Thomas Y. Pickett & Co., Inc.
October 5, 2026
•[ ransomware, technology, finance ]
Thomas Y. Pickett & Co., Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. Website: typco.com. [consulting] Thomas Y. Pickett & Co., Inc. founded in 1926, headquartered in Addison/Dallas, Texas is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation.
Inventory:
13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials
Complete HR records for all 40+ employees Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices
11 GB Azure DevOps repository the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices
200+ client contracts with pricing for every county appraisal district they serve the competitive intelligence gold mine
Complete financial records bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025
A developer's password exposed in a directory name visible to anyone who looks at the file listing
A PKCS#12 digital signing certificate (private key) for an HR manager enabling document forgery
J&D Financial
October 6, 2026
•[ ransomware, finance ]
J&D Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services. Website: www.jdfinancial.com.
Michael K Shelby, CPA
October 6, 2026
•[ ransomware, finance, leak ]
Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi
ve range of tax and accounting services. They provide individual tax preparation, estate and tr
ust tax services, and business tax services, ensuring clients meet their tax obligations effici
ently.
We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs
, payment information), projects, client internal information and so on.
Skaff Group
October 3, 2026
•[ ransomware, retail, finance ]
Skaff Group was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-03. Sector: Other. Website: skaffgroup.com. Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More
Sheppard, Mullin, Richter & Hampton
October 5, 2026
•[ ransomware, leak, finance ]
Sheppard, Mullin, Richter & Hampton was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. They offered $4.900.000 to keep the data from being published.
magnals.com
October 6, 2026
•[ ransomware, leak, legal ]
magnals.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: magnals.com. confidential data belonging to all these companies; magnals.com is responsible for the leak.
alunanuova@magnals.com
sraynal@magnals.com
info@ranshelpfi.com
kcawley@kirkland.com
pforan@hueston.com
mtodisco@hueston.com
sschnier@hueston.com
tking@hueston.com
lcohen@omm.com
lhack@motleyrice.com
monica.pedroza@morganlewis.com
thomas.hilton@morganlewis.com
kvose@motleyrice.com
lshaarda@motleyrice.com
mmontoya@skikos.com
tamara.giulianelli@morganlewis.com
karl.stampfl@kirkland.com
lshuler@hueston.com
khermiz@motleyrice.com
zachary.byer@kirkland.com
paul.weeks@kirkland.com
mpendell@motleyrice.com
mrivera@kirkland.com
mrobinson@robinsonfirm.com
zac.ciullo@kirkland.com
kcalcagnie@robinsonfirm.com
mcrawford@skikos.com
pdagostino@robinsonfirm.com
maureen.barber@morganlewis.com
pwilson@occourts.org
judith.hanratty@morganlewis.com
lelliott@motleyrice.com
Paulie.Fabian@da.ocgov.com
kding@hueston.com
mkaba@hueston.com
jhueston@Hueston.com
lstarks@hueston.com
mpurpura@hueston.com
smayer@hueston.com
tbecerra@omm.com
rebecca.zieben@morganlewis.com
kgrossman@omm.com
jschneller@omm.com
rmassing@hueston.com
mkaiser@omm.com
meimark-itc-1290@meimark.com
rwells@meimark.com
kdeighan@calfee.com
jhartman@merchantgould.com
jmiller@merchantgould.com
dylansuggsvideo@gmail.com
mso@levinperconti.com
MMirkovic@levinperconti.com
production@magnals.com
b.scott@magnals.com
samuel.ventresca@blankrome.com
JFeigenbaum@PostSchell.com
dspencer@magnals.com
jfrancis@magnals.com
dbrown@magnals.com
nbernik@magnals.com
mcantu@magnals.com
shorwitz@maganls.com
jtaran@jtaranlaw.com
michael@martinovskylaw.com
lori@costanzo-law.com
lucy.goodnough@costanzo-law.com
lawdesk@lex-omni.com
babbdesignsinc@gmail.com
gt@turitzadr.com
fburke@burkemediation.com
skaplan@Steptoe.com
mail@questvideoservice.com
balindadunlap@yahoo.com
lucy.marrone@costanzo-law.com
smisbah@steptoe.com
standard
shorwitz1@gmail.com
jnuttall@Steptoe.com
ktellez@steptoe.com
casey.griffin@ankura.com
marc.blanch@ankura.com
ECarapella@littler.com
rwangsness@occourts.org
mdjuric@omm.com
vharting@occourts.org
rhickman@magnals.com
revaldez@omm.com
cmonroe@motleyrice.com
csuarez@Steptoe.com
tfu@Steptoe.com
jcooper@steptoe.com
nathan.carpenter@dlapiper.com
sivakumarm@ballardspahr.com
sbylina@ziliak.com
disaacs@morrisoncohen.com
Michelle.Gorman@lewisbrisbois.com
kayla.clark@morganlewis.com
djensen@skikos.com
rklink@motleyrice.com
katherine.vaky@morganlewis.com
madock@rescar.com
