Tanner
September 4, 2026
•[ ransomware, finance ]
Tanner was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-04. Sector: Other. Country: Chile. Website: www.tanner.cl.
Occidental
September 4, 2026
•[ ransomware, finance, energy ]
Occidental was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-09-04. Sector: Energy & Utilities. Country: Venezuela (Bolivarian Republic of). Website: laoccidental.com. Sector: Insurance | Revenue: US$ 157,000,000
Blanco & Etcheverry
September 4, 2026
•[ ransomware, finance ]
Blanco & Etcheverry was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-09-04. Sector: Professional Services. Country: Uruguay. Website: blancoetcheverry.com. Sector: Law Firm | Revenue: US$ 5,000,000
AP CAPITAL PARTNERS LIMITED
September 4, 2026
•[ ransomware, finance ]
AP CAPITAL PARTNERS LIMITED was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-04. Sector: Financial Services. Website: www.apcapitalpartners.com.
CitizensPay
September 5, 2026
•[ ransomware, finance, technology ]
CitizensPay was listed as a victim on the leak site of the DYSPHOR1A ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Financial Services. Country: Myanmar. Website: ctzpay.com. Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar powered by Myanmar Citizens Bank (MCB) and Capital Connect Limited. Compromised agent user information total data size 30 GB. Price range $7,000 to $25,000. Victim domain https://ctzpay.com.
Jinny Beauty Supply
September 7, 2026
•[ ransomware, retail, technology ]
Jinny Beauty Supply was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: United States of America. Website: Jinny Beauty Supply. [distributors] Jinny Beauty Supply is one of the largest Korean-American wholesale beauty distributors in the US, operating 9 distribution centers from Doraville, Georgia to Commerce, California. They serve 7,400+ beauty supply stores and 2,800+ international distributors.
The exposed material includes:
A complete password vault export 50+ plaintext credentials for PayPal, Braintree, Amazon Seller Central, eBay, Acumatica ERP (production), 12 state tax portals, FedEx, UPS, ShipStation, Microsoft 365, Google Analytics, and internal email.
VMware hypervisor root credentials vCenter and ESXi root passwords giving complete control over the entire virtual infrastructure.
911 scanned credit card authorization forms full card numbers, CVV, expiry dates, and cardholder signatures for beauty supply store customers across 26 US states.
Complete employee compensation database ~260 employees with Korean and English names, departments, salaries, bonuses, and 1099 contractor data spanning 20152018.
A 340 MB Shopify database backup full customer table (names, emails, phones, addresses), product catalog, pricing, and warehouse assignments.
Active Directory domain enumeration all 239+ user accounts including 17 admin accounts, the complete server topology across 7 geographic sites (50+ servers), and DPAPI-encrypted RDP passwords.
Employee tax documents W-4 forms (SSN), I-9 forms (SSN + DOB + citizenship), direct deposit forms (bank account and routing numbers).
3.6 GB of SQL Server database backups e-commerce customer/order/product data spanning November 2019 to March 2020.
vsbattorneys.co.za
September 3, 2026
•[ ransomware, finance ]
vsbattorneys.co.za was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-03. Sector: Professional Services. Country: South Africa. Website: vsbattorneys.co.za. VSB Attorneys Inc is a well-established law firm in South Africa, specializing in corporate and comm...
Partners Group SK
September 7, 2026
•[ ransomware, finance ]
Partners Group SK was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Financial Services. Country: Slovakia. Website: www.partnersgroup.sk.
AbacoViaggi
September 7, 2026
•[ ransomware, leak, retail ]
AbacoViaggi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Hospitality. Country: Italy. Website: abacoviaggi.it. abacoviaggi.it zoominfo.com/c/abacoviaggi-srl/467818111 We have downloaded abacoviaggi company's data: Confidential personal data and customer information, Financial Documents and Accounting, Business correspondence and legal documents, e-mails, IT infrastructure information, Accesses and credentials. Abaco Viaggi family-run travel agency and tour operator founded in 1997 in Bologna by Alberto Scipione (P.IVA 02686751203), part of the Gruppo Abaco ecosystem (Viaggi + Meeting & Incentive + Servizi). Its signature niche: senior/third-age group travel packages for 60+ travelers (slow pace, medical support, no-surprise pricing), plus the trademark move of chartering entire trains for group excursions across Emilia-Romagna.
Soni Dwarkadas Virchand
September 7, 2026
•[ ransomware, retail, finance ]
Soni Dwarkadas Virchand was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: India. Website: dwarkadasjewellers.com. dwarkadasjewellers.com zoominfo.com/c/soni-dwarkadas-virchand/562586193 We have downloaded company's data: Confidential personal data and customer information, Financial Documents and Accounting, Business correspondence and legal documents, your databases, IT infrastructure information, Accesses and credentials, Technical documentation Soni Dwarkadas Virchand is a 110-year-old family jewellery house from Bhavnagar, Gujarat founded in 1915 with a shop rented for just 7, carrying a freedom-fighter legacy (founder left the shop to join India's independence movement) and a dramatic heir story (a 16-year-old son with 22 saved the dynasty). Now in its 5th generation, it runs Bhavnagar's biggest jewellery mall (6,100 sq ft) plus a "House of Bangles" and tech-powered "Bridal Studio" with virtual try-on. Product scale: 25,000+ designs, signature collections (Bikaneri Treasure, Sara, Menaments), Trust moat: BIS hallmark, IGI/GIA certified diamonds,4.9/5 from 1,350+ Google reviews.
