FIZA
June 10, 2026
•[ ransomware, leak, financial ]
FIZA was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-10. Sector: Manufacturing. Country: Czechia. FIZA, a.s. is an established, medium-sized auditing and consulting company with a good capital base enabling its further development.
Its roots go back to the very beginning of the 1990s, when it provided its services in the form of its legal predecessor, the association of individuals Ing. Ji Ficbauer, civilingenjr. FIZA.
The current joint-stock company was established in 2001.
We specialize in auditing, economic-organizational and tax consulting.
We approach every job and every client carefully and responsibly. We want to become your long-term and trustworthy partner.
We will be happy to accommodate you even in the case of one-off cooperation.
Laek: 100GB
WE HAS COLLECTED SUCH DATA AS:
- Confidential documents
- Clients Data
- NDA
- Financial data
- Operations
- Corporate data
- Business Agreements
- Development
- Financial databases, all transactions, all clients
And a lot of other VERY IMPORTANT information!
Cattani
May 18, 2026
•[ ransomware, leak, manufacturing ]
Cattani was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-05-18. Sector: Manufacturing. Country: Italy. Website: www.cattani.it/en. Established in 1967, Cattani S.p.A. is now a leader in the dental field, exporting its range of products to all continents. After becoming a publicly limited company in 1981,Cattani S.p.A. founded the division Esam in 1984, extending the groups business activities into the industrial field. In 2003 Cattani S.p.A. launched Magnolia,a chemical company specialising in the production of detergent disinfectant products for surgery instruments and, in particular, dental aspiration systems.The Cattani group designed and manufactured one of the scientific components in the famous NASA space shuttle. Due to our reputation for reliability,Ferrari Engineering (supplier of the European Space Agency) chose us as one of its prestigious suppliers for the production of a 180 gram compressor,which reached a pressure of 38 bar. The group has also taken part in the Eurostar project, the pride of the Italian railway system, producing the trains pressurization system.-Personal information of employees and clients -Financial documents- 200 000 + other files https://www.***.it/en/
fineconsulting
June 11, 2026
•[ ransomware, financial, technology ]
fineconsulting was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-11. Sector: Professional Services. Country: Romania. Website: fine-consulting.com. Unauthorized access has been gained to the company's confidential files, including client data, proprietary R&D, and financial documentation.
Kewaunee Scientific
June 11, 2026
•[ ransomware, manufacturing, financial ]
Kewaunee Scientific was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-11. Sector: Manufacturing. Country: United States of America. Total data: 504GB
Contains: 852,141 Files, 120,670 Folders
Documents: Clients KYS & NDA, Financial documentation, Contracts, Drawings, Audit reports,
Personal data, Contractors and subcontractors information, Scanned documents and much other important information.
Tape: confidential
Clients: Pfizer, Rusan Pharma Ltd., Samsung and many other world-famous laboratories.
full information will be released in a few weeks
FÉTIS Group & SECOM Engineering
June 11, 2026
•[ ransomware, technology, financial ]
FTIS Group & SECOM Engineering was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-06-11. Sector: Professional Services. Country: France. Data breach at an engineering company. Financial records, project details, and personal information.
moody.edu
June 15, 2026
•[ ransomware, education, technology ]
moody.edu was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-06-15. Sector: Education. Country: United States of America. Website: moody.edu. Over 23 gigabytes of Moody Bible Institute data (1,300+ files, tens of millions of records) was compromised across enrollment, donor relations, payroll, and communications systems (MBI, EDC/Salesforce leads, PeopleSoft PS_COMMUNICATION, Horizon SIS, WHPD donor database, and Cadence admissions), including 46 million communication records, 2.2 million enrollment lead records, 108,000 biodemographic master files with addresses and birthdates, 3.3 gigabytes of donor gift data, employee payroll XML with home addresses and earnings, 1,100+ admissions outreach files, and student housing assignment records. This is a final warning to reach out by 18 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 16 June 2026 | Warning: FINAL WARNING PAY OR LEAK
thecreditpros.com
June 16, 2026
•[ ransomware, financial, technology ]
thecreditpros.com was listed as a victim on the leak site of the Icarus ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Financial Services. Country: United States of America. Website: thecreditpros.com. TheCreditPros' Salesforce instance was breached and 263MB of data were taken from it, including:
01_input_fullcards.csv - 51,691 lines of full-info credit/debit cards: Id,First_Name__c,Last_Name__c,Middle_Name__c,Email__c,Credit_Card__c,CCV__c,Exp_Month__c,Exp_Year__c,SSN__c,DOB__c,Street_Address__c,City__c,State__c,Zip_Code__c,Mobile_Number__c,IP_Address__c,Transaction_ID__c,Status__c,CreatedDate
02_contacts_ssn.csv - 847,990 lines: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,HomePhone,SSN_hidden_field__c,Birthdate,MailingStreet,MailingCity,MailingState,MailingPostalCode,Status__c,Bank_Account_Number__c,Bank_Name__c,Bank_Account_Type__c,CreatedDate
03_creditcards.csv - 722,403 lines: Id,Card_number__c,card_number_hidden__c,cvv__c,expiration_month__c,expiration_year__c,Active__c,BIN__c,Issuing_Bank__c,Prepaid__c,CreatedDate
04_leads.csv - 3,598 liens: Id,Name,FirstName,LastName,Email,Phone,MobilePhone,Street,City,State,PostalCode,Status,CreatedDate
Pay or leak!
