Ernesto Malvestiti S.p.A.
October 26, 2026
•[ ransomware, manufacturing, espionage ]
Ernesto Malvestiti S.p.A. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Italy. Website: Ernesto Malvestiti S.p.A.. [manufacturer] Ernesto Malvestiti S.p.A. a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup 7 copies) every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB 5).
GDPR Article 9 special-category data medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce.
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export.
ADP payroll SFTP credentials stored in WinSCP.ini the channel used to transmit employee salary data to the external payroll processor.
614 MB of financial/controlling data consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
1.5 GB of engineering IP 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
160+ client/supplier contracts with pricing, commercial terms, and executed NDAs.
560+ job candidate CVs with full names, addresses, phone numbers, and career histories.
Solid Trading B.V.
October 18, 2026
•[ ransomware, leak, finance ]
Solid Trading B.V. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Other. Country: Netherlands. FX liquidity and trading technology Netherlands | Live client trading records: order and execution data for the banks and institutions trading through this firm, with amounts and account identifiers; The client database: companies, platform users with password hashes, credit limits, clearing paths and fee schedules; FIX venue session configurations, including login credentials for liquidity providers; Trade history and bank matching audit records | [NOT PAID EXPOSED]
All Business Technologies (Fox Hill bookkeeping and tax practice)
October 18, 2026
•[ ransomware, leak, finance ]
All Business Technologies (Fox Hill bookkeeping and tax practice) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Professional Services. Accounting & Tax Preparation (US) Massachusetts, USA | Books and tax records of a Massachusetts bookkeeping and tax practice: live accounting company files of more than 60 client companies with all accounting backups 2014 through 2026; Per-client tax return data for tax years 2015 through 2025 and the practice billing database; Accounts receivable ledgers, client lists and scanned client legal documents: deeds, trust certifications and IRS powers of attorney | [NOT PAID EXPOSED]
CREDIN
October 19, 2026
•[ ransomware, finance ]
CREDIN was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Financial Services. Country: Portugal. Website: www.credin.pt.
Kirkland & Ellis LLP
October 22, 2026
•[ ransomware, finance, technology ]
Kirkland & Ellis LLP was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Professional Services. Country: United States of America. [AI generated] Kirkland & Ellis LLP is a global law firm headquartered in Chicago, Illinois, United States. It operates in the legal services industry, providing counsel in private equity, mergers and acquisitions, restructuring, litigation, intellectual property, and tax law. One of the world's largest law firms by revenue, it serves corporate clients, investment funds, and financial institutions through offices across the United States, Europe, and Asia.
CDG Chartered Accounting
October 23, 2026
•[ ransomware, finance ]
CDG Chartered Accounting was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Professional Services. Country: Australia. Website: www.cdgaccounting.com.au.
zelsior.es
October 23, 2026
•[ ransomware, finance, technology ]
zelsior.es was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-23. Country: Spain. Website: zelsior.es. Founded in 2015, we have become the leading firm in comprehensive, technology-driven legal debt reco...
Commonwealth Community Bank
October 24, 2026
•[ ransomware, finance ]
Commonwealth Community Bank was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Financial Services. Country: United States of America. Website: www.cwcbankhb.com.
Power Funding
October 26, 2026
•[ ransomware, finance ]
Power Funding was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.powerfundingltd.com.
Luzco Ilumination
October 18, 2026
•[ ransomware, manufacturing, finance ]
Luzco Ilumination was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-18. Sector: Energy & Utilities. Spanish company that specializes in professional
lighting for shops and commercial spaces.
There are many customer documents and employee data. [Sector: Manufacturing, Finance]
Finzly Corp
October 19, 2026
•[ ransomware, finance, technology ]
Finzly Corp was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Financial Services. Country: United States of America. fintech payments US | Network configuration and access secrets for payment infrastructure; Cloud environment topology and access keys | [NOT PAID EXPOSED]
Company #99
October 21, 2026
•[ ransomware, healthcare, finance ]
Company #99 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-21. health insurance administration Guayaquil, Ecuador | [PENDING EXPOSURE]
Porter Hedges LLP
October 21, 2026
•[ ransomware, leak, finance ]
Porter Hedges LLP was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Professional Services. Country: United States of America. [AI generated] Porter Hedges LLP is a full-service business law firm based in Houston, Texas, United States. It operates in the legal services industry, providing counsel in areas such as energy, corporate transactions, finance, litigation, bankruptcy, real estate, and labor and employment law. The firm primarily serves corporate clients, including businesses in the oil and gas sector, and operates within the United States.
srsnodgrass.com
October 21, 2026
•[ ransomware, finance, leak ]
srsnodgrass.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Professional Services. Country: United States of America. Website: srsnodgrass.com. [AI generated] N/A
I don't have reliable, verified information about a company associated with the domain "srsnodgrass.com." Rather than provide speculative or potentially inaccurate details about its operations, industry, or country of origin, I'm flagging this as unknown. If you have additional context, documentation, or details about this entity, I'd be glad to help analyze that information instead.
