The Golden Legacy Financing
October 13, 2026
•[ ransomware, finance ]
The Golden Legacy Financing was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. Website: www.goldenfinancing.com.
FINANCIAMENTO LTDA
October 14, 2026
•[ ransomware, finance, leak ]
FINANCIAMENTO LTDA was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Financial Services. Country: Brazil. H2 Financiamento
h2financiamento.com.br
Total leak: 1.53 TB, 3.619.372 Files, 908.472 Folders
Data: Clients Personal ID/Passport, Driver license, Clients (RG / CIN) CPF (Cadastro de Pessoas Fsicas), Birth certificate, Clients Risk Assessment,
Finance doc's, Bank statements, Tax invoice and a lot of other personal information.
Data type: High Confifential
Partners: Caixa Economica Federal, Construtora Tenda, Cury Construtora, Santander Brasil, Morgan Stanley
The full version of the publication is coming soon.
Company #69
October 15, 2026
•[ ransomware, technology, finance ]
Company #69 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-15. Software / fundraising services California, USA | [PENDING EXPOSURE]
Boyle, Pecharich, Cline, Whittington and Stallings
October 15, 2026
•[ ransomware, finance ]
Boyle, Pecharich, Cline, Whittington and Stallings was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. This law firm has been serving clients in Arizona since 1950, specializing in various legal are
as including business law, real estate law, probate, trusts, estate administration, and estate
planning. They are dedicated to assisting individuals and businesses in Prescott and Yavapai Co
unty with their legal challenges.
We will upload 24gb of corporate data soon. Detailed client information (SSN numbers, passports
, DLs), court files, contracts, financials, lots of confidential files, NDA, and so on.
www.coopecaja.fi.cr
October 15, 2026
•[ ransomware, finance ]
www.coopecaja.fi.cr was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Financial Services. Country: Costa Rica. Website: www.coopecaja.fi.cr. /
Evolution Spine / All Labs
October 16, 2026
•[ ransomware, healthcare, manufacturing ]
Evolution Spine / All Labs was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Healthcare. Medical device manufacturing (US) Texas, USA | FDA quality system records of a Texas spinal implant manufacturer: CAPAs, device history records for implant lots, management reviews, design drawings and audit files; The complete inventory database of the business, 317 tables, with hospital and surgical-center customers, purchase orders and implant lot shipping records; Finance records: purchase orders, tax forms and payroll timesheets; Hospital product packets for spinal fusion systems and staff mailbox exports | [NOT PAID EXPOSED]
Company #75
October 16, 2026
•[ ransomware, finance, technology ]
Company #75 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-16. Country: United States of America. fintech payments US | [PENDING EXPOSURE]
Sladek Partners
October 14, 2026
•[ ransomware, finance, hack ]
Sladek Partners was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Professional Services. Country: Czechia. Website: epravo.cz. ak-sladek_cz Sladek & Partners Prague law firm operating as Mgr. Ivana Sldkov, advokt (IO 66252946), with 24 years of practice since 2002 specializing in real estate transactions, divorce/family law, and attorney escrow (advoktn schova). The firm's flagship claim: 500M CZK ($23M) held in escrow annually across 100+ segregated accounts, backed by 500M CZK insurance and 25 day payout guarantees. Led by Ivana Sldkov (AK ev. . 09496, Charles University, licensed for escrow since 2002, speaks English/German/Russian), with a tiny 35 person team (accountant + secretary). Listed in EPRAVO.CZ's notable law firm yearbooks (2013, 2016); pricing is quote-only (hourly/fixed/contingency), no published rates.
Macfarlan Capital Partners
October 14, 2026
•[ ransomware, finance ]
Macfarlan Capital Partners was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Financial Services. Country: United States of America. Website: macfarlan.com. Equity real estate investment sponsor that serves institutional investors, family offices, wealth management advisors, and high net worth individuals
poolegroup.com.au
October 14, 2026
•[ ransomware, finance, hack ]
poolegroup.com.au was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Professional Services. Country: Australia. Website: poolegroup.com.au. Poole Group is a prominent accounting and business advisory firm located on the Sunshine Coast, offe...
