Placer AI
October 10, 2026
•[ ransomware, technology, retail ]
Placer AI was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Technology. Country: United States of America. Website: placer.ai. placer.ai Revenue $136.5 Million private US company valued at $1.5 billion that sells foot traffic analytics for physical locations, estimating visits to stores, malls and offices from anonymized data on tens of millions of mobile phones with 92%+ claimed accuracy. It hit $100 million annual recurring revenue in 2024 after growing 80% in a year and serves 4,000+ customers including Sony, Wegmans, BJ's Wholesale, SeaWorld and Bloomberg, which puts Placer data into its Terminal so investors can track company performance before earnings. Money comes from SaaS subscriptions starting around $12,000 a year, API data feeds and add-on datasets, and it has raised $268 million in total funding. Around 630 employees work at Placer.ai after 150 layoffs in January 2025 aimed at reaching profitability, and it owns no factories or stores because its product is pure software and data.
DFK Group
October 13, 2026
•[ ransomware, finance ]
DFK Group was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Germany. Website: www.dfkgroup.de. Germany
The Buckner Company, Inc.
October 13, 2026
•[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
PG Group (Pure Options)
October 13, 2026
•[ ransomware, finance, retail ]
PG Group (Pure Options) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. cannabis operator (US) Lansing, Michigan, USA | Complete directory database of a Michigan cannabis operator: password data for all 577 accounts; Working password corpus for dozens of staff and administrator accounts; Financial and contract backups: payroll reports, general ledgers, signed operating and lease agreements; Complete inventory of the shared data volume | [NOT PAID EXPOSED]
SAS H2O MICHEL
October 6, 2026
•[ ransomware, finance ]
SAS H2O MICHEL was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: France. Website: h2o-michel.fr. h2o-michel.fr huissiers-bordeaux.com SAS H2O MICHEL is a French commissaire de justice firm (public judicial officer serving court documents, enforcing judgments, debt recovery) created in 2018 and based in Tours/Chinon, Val de Loire (Indre-et-Loire). It is led by President Alexandra Michel and operates 5 offices (Tours, Chinon, Bourgueil, Langeais, Chteau-la-Vallire) with a small team of 37 employees. Revenue grew rapidly from 223K in 2018 to 631K in 2019 (+183%), with a strong 16.4% net margin (103.5K net profit, ROE 85.8%) though all accounts since 2020 are filed confidentially (estimated 600K1M today). The firm is part of H2O Rseau National, France's first national network of commissaires de justice specialized in debt recovery (group network: 160+ staff, 6 major offices). Core services: enforcement of court decisions (saisie-attribution, wage garnishment, evictions, property seizures), debt collection, legal constats, and auction sales.
MoneyGram
October 10, 2026
•[ ransomware, finance, technology ]
MoneyGram was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Financial Services. Country: United States of America. Website: moneygram.com. moneygram.com Revenue $2.1 Billion MoneyGram global money transfer network moving nearly $200 billion a year through almost 500,000 retail agent locations in 200+ countries and serving 60 million+ active customers, with over 70% of transactions now digital. It earns mainly from transfer fees plus currency exchange spreads, not from owning stores, since almost all locations are partner agents like post offices and grocery chains. In 2025 it cut 449 jobs to speed up digital growth and in 2026 launched its own MGUSD dollar stablecoin and a Visa card that spends digital dollars anywhere Visa works. MoneyGram owns no factories or stores, it is a licensed money transmitter with 75+ regulatory approvals, around 2,000 employees in 36 countries, and was taken private in 2023 for $1.8 billion.
CMC AUDITORES SRL
October 13, 2026
•[ ransomware, finance ]
CMC AUDITORES SRL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Argentina. An Argentine auditing and accounting consulting
company that works with businesses in the field of accounting,
taxes and financial audit.
The archives contain several thousand documents with
personnel and customer data. [Sector: Finance]
Telcoe Federal Credit Union
October 15, 2026
•[ ransomware, finance ]
Telcoe Federal Credit Union was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Financial Services. Country: United States of America. Website: www.telcoe.com.
Via Credit Union
October 16, 2026
•[ ransomware, finance ]
Via Credit Union was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Financial Services. Country: United States of America. Website: www.viacu.org.