Mutant
September 7, 2026
•[ ransomware, technology, finance ]
Mutant was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: Brazil. Website: mutant.com.br. mutant.com.br zoominfo.com/c/mutant/452328184 Mutant is one of Latin America's largest CX & AI companies, founded in 2016 as a spin-off from Genesys Brazil, HQ'd in So Paulo with 4,000+ employees across 14 countries. Backed by Permira, GIC and TCV, its holding "Clash" raised $75M from BlackRock in 2025 for M&A and AI. It runs 3.5 billion AI-driven interactions per year for 100+ enterprise clients including the world's largest corporate WhatsApp operation (Caixa) with clients like Ita, Vivo, Santander, Claro and iFood. Built through 8+ acquisitions (Interaxa, GRB, Intervalor...), it projects ~R$1B revenue in 2026 and pours R$100M+/year into its proprietary generative AI ecosystem (IAM/Xavier/PALI). Bottom line: the quiet AI-giant of Brazilian customer experience "Artificial Intelligence, Human Experiences" now repositioning as the enterprise AI-intelligence layer of LatAm.
Hollard Insurance Group
September 7, 2026
•[ ransomware, finance, leak ]
Hollard Insurance Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Financial Services. Country: South Africa. Website: hollard.co.za. hollard.co.za zoominfo.com/c/the-hollard-insurance-company-ltd/56019572 Hollard is South Africa's largest independent, privately-owned insurance group, founded in 1980 by the Enthoven family, HQ'd in Johannesburg, 4,000+ employees, 6M+ policyholders. Ownership: Enthoven family 57%, B-BBEE group Bushwillow 20%, Tokio Marine ~22.5% (2018, ~$327M); GCR AA(za). Operates in 18 countries on 4 continents via 100+ partnership ventures: Hollard Insure (corporate/broker), Hollard Life Solutions (mass market, prepaid "starter packs" sold like airtime), Hollard International (8 African countries + Philippines). Landmark deals: CommInsure Australia A$625M (2022 top-5 insurer there, 15-year exclusive bancassurance deal with Commonwealth Bank), and in 2025 Global Alliance Seguros (Mozambique) + Absa Life Botswana. Innovations: HUGinsure (world's first social-impact insurer), insurtech bets (Naked, dotsure).
fdcputman.nl
September 8, 2026
•[ ransomware, finance ]
fdcputman.nl was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Other. Country: Netherlands. Website: fdcputman.nl. FDC Putman is a financial specialist offering tailored advice on mortgages, insurance, and various f...
Financière d'Uzès
September 8, 2026
•[ ransomware, finance ]
Financire d'Uzs was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Financial Services. Country: France. Website: finuzes.fr. Financire d'Uzs offers a range of financial services tailored for individuals, entrepreneurs, and professionals, focusing on wealth management, investment strategies, and fiscal optimization. Their services include asset management, financial analysis, and dedicated funds, catering to clients looking to enhance their income, organize their assets, and manage their taxes. With over 35 years of experience and a commitment to independence, they have supported 2000 families and manage 1.5 billion euros in assets. The company operates six offices across France, providing personalized service through a single point of contact.
RelyComply AML Platform
September 9, 2026
•[ ransomware, finance, technology ]
RelyComply AML Platform was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: relycomply.com. Financial Software
EASY JOB S.A.S.
September 10, 2026
•[ ransomware, finance, leak ]
EASY JOB S.A.S. was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: Colombia. Website: easyjobsas.com. Colombian Company.
Audit and Tax Audit with more than 5 years of experience
Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medelln Colombia.
Llmanos o escrbenos: 310 447 2013 - 313 796 9917
The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents
17000 documents [Size: 2.7 GB | Sector: Finance]
General Santos Doctors Hospital
September 10, 2026
•[ ransomware, healthcare, finance ]
General Santos Doctors Hospital was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Healthcare. Country: Philippines. General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data personal cell numbers of the president, hospital administrator and board members More
CO-OP URBAN BANK LTD
September 10, 2026
•[ ransomware, finance, leak ]
CO-OP URBAN BANK LTD was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Financial Services. Country: India. Website: indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited. Country: India |
Website: https://indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited/ |
Revenue: $50 Million |
Industry: Bank, Finance |
Employees: 25-50 |
Properties: 41.3 GB (125,988 Files, 14,641 Folders)
Mestechkin Law Group P.C.
September 14, 2026
•[ ransomware, finance, technology ]
Mestechkin Law Group P.C. was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Professional Services. Country: United States of America. Website: www.lawmlg.com. Law Practice Stolen data: 37 GB.
httoy.fi
September 9, 2026
•[ ransomware, finance ]
httoy.fi was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-09. Country: Finland. Website: httoy.fi. Tilitoimisto HTT Oy Tilitoimisto HTT Oy on Raumassa toimiva kirjanpitj, joka tarjoaa taloushallin...
