Allmand-Smith Limited
October 21, 2026
•[ ransomware, manufacturing, finance ]
Allmand-Smith Limited was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Website: Allmand-Smith Limited. [distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent.
Domain admin credentials in plaintext and a full DC dump STORMGUARD\MichaelAdmin / 5t0rmGuard
Complete NatWest banking infrastructure blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus
WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15
entities. NatWest has 3 outstanding registered charges (Jun 2026).
Full payroll for every employee, current and former Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE
history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records.
Complete financial records for 15 entities Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan,
Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds, plus the consolidated
age200_AllmandSmithLtd.bak (2.1 GB). Management accounts (JanJul 2024), nominal trial balances, bank reconciliations (102,662 cash at year-end). Revenue:
17.66M, profit: 1.01M, financial health: 12/100 (distressed).
mvjllp.com
October 21, 2026
•[ ransomware, finance ]
mvjllp.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Website: mvjllp.com.
Company #106
October 22, 2026
•[ ransomware, finance ]
Company #106 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-22. Financial Advisory & Restructuring (US) Chicago, Illinois, USA | [PENDING EXPOSURE]
PWC
October 22, 2026
•[ ransomware, finance, technology ]
PWC was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. [AI generated] PwC (PricewaterhouseCoopers) is a multinational professional services network headquartered in London, United Kingdom. It is one of the "Big Four" accounting firms, offering audit and assurance, tax, consulting, and advisory services to businesses, governments, and organizations worldwide. PwC operates across numerous industries including finance, technology, healthcare, and energy, serving clients in over 150 countries globally.
Bethany Press International
October 21, 2026
•[ ransomware, leak, retail ]
Bethany Press International was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Retail & E-Commerce. Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib
ute millions of life-changing Christian books each year. They offer industry-leading publishing
services for both short-run and long-run printing and distribution.
We will upload 40gb of corporate data soon. Employee personal information (financials and so on
), customer information, financials, contracts and agreements, and so on.
Barrow & Grimm
October 22, 2026
•[ ransomware, finance ]
Barrow & Grimm was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-10-22. Country: United States of America. Website: barrowgrimm.com. Legal Services, Business Litigation and Corporate Law.
Morrison Cohen
October 26, 2026
•[ ransomware, finance, government ]
Morrison Cohen was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Professional Services. Country: United States of America. [AI generated] Morrison Cohen LLP is a United States law firm headquartered in New York City. It provides legal services across practice areas including corporate law, litigation, bankruptcy and restructuring, real estate, intellectual property, and white-collar defense. The firm serves corporate clients, financial institutions, and individuals. It operates within the legal services industry, primarily serving businesses in the New York metropolitan area and nationally.
GreenbergFarrow
October 27, 2026
•[ ransomware, technology, finance ]
GreenbergFarrow was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Website: GreenbergFarrow. [architecture] GreenbergFarrow a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada.
The dataset spans three major divisions:
Client Libraries (152 client folders, AF): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
Corporate Library: The entire institutional memory 24 years of accounting (invoicing, cleared checks, budgets from 20022026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.
Discipline Libraries (283 GB): Complete architecture reference library.
The exposed material includes:
300650+ individuals' personal data SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package including Medicare enrollment and voicemail recording.
7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 20142023.
Complete active litigation file for GF v. Storm/RFW (1:25-cv-03532) complaint, amended complaint, answers to interrogatories, discovery requests and responses, settlement negotiations, D&O insurer correspondence, and engagement letters. The entire attorney-client privilege chain.
FBI facility clearance documents SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
Complete acquisition records for 7 deals (5 completed + 2 in progress) including purchase prices, due diligence materials, certified financial statements, and wire instructions.
Lowenstein Sandler LLP
October 28, 2026
•[ ransomware, finance ]
Lowenstein Sandler LLP was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Founded in 1961 and headquartered in New York City, New York, Lowenstein Sandler is a national law fir
susannecerda.com
October 28, 2026
•[ ransomware, finance ]
susannecerda.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-28. Country: Mexico. Website: susannecerda.com. Die Unternehmensgruppe Susanne Cerd bietet nicht nur Dienstleistungen im Bereich Unternehmensgrndu...
Punta Shopping
October 31, 2026
•[ ransomware, retail, finance ]
Punta Shopping was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Country: Uruguay. Website: puntashopping.com.uy. Commercial organization in Uruguay, located in the city of Punta del Este
Field of activity: shopping center management, rental of commercial space, retail trade and services.
The archive contains the most important personal data and customer data. [Sector: Finance]
Hawaii Law Enforcement Fedral Credit Union
October 27, 2026
•[ ransomware, finance ]
Hawaii Law Enforcement Fedral Credit Union was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Financial Services. Country: United States of America. Website: www.hlefcu.com.
NuVista Federal Credit Union
October 27, 2026
•[ ransomware, finance ]
NuVista Federal Credit Union was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Financial Services. Country: United States of America. Website: www.nuvista.org.
Money Concepts Capital
October 27, 2026
•[ ransomware, finance ]
Money Concepts Capital was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Financial Services. Country: United States of America. Website: www.moneyconcepts.com. United States
Coast 2 Coast
October 27, 2026
•[ ransomware, retail, finance ]
Coast 2 Coast was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Retail & E-Commerce. Country: United States of America. Website: www.c2cescrow.com. United States
xspringcapital.com
October 28, 2026
•[ ransomware, finance ]
xspringcapital.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. Country: Thailand. Website: xspringcapital.com. XSpring Capital Public Company Limited is a company that operates in the business of investing in va...
Gilliam & Associates, P.C
October 30, 2026
•[ ransomware, finance ]
Gilliam & Associates, P.C was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. Website: gilliamcpapc.com. A full service CPA firm.
chicagolawyer.com
October 30, 2026
•[ ransomware, leak, finance ]
chicagolawyer.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: United States of America. Website: chicagolawyer.com. Chicago Personal Injury Lawyers Award-Winning Injury Lawyers At Staver Accident Injury Lawyers, we face powerful insurance companies head-on, using our decades of experience to help injury victims like you get the compensation you deserve. SAIL to victory with our winning team.
FPT Software
October 27, 2026
•[ ransomware, technology, automotive ]
FPT Software was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Technology. Country: Vietnam. Website: fptsoftware.com. fptsoftware.com FPT Software is the largest IT services company in Southeast Asia, founded in 1999 in Hanoi with 1.34 billion dollars in revenue and over 33,000 employees across 31 countries. It serves 1,100 clients including 130 Fortune Global 500 companies across automotive, banking, healthcare and energy, with Japan as its largest international market. Its AI-first strategy uses the FleziPT platform delivering 30 percent productivity gains, with AI and data services growing 60 percent in 2026. In 2025 it signed a record 256 million dollar AI transformation deal and secured 26 projects above 10 million dollars. Strategic partnerships span NVIDIA, Microsoft, SAP, AWS and OpenAI. Key strengths are unmatched scale from Vietnam, deep AI capabilities and a 152,000 strong education talent pipeline.
TWICE SRL
October 27, 2026
•[ ransomware, manufacturing, finance ]
TWICE SRL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-27. ompany from the Republic of San Marino,
associated with the production and sale of fashion clothing and accessories.
Archived personal and corporate data of employees and customers. [Sector: Manufacturing, Finance]