Data-Core Systems
October 16, 2026
•[ ransomware, technology, healthcare ]
Data-Core Systems was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Technology. Website: dcsdev.org. Data-Core Systems is an IT consulting and technology services company incorporated in 1988. It helps organizations with digital transformation, SAP implementation, AI and machine learning, data analytics, cloud migration, application development, publishing, and business process solutions. It serves industries including healthcare, manufacturing, government, finance, retail, and energy.
Prafesta Ind. e Com. de Embalagens Ltda
October 16, 2026
•[ ransomware, manufacturing, finance ]
Prafesta Ind. e Com. de Embalagens Ltda was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Manufacturing. Country: Brazil. packaging manufacturing (extrusion) Brazil | Senior Sapiens ERP and Vetorh HR payroll platform; eSocial government payroll filings September and October 2026; Thousands of electronic invoices with customer and supplier data; Worker and partner CPF identification numbers; Bank integration certificates and financial records | [NOT PAID EXPOSED]
Merit Financial Group
October 19, 2026
•[ ransomware, finance, leak ]
Merit Financial Group was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Financial Services. Country: United States of America. Merit Financial Group, LLC, doing business as Merit Financial Advisors ("Merit"), is a national wealth management firm that supports both the independent broker-dealer and RIA models. Based in Atlanta, Georgia, Merit has 24 additional offices throughout the U.S. and managed $5.59 billion in assets as of June 30, 2021 ($3.53 billion in advisory, $1.95 billion in brokerage assets and with $112 million in assets under advisement). Merit's mission is to establish and exceed the financial goals of its clients, while also providing its advisors and offices with practice management resources, an industry leading technology platform and the investment expertise needed to drive growth and deliver a superior client experience.
The company headquarters is located in 2400 Lakeview Parkway, Suite 550, Alpharetta, GA 30009, United States.
201-500 Employees
Adobe Insurance Brokers, LLC
October 21, 2026
•[ ransomware, finance ]
Adobe Insurance Brokers, LLC was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Financial Services. Country: United States of America. Website: adobebrokers.com. Independent insurance agency located in Morgan Hill, California
sodali.com
October 21, 2026
•[ ransomware, finance, technology ]
sodali.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Professional Services. Country: United States of America. Website: sodali.com. [AI generated] Sodali & Co is a global corporate governance and advisory firm providing services such as shareholder engagement, proxy solicitation, investor relations, M&A and contested situation advisory, ESG consulting, and governance analytics. Formed through the merger of Georgeson and Sodali, it serves corporations, institutional investors, and financial firms worldwide. Headquartered in Luxembourg, it operates across North America, Europe, Asia, and Latin America.
VERGI Muenster
October 22, 2026
•[ ransomware, finance, energy ]
VERGI Muenster was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Energy & Utilities. Country: Germany. Website: vergi-muenster.de. German tax advisory and business consulting firm providing tax return preparation, bookkeeping, annual financial statements, auditing, fiduciary services, and consulting for start-ups and established businesses.