Data stolen: PII, Credit cards
Diamond Truck Centres
June 16, 2026
•[ ransomware, leak, manufacturing ]
Diamond Truck Centres was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-06-16. Sector: Transportation. Country: Canada. [dealership, trucks] *** Western Canada's largest International Trucks dealership group (9 dealer + 13 sub-dealer locations, ~$63M revenue, 250 employees).
The dataset spans 17 years of unbroken operational history (20092026) and represents the full shared-drive contents of the entire company: HR, payroll, accounting, military contracts, and individual employee profiles.
The exposed material includes:
53 customer Pre-Authorized Debit (PAD) forms full bank account numbers, transit numbers, institution numbers, and authorized signatures for commercial customers including the City of Saskatoon.
17 years of employee payroll data wages, SINs (implied), pension contributions, benefits, termination calculations for every employee since 2009.
Biometric data ADP fingerprint timeclock enrollment records for all locations.
Immigration documents for 6+ foreign workers LMIA applications, offers of employment, provincial nominee support docs.
System credentials in plaintext ADP timeclock passwords, manager training logins, safe combination.
Military contract documentation Diamond's Controlled Goods Security Plan (ITAR/CGP), MSVS delivery matrices, military vehicle VINs, CFB Edmonton and RCMP vehicle program data.
289 GB of daily bank deposit scans (20172026) customer cheque images with names, amounts, and account details.
A complete Outlook PST archive (166 MB) years of internal email likely containing credentials and customer data.
Smith Filter
June 17, 2026
•[ ransomware, manufacturing, financial ]
Smith Filter was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-06-17. Sector: Manufacturing. Smith Filter is a leading manufacturer of high-quality air and grease filters, established in 1
939. They offer a wide range of products including permanent, disposable, and high-efficiency f
ilters, catering to both OEM and custom orders.
We will upload 10gb of corporate data soon. Employee personal information (passports, SSNs, DLs
and other docs scans), credit cards information, projects info, clients information, NDAs, etc
.
Horizon Family Medical Group
June 18, 2026
•[ ransomware, healthcare, financial ]
Horizon Family Medical Group was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-18. Sector: Healthcare. Country: United States of America. Horizon Family Medical Group
A deep dive into 7 terabytes of internal data: from patient records to QuickBooks financial databases
In the modern world, data is the new oil. For a medical organization like Horizon Family Medical Group, it is also the foundation of trust between doctor and patient. We have conducted an independent and complete audit of this organization's data security. The results are catastrophic. We are in possession of the company's entire digital footprint, totaling **7 terabytes**, which includes 1TB of file data and 6TB of mission-critical SQL and QuickBooks databases.
The management of Horizon Family Medical Group was notified of their complete loss of data control. They chose silence. This blog exists to illuminate what they are desperately trying to hide. We will not be publishing the files. Yet. Instead, we will explain exactly what this data contains, so that every patient, employee, and partner can appreciate the full scale of the threat.
The Patient, Dissected. What We Know About You
Horizon Family Medical Group prides itself on a wide range of services, from primary care to specialized treatments. This range of services has now become a detailed vulnerability map for every single patient. Our data includes, but is not limited to:
Primary Care: Complete visit histories, diagnoses, prescriptions, lab results, and physicians' private notes about your lifestyle, habits, and family status.
Women's Health: Detailed information on gynecological exams, pregnancies, abortions, Pap smear results, STD diagnoses, and prescribed treatments. Everything you trusted only to your doctor.
Behavioral Health: The most sensitive category. Diagnoses related to depression, anxiety disorders, bipolar disorder, and addiction. Full session notes from psychotherapists. Every antidepressant and antipsychotic prescription. This information can destroy careers, families, and social standing.
Allergy and Immunology: Data on all your allergies, including reactions to specific medications. What happens when this information is lost or altered in your official medical file?
Ophthalmology & Nutrition: Your eyeglass prescriptions, diagnoses like glaucoma and cataracts, as well as all your attempts to manage weight, documented eating disorders, and private recommendations from nutritionists.
This isn't just 'data'. This is your life, cataloged and ready for use.
Anatomy of a Business. A Financial Teardown of Horizon Family Medical Group
It's a paradox that clinics, while collecting mountains of information, often fail to see the real picture of their own business. We see it. The 6 terabytes of SQL and QuickBooks databases represent the complete financial and operational model of Horizon Family Medical Group.
We have analyzed:
SQL Databases: These contain complete patient information, doctor schedules, office utilization, patient flow, average revenue per department and per doctor. We know which doctor is profitable and which is a liability. We see every operational metric management uses to make decisions.
