Williams & Sparages
November 26, 2025
•[ ransomware, financial, technology ]
Williams & Sparages was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-11-26. Sector: Professional Services. Country: United States of America. Website: wsengineers.com. Williams & Sparages is a full-service engineering firm specializi
ng in civil engineering, planning and development, surveying and
mapping, and construction services.
We will upload about 127gb of corporate documents soon. Clients i
nformation, employee personal information, financials, credit car
d details, projects, contacts and agreements, etc.
mazda-ploiesti.ro
November 26, 2025
•[ ransomware, manufacturing, leak ]
mazda-ploiesti.ro was listed as a victim on the leak site of the benzona ransomware group; the attack is estimated to have taken place on 2025-11-26. Sector: Manufacturing. Country: Romania. Website: mazda-ploiesti.ro. Ransom demand: $90,000. Data size claimed by the group: 200 GB.
Casting House
September 2, 2025
•[ ransomware, manufacturing, financial ]
Casting House was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-09-02. Sector: Manufacturing. Country: United States of America. Website: castinghouse.com. Casting House is a full-service custom jewelry manufacturing comp
any that provides jewelers and designers with access to manufactu
ring solutions that will help grow their inventory.
We are ready to upload 10GB files of corporate documents such as:
personal employee data, financials, agreements and contracts, co
nfidential files, credit card details, etc.
Panini Kabob Grill
November 28, 2025
•[ ransomware, retail, leak ]
Panini Kabob Grill was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-11-28. Sector: Hospitality. Country: United States of America. Website: paninikabobgrill.com. Panini Kabob Grill specializes in preparing fresh and healthier M
editerranean food using high-quality ingredients in a scratch kit
chen.
We are ready to upload 60GB files of corporate documents such as:
detailed personal employee information (SSN, DLs, passport, phot
o, phone, emails and so on), credit cards, detailed financials, a
greements and contracts, etc.
Parrish Tire
September 25, 2025
•[ ransomware, retail, financial ]
Parrish Tire was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-09-25. Sector: Transportation. Country: United States of America. Website: parrishtire.com. Parrish Tire Company is one of the largest tire dealers in the So
utheast, operating wholesale, retail, and commercial truck tire c
enters in NC, SC, VA, GA, and OH.
We are ready to upload 10GB files of corporate documents such as:
personal employee data, client data (~150 credit cards details,
and other information), financials, agreements and contracts, etc
.
NIUS
July 13, 2025
•[ leak, financial, technology ]
In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly. The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry).
Campaign: Incidents in Brazil's financial sector (roundup)
July 5, 2025
•[ Financial ]
Roundup article listing recent cybersecurity incidents impacting Brazils financial sector; logged as campaign-level entry.
Veradigm Inc.
September 17, 2025
•[ financial, healthcare ]
Veradigm reported on September 26 2025 that it detected unauthorized access to portions of its network on September 17 2025. Investigators determined that data on roughly 1.1 million individuals was accessed, but no encryption, ransom demand, or operational disruption occurred. The actor has not been identified and the intrusion appears financially motivated.
Fairmont Federal Credit Union
September 30, 2023
•[ leak, financial, finance ]
Between September 30 and October 18, 2023, Fairmont Federal Credit Union in West Virginia experienced unauthorized access to its internal file servers and databases. Attackers exfiltrated sensitive personal, financial, and limited medical information of about 187,000 members. No data encryption or ransomware activity was reported.
Cancer patient in charity livestream
September 25, 2025
•[ financial, malware, healthcare ]
A serious accusation in Argentina alleged that influencer Valentn scammed a cancer patient during a charity livestream using a video game called BlockBlasters, which contained hidden malware that stole cryptocurrency from the victims wallet.
Russia’s System for Fast Payments (SBP)
September 24, 2025
•[ financial, ddos, finance ]
Ukraines Defense Intelligence Directorate (GUR) conducted a large-scale distributed denial-of-service (DDoS) operation on September 24, 2025, targeting Russias System for Fast Payments (SBP). The attack caused a full nationwide disruption of online payment services for several hours, halting financial transfers and transaction processing across Russian banks. TransTeleComs supporting network infrastructure was also temporarily overloaded during the event.
Unnamed hotels in Brazil
June 13, 2025
•[ phishing, financial, malware ]
TA558 used LLM-generated JS/PowerShell loaders in phishing emails (Portuguese/Spanish) to deploy Venom RAT against hotels (Brazil/Spanish-speaking markets), aiming to siphon guest credit-card data from hotel systems/OTAs; observed in summer 2025, with no named victims or outages.
Wytec
August 25, 2025
•[ hack, financial, technology ]
On August 25, 2025, Wytec International's website was defaced twice; site remains offline. Operations impacted included cancellation of a September 2 seminar. Company notified authorities and engaged forensic experts, citing financial losses as a result.
Sinqia
August 29, 2025
•[ financial, hack, finance ]
On Aug 29, 2025, attackers used stolen vendor credentials to breach Sinqia's access to Brazils Pix system, attempting $130M in fraudulent transfers. Immediate action halted operations; some funds recovered. No data breach occurred.
Npm ecosystem
August 9, 2025
•[ phishing, malware, hack ]
Phished npm maintainer account used to publish trojanized releases of widely used packages; malicious code attempted crypto address swapping. Packages were pulled within ~2 hours, yet reached ~10% of cloud environments; profits remained under $1,000; no confirmed data theft or sustained outages.
National Credit Information Center (CIC), State Bank of Vietnam
September 10, 2025
•[ hack, leak, financial ]
VNCERT confirmed signs of intrusion targeting personal-data theft at CIC; ShinyHunters/Scattered Spider claimed ~160M records, allegedly exploiting end-of-life software; data offered for sale with samples posted.
Multiple Crypto Users
August 9, 2025
•[ financial, hack, malware ]
Malicious updates to popular npm packages deployed credential/wallet-stealing malware impacting crypto/DeFi users; community advisories urged halting transactions and rotating secrets; maintainers removed tainted packages; early losses ~$900$1,043 total.
Multiple Russian Entitites
July 9, 2025
•[ financial, ddos, technology ]
A DDoS attack by Ukrainian military intelligence disabling fuel payment services (fuel cards), taking down infrastructure of Rostelecom, Lukoil, KCorp, etc., causing disruption in fuel card functionality; over 700 switches and 13 servers in two data centers disabled; financial damage estimated at US$13 million.
Sree Padmanabhaswamy Temple
June 13, 2025
•[ hack, insider, financial ]
On June 13, 2025, the Sree Padmanabhaswamy Temples computer system in Kerala, India, was hacked, suspected to involve a former IT staff member retaining access after transfer. Critical operational and financial records were accessed and tampered with, though no encryption or ransomware-style disruption was reported. The breach was discovered by temple officials and reported to police, with a forensic probe launched.
CoinDCX
July 19, 2025
•[ financial, hack, finance ]
CoinDCX, Indias largest crypto exchange, suffered a $44M breach in July 2025 after attackers compromised a backend server connected to a hot wallet. Withdrawals were suspended but later resumed with assurances user funds were safe. Attribution remains undetermined; some analysts suggest Lazarus Group, while Indian police arrested a local engineer tied to suspicious freelance work.
