SK Capital Partners
October 28, 2026
•[ ransomware, financial, manufacturing ]
SK Capital Partners was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. Country: United States of America. Website: skcapitalpartners.com. skcapitalpartners.com Revenue $63 Million SK Capital Partners is a New York-based private equity firm founded in 2007 as a spinoff from Apax Partners, managing approximately 10 billion dollars across 60 plus investments in specialty chemicals, pharmaceuticals and ingredients. Led by co-founder Barry Siadat, it targets control investments in companies with 100 million to 1 billion dollars in revenue and has built platforms like Advansix, Sartomer and Cura Particles through buy-and-build strategies. Its portfolio companies employ over 12,000 people and generate more than 5 billion dollars in annual revenue. Recent deals include the July 2026 acquisition of Lorama Group and the October 2026 purchase of Vesuvius Americas refractory assets. Key strengths are deep sector expertise in real-economy industrial businesses and proven IPO and trade sale exits.
grifosespinoza.com
October 31, 2026
•[ ransomware, retail, financial ]
grifosespinoza.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Peru. Website: grifosespinoza.com. Headquartered in Lima, the company manages fuel stations that serve individual motorists, commercial customers and other transportation-related businesses. Its core
Hudson & Hudson Sign Products
October 30, 2026
•[ ransomware, manufacturing, financial ]
Hudson & Hudson Sign Products was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Hudson & Hudson is a second generation sign company, located in the heart of Houston. From its
humble beginnings, in the back of a garage near downtown Houston, it has grown to one of the pr
emier sign manufacturing facilities in the US.
We will upload 14gb of corporate data soon. Employee information, contracts and agreements, cli
ent information, financials, drawings and so on.
Digital Triumph
October 31, 2026
•[ ransomware, leak, technology ]
Digital Triumph was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Technology. Country: Malaysia. telecommunications services Malaysia | Employee payroll records with names, national identity numbers and wages, statutory filings 2016 to 2025; Audited financial statements, tax filings and company bank account numbers; 2,552 customer invoices and delivery orders; The full customer service data room covering 309 organizations including banks, an embassy and government offices; The CRM customer database and the company mail archive, 8,700+ verified business emails with customer correspondence | [NOT PAID EXPOSED]
Phoenix Charter Academy
October 31, 2026
•[ ransomware, education, financial ]
Phoenix Charter Academy was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: United States of America. Website: phoenixcharteracademy.org. Phoenix Charter Academy Phoenix Charter Academy Network is a public charter school network in Massachusetts, USA, operating three campuses (Chelsea, Lawrence, Springfield) and serving mainly low-income and immigrant families.36,829 files, 445.1 GB of data.Domain controller (password hashes of ~170+ staff accounts)File server, helpdesk server, print serverPowerSchool test server the student databaseStudent special-education records of named minors: signed IEP/504 plans for the 20252026 school year, BASC-3 psychological protocols, three-year re-evaluations, speech-therapy files, discipline recordsImmigration records of students' families: official CBP I-94 entry records, parole application statements, immigration cover lettersStaff personal and financial data: W-2 forms with SSNs and salaries, US passport card and foreign passport scans, bank statements with account numbers (Bank of America / Tremont Credit Union), signed direct deposit authorizations, CORI background-check filesMedical data: MassHealth cards and applications, immunization recordsMunicipal compliance files: Lawrence Board of Health licenses and inspections (20222024), Fire Department inspection certificatesInternal HR material: network-wide salary bands More
CP Manufacturing, Inc.
October 30, 2026
•[ ransomware, manufacturing, financial ]
CP Manufacturing, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Website: CP Manufacturing, Inc.. [manufacturer] CP Manufacturing, Inc. a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems) operating since the 1970s under
the CP Group / CPG Sorting Technologies brand, with subsidiaries MSS Inc. (Nashville, TN), IMS Electronics Recycling, IMS Logistics, IMS Recycling Services,
Material Sales, HMM, and UK partner Recycleye.