REGiO Nord
October 14, 2026
•[ ransomware, government, finance ]
REGiO Nord was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Other. Country: Germany. Website: regio-nord.com. regio-nord.com REGiO-Nord mbH (HRB 1203, Amtsgericht Neuruppin) is a municipal regional-development company in Gransee, Brandenburg, founded 20082009 to run the shared "Mittelzentrum" of GranseeZehdenickFrstenberg/Havel. It is 100% publicly owned (Zehdenick 1/3, Frstenberg 1/3, Gransee 1/6, Amt Gransee 1/6), led by sole managing director Olaf Bechert with a staff of ~5 plus two tourist info offices. Its real money flows through the Kooperationsfonds ~8.9M in projects since 2008, with 538K spent in 2025 and 563K budgeted for 2026, of which 312K funds the company's own coordination work. Four workstreams: education (teacher recruitment, apprenticeship exchange), economy (business services, doctor recruitment, arztidylle.de), tourism (two info stations, region portals, RegioApp), and regional marketing (REGiO-Card, library network). Finances are project-transparent (open budget reports) but the GmbH's own annual accounts are only public through 2022 request 20232025.
Company #76
October 16, 2026
•[ ransomware, finance, technology ]
Company #76 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-16. Country: United States of America. fintech payments US | [PENDING EXPOSURE]
Pure Options
October 16, 2026
•[ ransomware, finance ]
Pure Options was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Financial Services. Website: www.pureoptions.com. United States
Interseguro
October 13, 2026
•[ ransomware, finance ]
Interseguro was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. Country: Peru. Website: interseguro.pe. Insurance
Company #67
October 15, 2026
•[ ransomware, technology, finance ]
Company #67 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-15. Country: Netherlands. FX liquidity and trading technology Netherlands | [PENDING EXPOSURE]
torcivialaw.com
October 15, 2026
•[ ransomware, hack, finance ]
torcivialaw.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: Italy. Website: torcivialaw.com. Torcivia, Donlon, Goddeau & Rubin, P.A. continues to provide high quality, personalized, and practic...
fairfeelegalservices.com
October 15, 2026
•[ ransomware, finance ]
fairfeelegalservices.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-15. Sector: Professional Services. Country: United States of America. Website: fairfeelegalservices.com. proof
Pantanal Agricola
October 14, 2026
•[ ransomware, leak, finance ]
Pantanal Agricola was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-14. Sector: Agriculture and Food Production. Country: Brazil. Website: pantanalagricola.com.br. pantanalagricola.com.br Pantanal Agrcola S.A. is a Brazilian agri-input distributor (crop protection, fertilizers, seeds) founded in 2001 in So Gabriel do Oeste, Mato Grosso do Sul 19 legal units, 15-16 stores across MS/MT/GO, ~300 employees, serving 64+ municipalities and 5 million hectares of farmland. Partners include BASF, Corteva, FMC, Sumitomo, ICL, and Brevant; the business model centers on barter (inputs repaid with grain) plus agronomic advisory. The headline event: Bunge signed an MOU in Nov 2021 to acquire a minority stake, adding grain-storage and trading muscle. It finances heavily through agri-receivables certificates (8 CRA/CDCA deals since 2019, ~R$217M+, incl. R$145M in 2025 via Ecoagro and a tokenized CDCA with Banco BV). Corporate governance is professionalizing SA fechada since 2019, board expanded with independents in 2025-26, new CFO Flvio Sales (2025); founder-CEO Jonis Assmann still leads, with second generation (Bruno Franciosi) in management.
Martin LLP
October 13, 2026
•[ ransomware, finance, leak ]
Martin LLP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: martinllp.net. martinllp.net Martin LLP Martin LLP is a boutique business law firm founded in 1996, with offices in Stamford and New York. It focuses on middle-market companies, private equity sponsors, lenders, and business owners. Core practices: M&A and private equity, banking and finance, commercial litigation, and commercial real estate. The firm positions itself as partner-led, with small teams and senior lawyers doing hands-on work on deals from a few million to several hundred million dollars. Its people come from large national firms like Skadden, Latham & Watkins, Mayer Brown, and Schulte Roth. It publishes actively on M&A topics, notably representation and warranty insurance (RWI). It is recognized in regional rankings such as Best Law Firms 2026 for Corporate Law in Stamford.
Company #72
October 16, 2026
•[ ransomware, technology, finance ]
Company #72 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-16. Software / fundraising services California, USA | [PENDING EXPOSURE]
WSBI-ESBG
October 16, 2026
•[ ransomware, finance ]
WSBI-ESBG was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-16. Sector: Financial Services. Country: Belgium. Website: www.wsbi-esbg.org. Belgium
