SILIKO d.o.o.
November 4, 2026
•[ ransomware, manufacturing, financial ]
SILIKO d.o.o. was listed as a victim on the leak site of the Aoqin ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: Slovenia. Siliko d.o.o. is a development supplier and manufacturer of technical products made of elastomers and thermoplastics with over 30 years of tradition. During this period, production program expanded substantially and nowadays includes activities which offer customers a comprehensive range of services from draft design and construction to tool making and mass production. 70 percent of our production is being exported to the European Union markets, predominantly to buyers from the German automotive industry. At the same time, we are an important supplier for the household appliances industry on the European market, also cooperating with partners in the electrical, sanitation and construction industries. With state-of-the-art technology, knowledge and experience, we strive to offer the best products and to go beyond our customers expectations. Status: Not paid. Data publication: 2026-11-09 14:00 UTC. Revenue: $61.6M. Employees: 130. Data type: banking, clientsData, confidential.
Food Bank of Central Louisiana
November 4, 2026
•[ ransomware, leak, financial ]
Food Bank of Central Louisiana was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Agriculture and Food Production. Country: United States of America. Website: www.fbcenla.org. About Food Bank of Central Louisiana\ The Food Bank of Central Louisiana is a nonprofit organization dedicated to alleviating hunger in Central Louisiana through collaboration and food distribution programs. They provide assistance to over 42,500 households annually, offering resources such as SNAP applications and mobile pantry services. Their initiatives include programs aimed at strengthening children and nourishing seniors, addressing the specific needs of vulnerable populations. The organization encourages community involvement through donations and volunteer opportunities to support their mission. The Central Louisiana Food Bank was the victim of a cyberattack, resulting in the theft of more than 130 GB of confidential data. The stolen data includes documents such as banking and financial information, personal data of employees and clients, databases, and other important company information.
Unilever
November 4, 2026
•[ ransomware, manufacturing, leak ]
Unilever was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Unilever is a British multinational consumer goods company headquartered in London. It owns over 400 brands, including Dove, Knorr, Hellmann's, and Rexona, spanning beauty, personal care, home care, and foods, serving consumers in around 190 countries worldwide.
We hold 665K contacts, 5.5K OTM accounts with roles and logins, 14M locations, 3.8M shipments, 229M status records, 13.8K invoices, plus 838K distributor loyalty profiles and ledgers. 79 gigabytes, 1.8 million files, three regions.
Unilever7.z is about 79GB decompressed.
Our ransom demand is only $15,000,000 in BTC
Emails with instructions will be sent to you shortly, if you have failed to receive them,
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Undisclosed AT&T customers
May 1, 2018
•[ insider, financial, technology ]
An AT&T store worker in Portland, Oregon used his access to AT&T systems from May 2018 to Nov 2019 to SIM-swap customers' numbers to co-conspirators' devices, letting them intercept login codes and access bank accounts (~$600,000 intended losses). He got 16 months in prison.
Undisclosed French business-software hosting company (Software; pseudonym)
June 24, 2021
•[ ransomware, financial, technology ]
During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
Undisclosed companies
September 1, 2021
•[ phishing, financial, technology ]
Scattered Spider crew members phished credentials at 12+ companies (entertainment, telecom, tech, BPO, IT, cloud, crypto) in 2021-2023, stole company data and millions in crypto from 29 victims. Ahmed Elbadawy's guilty plea surfaced Sept 2026 via a forfeiture filing.
Syrian National Army Military Police Investigation Section, Suluk
May 10, 2023
•[ leak, malware, government ]
A RedLine infostealer infected a senior officer's Windows computer used by the Syrian National Army Military Police Investigation Section in Suluk on May 10, 2023. Hudson Rock recovered a stealer log timestamped 09:39 showing the unit-named Windows account and theft of saved passwords, browser cookies, a live Telegram session, and 14 desktop files, including seven active detainee interrogation records. Five recovered Office lock files indicate some records were open when the malware ran. The log subsequently circulated in criminal markets. The individual RedLine affiliate responsible has not been identified. RedLine is commodity malware-as-a-service designed for credential and financial-data theft and resale, supporting Criminal actor type and Financial motive.
Undisclosed individual
August 18, 2024
•[ social, financial, phishing ]
A Washington, D.C. crypto investor lost over 4,100 bitcoin (over $240M) on Aug. 18, 2024 after callers posing as Google and Gemini support got access to his Google Drive and security codes. Ringleader Malone Lam faced a plea hearing; 18 people were charged.
Excelsior Orthopaedics
January 7, 2025
•[ ransomware, healthcare, financial ]
Excelsior Orthopaedics suffered a ransomware attack attributed to the Monti threat group, which disrupted operations across all seven of its facilities in Western New York. The attackers exfiltrated approximately 300GB of sensitive data, including medical and financial records, and rendered core systems nonfunctional for several weeks, forcing staff to rely on manual processes during recocery
Optima Tax Relief
May 1, 2025
•[ ransomware, financial, leak ]
Ransomware operators infiltrated Optima Tax Reliefs network and stole client tax-case data before leaking samples online. The company confirmed exposure of 3,114 individuals SSNs and financial account details but reported no further operational disruption.