The dataset includes complete server mirrors from HR, finance, engineering, legal, operations, and sales infrastructure, capturing the company's entire digital
footprint:
Sage/Epicor ERP accounting system for 8 entities (CPM, MSS, HMM, IMSR, IMSRE, MSIRE, CPGH, CP Global) with consolidated P&L showing $109.1M revenue, $10.2M net
income, and $12.1M EBITDA for FY2024, plus multi-year budgets (20212024), daily cash reports, and AR/AP data
~340 Social Security Numbers with full identity packages (name, DOB, health coverage status, premium amounts, tax withholdings) across 4 entities via ACA 1095-C
filings (20162022), biweekly payroll registers, 401(k) participant records, 10-year salary histories (20132023), and benefits administration across 5 carriers
(Anthem, Blue Shield, SIMNSA, UNUM, Western Dental)
Truist bank account details routing number 053101121 and account number 1180009812409 for CP Manufacturing LLC, plus ACH payment batch files spanning August 2025
through August 2026
277+ GB of proprietary engineering IP 22G of AutoCAD Electrical MRF designs with proprietary component catalogs (1.2G), 195G of Artec 3D scanner data for
manufactured equipment, 38G of CNC laser fabrication data (Amada LCG3015 AJ / FabriWin), PCB board designs (5 boards), SolidWorks Electrical templates, and Epicor
ERP Bill of Materials with proprietary part numbers
60+ customer contracts and 30+ NDAs with Republic Services, Waste Management, Recycleye/Nestl, Cal-Waste, Balcones, Wasatch, and international partners, plus
Declaration Partners acquisition due diligence documents, competitor proposals (BHS, Machinex, MISTRAL), and a complete project green list
Privileged legal materials active litigation subpoena (Hans Ouellet), Coastal Resources MWS settlement agreement with UCC1 financing statements,
separation/termination documents for named employees, restrictive covenant cease-and-desist letters, PIIAAs (invention assignment agreements), wage garnishment
orders, and corporate equity documents
200+ named job applicant resumes, 51 employee headshot photographs, 400+ vendor records with Tax IDs (including 3+ individual contractors with potential SSNs), and
a 7.8G Microsoft SQL Server backup (IMSROM) of undetermined contents
wagyu.xyz unfairness
October 28, 2026
•[ ransomware, financial, technology ]
wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence:
1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).
2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).
Evidence to support this can be found below:
Noelker and Hull
October 28, 2026
•[ ransomware, financial, healthcare ]
Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
Algra Group
August 14, 2026
•[ ransomware, technology, manufacturing ]
Algra Group was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-14. Sector: Other. Country: Switzerland. Website: algragroup.ch. Algra Group specializes in customized input systems, front panels, and industrial labels, provi
ding tailored solutions for various industries. Their product range includes agnostic touch sys
tems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation,
wellness, medical technology, and transportation.
We will upload corporate data soon. Employee personal information (passport numbers, DLs), clie
nts and partners information, contacts and agreements, financials, NDAs.
ScrubaDub Auto Wash Centers
September 2, 2026
•[ ransomware, retail, financial ]
ScrubaDub Auto Wash Centers was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Retail & E-Commerce. Country: United States of America. ScrubaDub Car Wash is New England's leading auto wash, offering customizable tunnel and touchle
ss washes, interior cleaning, and detailing services across over 20 locations in Massachusetts,
New Hampshire, Maine, and Rhode Island.
We will upload corporate data soon. Employee personal information (passport numbers, DLs of 22
employees, contact information), clients information (addresses, contacts and so on), company f
inancials, payment details.
Flex1
September 1, 2026
•[ ransomware, technology, financial ]
Flex1 was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-01. Flex1 is an innovative provider of desktop-as-a-service solutions that enables businesses to cr
eate secure and cost-effective digital workspaces. Their platform combines cloud architecture w
ith productivity tools and managed support services to ensure employees can work efficiently fr
om any device, at any time.
We will upload 402gb of corporate data and their client soon. Employee personal information, cl
ients information (lawyers clients (passports, DLs, SSNs and so on), pet's clinic, etc), financ
ials and so on.
Marlborough Partners
September 2, 2026
•[ ransomware, financial ]
Marlborough Partners was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-02. Sector: Financial Services. Country: United Kingdom of Great Britain and Northern Ireland. Major data breach at a capital solutions advisory firm.
neolife.com
August 18, 2026
•[ ransomware, healthcare, financial ]
neolife.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: United States of America. Website: neolife.com. COMPLETE DATA BREACH Golden Neo Life: Mexican MLM Network with Legal Problems, Financial Collapse an...