aschaffer@rescar.com
mshepard@babstcalland.com
carolwarfield2005@yahoo.com
mlmarais@gmail.com
sean.nicholson@cornell.edu
justin.mccrary@gmail.com
minnie@b-henry.com
BVinci@duanemorris.com
jgoldsmith@magnals.com
mdundervill@motleyrice.com
karen.angelo@lewisbrisbois.com
rbaeza@bsfllp.com
vayala@bsfllp.com
teutafani@quinnemanuel.com
violatrebicka@quinnemanuel.com
joten@hueston.com
ddelgrande@hueston.com
edunbar@magnals.com
bmccafferty@magnals.com
VNestor@magnals.com
MJimenez@ktanda.com
HValgoi@magnals.com
VRice@ktanda.com
HPorter@CHDLawyers.com
eflorian@coplancrane.com
david@yegeresq.com
scaldwell@pmtlawfirm.com
gstrong@gllawgroup.com
mguararra@guararralaw.com
RFUMO@travelers.com
manan74@yahoo.com
johara@fbzlaw.com
dperkins@robinsonfirm.com
sfranklin@magnals.com
sarajenkins@quinnemanuel.com
dstraite@dicellolevitt.com
brichardson@BSFLLP.com
rmcgee@forthepeople.com
jcabezas@forthepeople.com
wsangster@magnals.com
SWood@chuhak.com
cemling@cyp-law.com
chartley@magnals.com
RKrishnapriyan@durietangri.com
enyborg-burch@bsfllp.com
trodriguez@bsfllp.com
jomairecrawford@quinnemanuel.com
carlspilly@quinnemanuel.com
eharding@magnals.com
ABrausa@durietangri.com
VRanieri@durietangri.com
drew@kzllp.com
michael@skipti.com
ttucker@calfee.com
bliu@calfee.com
dlikens@calfee.com
outsider12b@hanmail.net
ProcopioITC1290@procopio.com
youngmin.hwang@lge.com
hojun.suh@lge.com
jaeoak.kho@lge.com
jin.seomoon@lge.com
Nicholas.jackson@dentons.com
Kevin.greenleaf@dentons.com
Tyler.goodwyn@dentons.com
Mark.hogge@dentons.com
Song.jung@dentons.com
alexjo.translator@gmail.com
annpark@pacls.com
kuyoung.son@lge.com
byunghwan.ahn@lge.com
tg.kong@lge.com
ejmichelle@gmail.com
Vivian.sandoval@dentons.com
Matthew.sim@dentons.com
Nah-eun.kim@dentons.com
jhochberger@meimark.com
jzhang@meimark.com
mei@meimark.com
rmyers@prmpclaw.com
kfisch@Steptoe.com
sreid@steptoe.com
willowashlynn@gmail.com
vikashni@vashlegalservices.com
sbowlby@plunkettcooney.com
arodas@magnals.com
rkappers@steptoe.com
tyebernetsky@Steptoe.com
dgelwicks@Steptoe.com
kcappaert@steptoe.com
bholt@steptoe.com
tmurray@magnals.com
amanda@levinzeiger.com
mmiller@steptoe.com
johnsmith@supercoolattorneys.org
AnnieLee@mofo.com
ckwark@steptoe.com
pbirdsall@steptoe.com
johnsmith@magnals.com
VCTeam@magnals.com
BNYH
October 6, 2026
•[ ransomware, finance ]
BNYH was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services.
B-accountants
October 6, 2026
•[ ransomware, finance ]
B-accountants was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Country: Netherlands. [AI generated] N/A
I don't have verified, reliable information about a specific company named "B-accountants." There are likely multiple small accounting or bookkeeping firms using similar names across different countries, and without additional context (such as a website, registration number, or location), I cannot confirm which entity you're referring to or provide accurate details about its operations, industry specifics, or country of registration.
Company #117
November 2, 2026
•[ ransomware, finance, healthcare ]
Company #117 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-02. Country: United States of America. dental insurance United States | [PENDING EXPOSURE]
Princeton Management
November 2, 2026
•[ ransomware, finance ]
Princeton Management was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-11-02. Sector: Financial Services. Princeton Management offers a range of residential and commercial properties, emphasizing quali
ty and competitive pricing. The company is dedicated to providing excellent customer service, w
hich has led to a strong community of residents choosing their locations.
We will upload 130gb of corporate data soon. Employee information (phones numbers, addresses, s
cans, military veterans information), contracts and agreements, client and partners information
, financials, specifications and drawings and so on.
avsa.com.ar
October 6, 2026
•[ ransomware, finance, hack ]
avsa.com.ar was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: Argentina. Website: avsa.com.ar. Argentina Valores S.A. is a financial services company focused on capital markets, registered with t...
Rechtsanwaltskanzlei Dr. Bien
October 12, 2026
•[ ransomware, leak, finance ]
Rechtsanwaltskanzlei Dr. Bien was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Professional Services. Country: Germany. Website: Rechtsanwaltskanzlei Dr. Bien. [law] Rechtsanwaltskanzlei Dr. Bien a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen.
The exposed material includes:
2,387 WinSolvenz case databases each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details.
