safe deposit boxes. Each of the company's loan officers have "real" lending authority, meaning that you will always be dealing with the decision makers. This makes your experience both personal and efficient. To the company's customers who are visiting the company's web site, "Thank You Very Much". If you are not currently a customer, the company invite you to "Bank Where You're Known".
The company headquarters is located in 7526 Hancock Drive, Wonder Lake, IL 60097, United States.11-50 Employees
Johnson Investment Counsel
September 18, 2026
•[ ransomware, finance ]
Johnson Investment Counsel was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: johnsoninv.com. Johnson Investment Counsel is an independent, employee-owned wealth management firm founded in 1965 and headquartered in Cincinnati, Ohio. The company provides comprehensive financial services to individuals, families, businesses, corporations, retirement plans, foundations, and nonprofit organizations. Its services include investment management, financial planning, retirement and cash-flow planning, estate planning, trust services, charitable planning, and business solutions. Johnson Investment Counsel operates as a fee-only Registered Investment Advisor and emphasizes fiduciary responsibility, long-term relationships, and customized financial strategies. As of June 30, 2026, the firm manages approximately $23 billion in assets and has 159 employees, serving clients across all 50 U.S. states.
The company headquarters is located in 7755 Montgomery Road, Suite 180, Cincinnati, OH 45236, United States.51-200 Employees
Argentem Creek Partners (investment firm)
September 18, 2026
•[ ransomware, finance, technology ]
Argentem Creek Partners (investment firm) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: argentemcreek.com. Investment management / private credit United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
PayPal support operations (Transcom WorldWide)
September 18, 2026
•[ ransomware, finance, technology ]
PayPal support operations (Transcom WorldWide) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: Sweden. Website: transcom.com. Outsourced customer support / financial services Netherlands / Tunisia | 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems; Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites | All 8 sites are enforcing a network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Cassias MG Government
September 19, 2026
•[ ransomware, government, healthcare ]
Cassias MG Government was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-19. Sector: Government & Defense. Country: Brazil. Website: cassia.mg.gov.br. network commitment, from government credentials to justice panels, such as access to the financial sector, police, personal data, medical (SUS), RG(CIN), BIRTH CERTIFICATE, CPF (identity number in Brazil) among other data from CASSIAS.MG.GOV departments, we will give you a deadline to negotiate with us! [Size: 720.0 MB | Sector: Medical, Government, Finance]
Studio Notarile Associato Salvatore Costantino E Anna Favarato
September 20, 2026
•[ ransomware, finance ]
Studio Notarile Associato Salvatore Costantino E Anna Favarato was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Professional Services. Country: Italy. Website: costantinofavarato.it. Studio Notarile Associato Salvatore Costantino E Anna Favarato, Follina
+39 0438 971778
Piazza Iv Novembre, 20, 31051, Follina , Italia
Notary's office
several thousand documents
There are many customer documents and employee data. [Sector: Finance, Other]
arsrenacer.com
September 1, 2026
•[ ransomware, healthcare, finance ]
arsrenacer.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Other. Country: Argentina. Website: arsrenacer.com. ARS RENACER, S.A. DUMP: ANALYSIS OF A HEALTH INSURANCE COMPANY LEAK
ARS Renacer, S.A. (Dominican Republic) is a private Health Risk Administrator (ARS), licensed by SISALRIL (Law 87-01). Member of ADIMARS. It serves hundreds of thousands of affiliates through 24 regional offices.
**DUMP VOLUME:** 274,404 files / 158,693 critical and high-risk files
50,894 files in the "Usuarios" (Users) folder user accounts for all systems
.ssh/ + .bash_history + .gitconfig access keys and command history of IT personnel
4,501 files direct affiliate databases (names, cdulas [national IDs], phone numbers, addresses)
3,000 backup files potentially complete database dumps
679 files employee payroll data
500 files passwords and access tokens to financial systems
**MEDICAL DATA (PHI):**
19,443 medical service authorization files diagnoses, procedures, patient names
13,928 pre-certification files
810 pre-certification files (treatment details)
199 medical record files (expediente clnico)
1,569 prescription files linked to diagnoses
252 claims files containing PHI
**FINANCIAL DATA:**
4,863 financial transaction files payments, refunds, bank details
3,676 account files with affiliates' financial data
3,467 financial documents (reports, balance sheets, budgets)
1,293 files containing financial system secrets and tokens
**REGULATORY RISKS:**
Law 172-13 (Personal Data Protection) Article 13 directly violated; penalties: 6 months to 2 years in prison + fines up to 150 minimum wages per incident
Law 42-01, Article 28 (Confidentiality of clinical records)
Law 53-07 (Cybercrime) mandatory DICAT investigation
Circular SSRL-INT-2025-000827 SISALRIL direct requirement to protect PHI
Precedent: SISALRIL fine of 2.3 million DOP for 5 incidents (2021); the current leak is orders of magnitude larger
**OTHER RISKS:**
Exploitation of the Traspaso Digital system (SISALRIL, 2025) for massive illegal transfers of affiliates using leaked credentials
Blackmailing patients with the threat of disclosing diagnoses
BEC (Business Email Compromise) attacks on management (Board of Directors' data is in the dump)
Synthetic identity theft and fabrication of fake cdulas
Mass Habeas Data lawsuits will paralyze the legal department
The dump contains a complete cross-section of the medical insurance company: from server SSH keys to the diagnoses of hundreds of thousands of patients and affiliates' bank details. The data cannot be invalidated a cdula and medical history are immutable.
siinqeebank.com
September 20, 2026
•[ ransomware, finance ]
siinqeebank.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Financial Services. Country: Somalia. Website: siinqeebank.com. Siinqee Bank is a licensed Ethiopian financial institution that offers inclusive and innovative bank...
The Money Store
September 21, 2026
•[ ransomware, finance ]
The Money Store was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Financial Services. Country: United States of America. Website: themoneystore.com. The Money Store is a local mortgage lender based in Hamilton, NJ, specializing in home financing solutions. They offer a variety of loan products including home purchase, refinance, construction, renovation, and home equity loans to cater to diverse client needs. Their services are designed for individuals looking to buy, build, renovate, or refinance their homes. The company aims to simplify the home financing journey with a user-friendly application process and dedicated team support.
The company headquarters is located in 30B Vreeland Road, Suite 200, Florham Park, NJ 07932, United States.
201-500 Employees
TruAmerica Multifamily
September 22, 2026
•[ ransomware, finance ]
TruAmerica Multifamily was listed as a victim on the leak site of the termite ransomware group; the attack is estimated to have taken place on 2026-09-22. Country: United States of America. Website: www.truamerica.com. TruAmerica Multifamily is a vertically integrated real estate investment and asset management firm specializing in multifamily housing across the United States. The company focuses on identifying value opportunities within existing apartment communities and enhancing their long-term performance through strategic acquisition, thoughtful renovation, and disciplined property management.
Cozen O'Connor
September 22, 2026
•[ ransomware, leak, finance ]
Cozen O'Connor was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: United States of America. [AI generated] Cozen O'Connor is an American full-service law firm headquartered in Philadelphia, Pennsylvania. Founded in 1970, it operates in the legal services industry, providing counsel across practice areas including litigation, corporate law, insurance, real estate, labor and employment, cybersecurity, and government relations. The firm serves clients across the United States and internationally, with offices throughout the U.S. and abroad.