Upper Township
October 5, 2025
•[ leak, government, financial ]
Upper Township determined that an unauthorized person accessed its network on October 5, 2025 and may have acquired files containing residents' and other individuals' personal and financial information. The township discovered suspicious activity on December 8 and shut down affected systems while investigating. The investigation was completed on April 13, 2026. Officials reported no known actual or attempted misuse of the information.
Greenbaum, Rowe, Smith & Davis LLP
November 25, 2025
•[ hack, brute-force, healthcare ]
An unauthorized party used compromised login credentials to access Greenbaum, Rowe, Smith & Davis LLP's network server between November 25 and November 27, 2025. The firm discovered the intrusion on November 27 and determined on April 15, 2026 that files containing patient information from healthcare clients had been acquired. Greenbaum reset passwords, replaced compromised equipment, notified law enforcement, and offered identity-monitoring services. No operational disruption was reported, no group claimed the attack, and no stolen data was found published or misused. Criminal and Financial are bounded inferences from credential-based theft of identity and health data; the actor and country remain undetermined.
Upbit
November 27, 2025
•[ financial, hack, finance ]
Unauthorized exploitation of Upbits Solana hot wallet enabled attackers to initiate a sequence of unauthorized withdrawals totaling roughly $38 million USD over a 54-minute window (04:4205:36 KST). No user data loss or service outage was reported, and Upbit moved remaining assets to cold storage and pledged full customer reimbursement.
Lifespan Physician Group of Massachusetts, Inc. d/b/a Brown Health Medical Group-MA
December 15, 2025
•[ leak, healthcare, financial ]
An unauthorized actor accessed a historic file server at Brown Health Medical Group-MA's Hawthorn location between December 15 and December 16, 2025. The organization isolated the affected server and later determined that files containing personal, medical, financial and personnel information had been accessed. The electronic health record system was not affected. HHS reports 311,760 affected individuals, including 290,357 Massachusetts residents. No known ransomware or extortion group has claimed responsibility.
Undisclosed banking customers, financial-services customers, and small-to-medium businesses in Portugal, Spain, Mexico, and Latin America
February 24, 2026
•[ phishing, malware, financial ]
WatchGuard telemetry identified Grandoreiro infections beginning in late February 2026. Phishing links delivered ZIP archives containing legitimate applications and malicious DLLs for side-loading, while a related campaign used an obfuscated VBS file to install the banking trojan. The confirmed victim population comprised banking and financial-services customers, small-to-medium businesses, and users in Portugal, Spain, Mexico, and other parts of Latin America; references to banks in the malware code identify targeted banking applications, not confirmed compromises of the banks themselves.
Undisclosed Windows users seeking system and hardware utilities
March 1, 2026
•[ malware, technology, financial ]
Beginning in March 2026, attackers used poisoned search results and fake download sites impersonating utilities such as CrystalDiskInfo, HWMonitor, PDFgear, and FurMark to compromise Windows users, with some malicious links also appearing in AI-chatbot recommendations during April. The malware installed ScreenConnect for persistent access, collected host information, and deployed GPU-focused cryptocurrency miners through process hollowing. Microsoft identified more than 150 malicious domains associated with the campaign.
Elliott-Lewis Corporation
March 11, 2026
•[ leak, financial, manufacturing ]
Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
Paidwork LLC
March 29, 2026
•[ hack, leak, financial ]
Hackers claimed to have obtained data from Paidwork in March 2026 and offered it for sale. An approximately 11 GB database attributed to Paidwork was subsequently published in July and contained more than 23 million unique email addresses along with extensive profile, financial, device, transaction, and authentication data. Paidwork stated that it had not confirmed compromise of its systems or user accounts and was investigating the reported incident.
Ohio Living
April 16, 2026
•[ ransomware, healthcare, financial ]
Ohio Living detected suspicious network activity on April 17, 2026. Its investigation determined that an unauthorized actor accessed systems and copied files from its network between April 16 and April 17. Ohio Living secured the network and began reviewing the files; no operational disruption was reported, and the 500-person figure reported to HHS was preliminary. On August 5, the Dark Project ransomware group claimed responsibility for an April 2026 attack on Ohio Living and alleged that it stole at least 600 GB, including at least 5,000 files containing employee, patient, medical, insurance, Social Security, financial, and banking information. Ohio Living had not publicly confirmed the attribution or the claimed volume.
Goodwin Procter LLP
April 16, 2026
•[ ransomware, financial, technology ]
Goodwin Procter disclosed a spring 2026 unauthorized data-access incident dated April 16 in state records. The firm notified a limited number of clients and affected people. Insurance-industry reporting linked the extortion to Luna Moth and reported a ransom payment around US$10 million, citing people familiar with the matter; Goodwin did not independently confirm that payment or attribution. Its effect was acquisition of sensitive information, without verified encryption or service shutdown. Criminal/Financial is supported by the attributed financially motivated extortion campaign.