Sanders Law Group
October 23, 2026
•[ ransomware, hack, finance ]
Sanders Law Group was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Professional Services. Sanders Law Group DATA SALE LISTING - Sanders Law Group / Sanders Law Firm, PLLC (Uniondale, NY)Target: Sanders Law Firm, PLLC (d/b/a Sanders Law Group; former brands - Barshay Sanders PLLC, Baker Sanders) Addresses: 333 Earle Ovington Blvd, Suite 402, Uniondale, NY 11553 100 Garden City Plaza, Garden City, NY 11530 Phone: (516) 203-7600 Owner: Craig B. Sanders, Esq. (founding partner) Size: ~8 TB 4.5 million files 20052026, history through most recent Format: full file-server clones + 2 dumps of the firm's ARES case-management DB + mail archives (33 PST, ~120 GB + 2,479 mailbox dumps)Who they are and who they work withA high-volume litigation factory out of Long Island, NY, running three conveyor-belt practices:FDCPA mill - 9,332 mass cases against banks and collectors. Their evidence pipeline: 1,144 audio recordings of their own clients' calls with banksCopyright machine - ~17,000 'photo-enforcement' suits. In January 2022 Sanders bought the entire practice of Richard Liebowitz the most-sanctioned copyright attorney in U.S. history (discredited, bar-suspended). Included: the executed Asset Purchase Agreement, a confidential WZMP settlement (7 versions incl. redlines), the acquired book of cases and clients, and solicitation letters to poach his client listFCRA litigation vs Equifax, Experian, TransUnion 953 cases. Plus a dedicated Equifax SRAs folder: executed settlements with Equifax LLC, named client by client, alongside their full credit disclosuresCorporate clients/partners in the files: The Mega Agency, Pixsy (exclusive enforcement deals), Signature Health Center / CareHealth (healthcare), Chase debt-buyer packages, Esquire Funding (litigation finance - loan agreements, commission invoices). Case-management dev outsourced to an Indian shop (neuralit.com).Active matters right now: 6,098 (of 30,671 total in the DB).What's inside - value breakdownPractice-side (the firm's jugular)Full ARES DB (2 dumps) - all 30,671 cases with settlement offers/demand ceilings in 13,413 files (up to $4,000,000 per case), statuses, internal notes, deadlines. Publication - burned negotiation positions across every active case at once2,342 executed CONFIDENTIAL settlement agreements (e.g., NationalPhoto v. Entravision + dozens more) - bearing secrecy clauses the firm itself is liable for1,315 documents of the firm's own sanctions and discipline: court orders on sanctions motions, a DFS Disciplinary Stipulation, 6 'Notice of Attorney Sanction' filings, public discipline ordersBanking & trusts11 accounts, 562 statements, incl. attorney trust accounts IOLTA NY (9068) and IOLTA NJ (2302) - bar-mandated audit territory = direct license threat for every named attorneyWire instructions for the client fund 6327 (JPMorgan Chase)Partnership tax returns 20152020 (Form 1065, TurboTax source files), payroll, full HR (I-9s, staff employment contracts, employee handbook)Client PII industrial scale12,803 full credit reports of the firm's own plaintiff-clients20,106 W-9/1099 forms, 520 files: SSN cards / passports / driver licenses / birth certificates1,471+ medical records (named patients, incl. NYUI files)CRM: 5,352 clients + 13,178 leads with phones/emails32,816 executed retainer agreementsOwner-level leverage (Craig B. Sanders)His 2022 divorce: Judgment of Divorce (Michelle Sanders v. Craig Sanders) + settlement stipulation + sworn Net Worth Statement + brokerage/bank statementsBonus: the firm's 78-page FBI IC3 criminal complaint dated 08/22/2026Email 20 years33 legacy PSTs (~120 GB) + 2,479 mailbox dumps + daily email backups (20132014)Freebies: office password lists in plaintext, owner's Chrome password export, court ECF login sheets. More
Frommann Energie GmbH
October 24, 2026
•[ ransomware, energy, manufacturing ]
Frommann Energie GmbH was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Energy & Utilities. Country: Germany. German company that sells and delivers fuels,
primarily heating oil (Heizl),
but also motor fuels and lubricants.
Archived personal and corporate data of employees and customers.
Here are the most important documents. [Sector: Manufacturing, Finance, Technology]
Phoenix S&S GmbH
October 24, 2026
•[ ransomware, manufacturing, finance ]
Phoenix S&S GmbH was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Germany. German company from Frankfurt am Main,
which deals with building maintenance, construction services,
logistics and security.
Archived personal and corporate data of employees and customers.
Here are the most important documents. [Sector: Manufacturing, Finance, Transportation]
AyT COMPUTERS SRL
October 25, 2026
•[ ransomware, technology, finance ]
AyT COMPUTERS SRL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Technology. Argentine Company operates in the field of electronic security systems,
video surveillance, monitoring and IT infrastructure.
There are many customer documents and employee data.
Financial documents, customer cards with phone numbers and addresses. [Sector: Finance, Technology]