492+ forced administration (Zwangsverwaltung) case files property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports.
80 GB MailStore email archive the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures.
1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) three MSSQL database backups containing every electronic communication between the firm and every German court.
35 employee records 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements.
DATEV tax/accounting archives 33 directories of income tax backups, insolvency accounting, third-party mandates.
MarieBelle New York
October 13, 2026
•[ ransomware, retail, healthcare ]
MarieBelle New York was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Retail & E-Commerce. Country: United States of America. confectionery & telehealth (US) New York, USA | Complete QuickBooks company file of a New York confectionery and luxury foods company: every transaction, customer, vendor and payroll record; Complete inventory database with product, cost and supplier data; Telehealth platform files and clinical system records from hospital partner infrastructure | [NOT PAID EXPOSED]
Admirals Trading
October 2, 2026
•[ ransomware, retail, finance ]
Admirals Trading was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Financial Services. Country: United Arab Emirates. Admirals Trading LLC (admirals.ae) is a Dubai-based food and beverage company under the Saudi conglomerate Rashed Abdul Rahman Al Rashed & Sons Group, with over 20 years of experience in the UAE market, specializing in the distribution of 60+ international and local F&B brands, food manufacturing and processing, and third-party logistics services across retail, food service, van sales, and wholesale channels, having recently expanded its operations from the UAE into Saudi Arabia while also running an online store called "Buy Like Chefs."
Wavecrest HFA
July 7, 2026
•[ ransomware, finance ]
Wavecrest HFA was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-07-07. Sector: Financial Services. Country: United States of America. 12,143 Files, 267 Folders
23,991,067,648 bytes
O'Hagan Meyer
October 8, 2026
•[ ransomware, finance ]
O'Hagan Meyer was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-08. Sector: Professional Services. Website: ohaganmeyer.com. U.S. national law firm focused primarily on business litigation and labor & employment law. It was fou
RealManage
October 9, 2026
•[ ransomware, finance, technology ]
RealManage was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Professional Services. Country: United States of America. RealManage RealManage is a privately held, tech-enabled community association management company headquartered in Plano, Texas. Founded in 2002 and backed by American Securities, the company has grown into one of the largest and fastest-growing community association management firms in the United States, having been recognized on the Inc.1.84 TBThe tax, banking and debt secrets of hundreds of American HOAs and thousands of homeowners - complete with SSNs, account numbers and signatures.Genuine W-9 forms with Social Security numbers, addresses and signatures; IRS 1099-MISC/NEC e-file transmissions for 20142025 - thousands of vendor TINs/SSNsHomeowners' banking keys: ACH debit files with routing and account numbers, USAA brokerage statements, signed bank signature cardsPeople's debts by name: assessments through September 2026, bankruptcies, late-fee waivers, hardship letters from debtors begging for payment plansPersonal documents: HUD-1 home purchase settlements (names, prices, mortgages), signed waivers with addresses, HOA election ballots with voter namesFull SQL Server databases: RM_Warehouse, RM_Sales, RM_Portals, CiraNetIdentity (portal accounts), CiraBooks_GL (general ledger)Mail and document flow: CiraMail$, CiraDocs$, SalesDocs$ More
mblllp
October 9, 2026
•[ ransomware, finance ]
mblllp was listed as a victim on the leak site of the arcusmedia ransomware group; the attack is estimated to have taken place on 2026-10-09. Country: Canada. Website: mblllp.ca. mblllp.caOur objective at MBL LLP is simple: To always exceed the expectations of our cli Deadline: 2026-10-16 12:44:00.000000
lopay
October 9, 2026
•[ ransomware, finance, technology ]
lopay was listed as a victim on the leak site of the Black X ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: lopay.com. Lopay is a UK-based fintech company that provides a payment platform enabling small and medium-sized enterprises (SMEs) and sole traders to accept credit card and mobile payments, as well as manage their sales and settlements. This includes financial information belonging to client companies, such as customer payment details, card information, banking data, transaction history, and payment terminal information.
Gress Clark Young & Schoepper
October 10, 2026
•[ ransomware, technology, healthcare ]
Gress Clark Young & Schoepper was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Professional Services. Country: United States of America. Website: gressandclarklaw.com. Gress Clark Young & Schoepper 167,804 files / ~166.4 GBBanking details - of the firm and its clients.SSNs + signatures of clients/witnesses; W-9, I-9 forms with DL/SSN card copies; W-4 forms.BIIA case-management procedures (Board of Industrial Insurance Appeals): default orders (Order of Default), internal 'Conference Questions', consulting-fee payments to experts.Firm finances: the firm's QuickBooks company file, VOID checks bearing signatures, expert-payment records, SaaS invoices.Medical photos and imaging; hundreds of pages of PHI/APF (Activity Prescription Forms) - X-rays, complete medical records.'Coaching' letters to doctors - including a letter to the physician in the Jachacy matter with wording indicative of steering a medical opinion ('coaching letter') - a potential ethics violation regarding witness handling.Credentials/access to the SPC e-file system (court e-filing).Disciplinary action against partner Daniel W. Gress. More