SGLA (Schwartz, Giannini, Lantsberger & Adamson)
October 22, 2026
•[ ransomware, finance, healthcare ]
SGLA (Schwartz, Giannini, Lantsberger & Adamson) was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Professional Services. Country: United States of America. Website: www.sglacpas.com. Schwartz, Giannini, Lantsberger & Adamson (SGLA) Accountancy Corporation is a full-service certified public accounting firm based in Stockton, California, founded in 1988. The firm provides tax planning and compliance, audits, reviews and compilations, bookkeeping, payroll, outsourced CFO support, and business consulting for individuals and companies. It has particular experience with real estate, healthcare, nonprofits, affordable housing, common-interest realty associations, and local government clients. SGLA positions itself as a hands-on local CPA practice that combines traditional accounting work with practical advice to help clients stay compliant and grow.*After the timer expires, you will be able to freely download several fragments of the full archive for review. To purchase the complete archive, please contact our manager. https://www.sglacpas.com
Andrews Advisory Group LLC
October 25, 2026
•[ ransomware, healthcare, finance ]
Andrews Advisory Group LLC was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Financial Advisory & Restructuring (US) Chicago, Illinois, USA | Patient records with names and dates of birth from the patient database backup of December 2025 (3,698 records), taken from the office network; The complete patient database backup history, 2018 through 2025; More than 13,000 patient eye examination records with full ocular, medical and social history; OCT eye scan files from the imaging server on the network; Workstation profiles of office staff including stored system credentials | [NOT PAID EXPOSED]
Mach Law APC (San Diego family law and divorce practice)
October 25, 2026
•[ ransomware, leak, finance ]
Mach Law APC (San Diego family law and divorce practice) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Legal Services - Family Law (US) California, USA | Client case files of a San Diego family law practice: divorce, custody and support matters with California court filings (FL-150 financial declarations, FL-300 requests for orders, FL-335 proofs of service) and XSpouse support calculations; Client intake records with Social Security numbers and dates of birth; Client bank statements (Navy Federal, Discover and other institutions) and the practice trust account statements; Client billing roster with balances | [NOT PAID EXPOSED]
Weitz & Luxenberg
October 25, 2026
•[ ransomware, finance, healthcare ]
Weitz & Luxenberg was listed as a victim on the leak site of the Falcon ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Professional Services. Country: United States of America. Mass tort litigation law firm - Our 82 GB extraction includes confidentiality agreements, stipulations, NDAs, internal board documents, privileged attorney-client communications, client rosters detailing medical conditions and settlement eligibility, active-case strategy documents, liability estimations, mediation term sheets, internal financial data, settlement payout memos, detailed bankruptcy settlement summaries, regulatory correspondence, internal board minutes and much more. Contacted us then timewasted, re-attacks incoming.
passavant-ee.com
September 25, 2026
•[ ransomware, healthcare, leak ]
passavant-ee.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Healthcare. Country: Estonia. Website: passavant-ee.com. German engineering company Passavant Energy & Environment GmbH, which builds wastewater treatment plants with German and Swiss taxpayer money (KfW, SECO), is in reality controlled by Dubai-based conglomerate Drake & Scull International PJSC and through it finances operations in Iraq. Internal debit notes from Drake & Scull Oil & Gas Iraq Branch show that employees of the Iraqi division flew to Muscat (Oman) and stayed at hotels billed to Passavant Frankfurt, with the company's accounting department at Hahnstrae 31-35 approving those charges for payment. Employee Serikan Kire
GTL Concreto e Logística LTDA
October 19, 2026
•[ ransomware, manufacturing, finance ]
GTL Concreto e Logstica LTDA was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Manufacturing. Country: Brazil. Production and preparation of ready-mixed concrete
and mortars. Production of cement products for
construction. Construction of buildings and other
construction works. Rental of vehicles and industrial
equipment without an operator.
IN THE ARCHIVE FINANCIAL DOCUMENTS, PERSONAL AND CUSTOMER DATA,
EMPLOYEE CREDENTIALS. [Sector: Manufacturing, Finance, Transportation]