QuickBooks Databases: This is the financial heart of the company. Every transaction, employee salaries (including hidden executive bonuses), tax reports, debts, loans, and settlements with insurance companies and suppliers. We can see the true profit margin of every service, the customer acquisition cost (CAC), and their lifetime value (LTV).
Horizon's management hasn't just lost patient data. They have lost complete control of their business. Any competitor with this information could dismantle their company by poaching their most profitable doctors and patients.
Eternal Memory. Why This Data Will Never Disappear.
Some believe a data breach is a temporary problem. In this case, it is not. We drew inspiration from the Arctic Code Vault project, where humanity's most critical code is preserved in permafrost for a thousand years.
Your 7 terabytes of data are no longer just files on a server. They have been prepared for archival and distributed storage. They will become a digital monument to the negligence of Horizon Family Medical Group. This data cannot be 'deleted'. It will exist forever, as proof that the company's leadership failed to protect what is most sacredyour health and your privacy.
To the management of Horizon Family Medical Group, we remind you: the clock is ticking. Your silence only magnifies the damage. Contact us. Your patients and your business deserve it.
Desert Micro
June 19, 2026
•[ ransomware, technology, financial ]
Desert Micro was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-19. Sector: Technology. DesertMicro.net is a Software & Internet based company located in Jacksonville, Florida, United States with over 25 - 100 employees, data included large sums of costumers data who use the company software service, such curbside waste company invoices and Storage data, foothillsSanitation + GreenEnviromnetal + InlandService + QC + FusionSite companies the same, credit cards Details and payments billings Documents, databases backups and more - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
graymont.com
June 22, 2026
•[ ransomware, manufacturing, financial ]
graymont.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-06-22. Sector: Manufacturing. Country: Canada. Website: graymont.com. NOTICE: Graymont Final Warning
We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly sensitive data. The scope of our access covers the entire core of your operations, from executive financial strategy to individ
maglificioliliana.com
June 24, 2026
•[ ransomware, leak, manufacturing ]
maglificioliliana.com was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-24. Website: maglificioliliana.com. Over 400 GB of data has been accessed and exfiltrated. This includes product designs, historical fashion lines, and technical specifications for garments. Furthermore, we have obtained customer databases from various parts of the world, financial records, commercial contracts, employee data, personal files for all staff members within the network, daily operational documents, and more.
Driving School Software
May 21, 2026
•[ ransomware, education, financial ]
Driving School Software was listed as a victim on the leak site of the PrinzEugen ransomware group; the attack is estimated to have taken place on 2026-05-21. Sector: Education. Hundreds of driving schools impacted.
16 Million rows of SQL, 8000 FULL credit cards, and more.
Full leak post + data available on the new PRINZ EUGEN site.
prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion
HIGUCHI USA, INC
June 28, 2026
•[ ransomware, manufacturing, technology ]
HIGUCHI USA, INC was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Manufacturing. Country: United States of America. Website: higuchiinc.com. (Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the .ptb file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations.
higuchi-inc.co.jp
June 28, 2026
•[ ransomware, manufacturing, financial ]
higuchi-inc.co.jp was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Manufacturing. Country: Japan. Website: higuchi-inc.co.jp. (Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the .ptb file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations.
owensborograin.com
June 19, 2026
•[ ransomware, manufacturing, financial ]
owensborograin.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-19. Sector: Agriculture and Food Production. Country: United States of America. Website: owensborograin.com. PROCESSING: GRAIN IN SOMEONE ELSE'S MILL PROLOGUE Tax returns filed with the IRS under threat of "fi...
universalplant.com
June 30, 2026
•[ ransomware, financial ]
universalplant.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Agriculture and Food Production. Country: United States of America. Website: universalplant.com. FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS)
We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive contains highly sensitive information, including:
Financial & Accounting: Full audits, tax filings (ADP), payroll, bank transa
arc-reins.com + fidelityunited.ae
May 1, 2026
•[ ransomware, finance, financial ]
arc-reins.com + fidelityunited.ae was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Financial Services. Country: United Arab Emirates. Website: fidelityunited.ae. We have gained full control over 700 GB of data, which includes: meticulous compliance audit data, complete Bank details for ARC, legal licenses, tax documents, and official contracts, as well as KYC and KYC TOBA files for all partners.Additionally, personal data for all employees has been extracted, including passports, ID cards, emails, career details, personal documents, and contracts for managers and internal communications. The breach also covers the marine insurance archive with all its deals in the Middle East, property insurance, civil liability, and risk insurance, in addition to monthly and annual quality control reports and collective agreements with major international partners.We have full control over administrative data, business travel logs, passwords, and DC client lists, along with all internal correspondence, digital identities, and official company signatures. The data also includes a list of major clients and thousands of personal information records for Fidelity and ARC brokers, including their full personal details. All of this and more, totaling 600 GB of secrets.
or-technology.com
May 3, 2026
•[ ransomware, technology, financial ]
or-technology.com was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-05-03. Sector: Technology. Country: Germany. Website: or-technology.com. Financial & Sales Intelligence Sales Statistics by Quarter (Q1, Q2, Q3, Q4) Corporate & Strategic Planning SQL Project Reports