Worrell
August 21, 2026
•[ ransomware, retail, financial ]
Worrell was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-21. Website: worrellcorp.com. Worrell Corporation is a family-owned business based in Indianapolis that specializes in promot
ional products, marketing, and print services. They assist clients in finding impactful promoti
onal items while offering tailored marketing strategies and webstore solutions.
We will upload 45gb of corporate data soon. Employee and client information, contacts and agree
ments, financials, projects and so on.
rubbermill.com
August 15, 2026
•[ ransomware, manufacturing, financial ]
rubbermill.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-08-15. Sector: Manufacturing. Country: United States of America. Website: rubbermill.com.
RUBBERMILL, INC. DUMP: BREAKDOWN OF AN OEM MANUFACTURER LEAK
Target: RubberMill, Inc. (North Carolina, USA) contract manufacturer of non-metallic components for appliance, HVAC, automotive, and heavy equipment. Certifications: ISO 9001:2015, WOSB, WBENC. Probable defense contracts (Mil-Spec).
DUMP SIZE: ~296K files / 276K data objects / 340+ GB
146 GB disk image (.mrimg) full copy of the system
AES PASSWORDS.xlsx file + APWDxx libraries credentials
outlook.pst (487 MB) corporate email archive
creditcard.xls payment data
EMPLOYEE CALL LIST + Employee Information Record Form PII
Insurance data
Tax forms containing SSNs
ENGINEERING DATA:
3,000+ CAD files (.dxf, .stp, .dwg) with client part numbers: 7J314, K2A31, K7K11, V1324, etc.
Complete set of 3D models
Client drawings
FINANCIAL DATA:
Sales analysis.mdb (38 MB) complete sales database
commercial terms
customer segmentation
REGULATORY RISKS:
C-TPAT / NAFTA / Certificate of Origin
Conflict Minerals Reporting Template
Supplier Quality Assurance Manual
Probable Mil-Spec specifications
The dump contains a full cross-section of the business: from passwords and SSNs to automotive OEM drawings and military specifications.
Benshaw, Inc.
August 27, 2026
•[ ransomware, manufacturing, financial ]
Benshaw, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-08-27. Sector: Manufacturing. Country: United States of America. Website: Benshaw, Inc.. [manufacturer, research] Benshaw, Inc. (Pittsburgh) and affiliated UTG entities (Unico, Benshaw Canada, AuCom, Excel, Noble Victoria).
~100+ corporate Visa/PCard records with full PAN + SSN + DOB + home address
637 former employees with full SSN/DOB/address on one spreadsheet
88 active employee folders plus multi-year Canada payroll
Global bank account numbers (PNC, BMO, BNZ, St George, Commerzbank, JPM London, BBVA, GNB)
ACH NACHA files with vendor routing/account numbers
UEdit source with hardcoded XOR key 4148865678 and date-based CalcBackDoor()
Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC)
Rug & Home
September 7, 2026
•[ ransomware, retail, financial ]
Rug & Home was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: United States of America. Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customersfull names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scanssigned delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More
CreateASoft
September 8, 2026
•[ ransomware, technology, financial ]
CreateASoft was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Technology. Inc. is a software company. The company provides dynamic process improvement solutions, predict
ive technology, and end-to-end support to a variety of process-based operations dedicated to im
proving operational efficiency and responsiveness.
We will upload corporate data soon. Employee and customer files, contacts and agreements, finan
cials, projects and so on.
Specchem LLC
September 9, 2026
•[ ransomware, manufacturing, financial ]
Specchem LLC was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Manufacturing. Country: United States of America. Website: specchem.com. About Specchem LLC Specchem LLC is a U.S.-based supplier of concrete repair materials, flooring products, and chemical admixtures. The company offers a range of cementitious and epoxy-based systems. Their distribution network covers domestic commercial and industrial contractors. A cyberattack on Specchem LLC resulted in a massive data breach. As a result of the incident, approximately 500 GB of datacontaining roughly 700,000 files, including confidential personal and financial informationwas stolen.
John Engel Team
September 10, 2026
•[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
