TOWILL
September 20, 2026
•[ ransomware, technology, government ]
TOWILL was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Technology. Country: United States of America. Website: www.towill.com. A geomatics veteran since 1955, providing surveying, LiDAR, photogrammetry, and GIS services primarily for U.S. federal agencies, including the Army Corps of Engineers and the Department of Defense.
Charlottesville Police Department
September 21, 2026
•[ ransomware, government ]
Charlottesville Police Department was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-09-21. Sector: Government & Defense. Country: United States of America. Website: cpdcareers.com. Status: upcoming | Data size: | Files: 0 files | Deadline: 2026-09-30T00:00:00Z
Clark Hill
September 22, 2026
•[ ransomware, leak, healthcare ]
Clark Hill was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-22. Sector: Professional Services. Country: United States of America. [AI generated] Clark Hill (Clark Hill PLC) is a full-service law firm headquartered in Detroit, Michigan, United States. It operates in the legal services industry, providing counsel across practice areas including corporate law, litigation, labor and employment, intellectual property, cybersecurity, government relations, and healthcare law. The firm serves businesses, governments, and individuals through multiple offices across the United States and internationally.
RECEITA FEDERAL DO BRASIL
September 23, 2026
•[ ransomware, government, finance ]
RECEITA FEDERAL DO BRASIL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: Brazil. MINISTRIO DA FAZENDA
SECRETARIA DA RECEITA FEDERAL DO BRASIL
The archives contain several thousand documents with personnel and customer data,
as well as all user date on gov.br with passwords. [Sector: Finance]
Washington County
September 23, 2026
•[ ransomware, government, leak ]
Washington County was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: United States of America. Website: washingtoncountymaine.com. Government Administration Stolen data: 2 GB.
The Merrimack County
September 23, 2026
•[ ransomware, government ]
The Merrimack County was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Government & Defense. Country: United States of America. Website: www.merrimackcounty.net. Government Administration Stolen data: 3 GB.
Italy
September 24, 2026
•[ ransomware, government, leak ]
Italy was listed as a victim on the leak site of the ImNotAVillain ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Government & Defense. Country: Italy. Italy is being exposed for failing to follow proper data protection laws.
Includes 85,000+ Files 150GB. Top departments, units, offices affected.
FTAPI Software
September 25, 2026
•[ ransomware, technology, healthcare ]
FTAPI Software was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Technology. Country: United States of America. Website: ftapi.com. ftapi.com zoominfo.com/c/ftapi-software/346927067 FTAPI (founded 2010, Munich, Germany) is a software company offering a secure, GDPR-compliant platform for exchanging sensitive business data and automating workflows encrypted email and file transfer, virtual data rooms, digital forms and no-code process automation. It serves 2,000+ organizations and over a million users, mainly in public administration, healthcare, insurance and industry, with all data hosted exclusively in Germany under strict certifications (ISO 27001, BSI C5, SOC 2) and optional zero-knowledge encryption. Its core selling point is European digital sovereignty a compliant alternative to US cloud tools like Dropbox under GDPR, NIS-2 and DORA regulations. In 2025 it raised 65 million from PE investors Armira and Tikehau Capital, which took control to fund EU expansion and acquisitions. The company employs around 150 people and targets becoming a leading European player in secure data exchange by 202829.
nsbsd.org
September 28, 2026
•[ ransomware, government, education ]
nsbsd.org was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Government & Defense. Country: United States of America. Website: nsbsd.org. North Slope Borough School District is a public school district serving the remote communities of Alaska's North Slope, headquartered in Utqiavik. It operates 11 schools across the borough, enrolling approximately 2,044 students from Pre-K through 12th grade. The district's mission is rooted in Iupiaq culture, aiming to develop students who are "empowered, culturally rooted, bilingual, healthy, critical, creative, life-long learners". For the 2025-2026 fiscal year, the district received $38,766,371 in local funding from the North Slope Borough, with per-pupil spending significantly above the national average at approximately $40,367
sumperk.cz
September 28, 2026
•[ ransomware, government, retail ]
sumperk.cz was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Retail & E-Commerce. Country: Czechia. Website: sumperk.cz. The official website, sumperk.cz, serves as the city's principal digital information and service portal for residents, businesses, visitors and other
manno.ch
September 28, 2026
•[ ransomware, government ]
manno.ch was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Other. Country: Switzerland. Website: manno.ch. The official website, manno.ch, provides residents, businesses and visitors with information about municipal administration, public services, local regulations, infrastructure, cultural
Juntadeandalucia
September 28, 2026
•[ ransomware, government, leak ]
Juntadeandalucia was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Government & Defense. Country: Spain. Website: juntadeandalucia.es. Organization with 198 emails extracted. Domain: juntadeandalucia.es
Amazon Informatica
September 28, 2026
•[ ransomware, technology, government ]
Amazon Informatica was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. Country: Brazil. Amazon Informtica LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995.
Amazon Informtica's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Braslia/DF (to service the federal government cluster) and Belm/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions.
Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information!
Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data.
TOX ID: 3D6EF83C3C4517FE42B212A934D4B08579A5F20522828C4E4818EA117F53063377C4D769640B
SESSION: 052a5fe97f7b1822c2225ba884b5f719c07ec99da7d838421a20958938f54cb539 [Sector: Government, Technology]
DBU Construction
September 29, 2026
•[ ransomware, manufacturing, government ]
DBU Construction was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Manufacturing. Country: United States of America. Website: dbu-construction.com. dbu-construction.com zoominfo.com/c/dbu-construction-inc/358513059 DBU Construction, Inc. (founded 1998 "DBU" stands for Directional Boring and Utility, Chichester, New Hampshire) is a specialty contractor focused on trenchless horizontal directional drilling (HDD) and underground utility construction, plus roads, water/sewer, excavation and drainage work. It started drilling for Verizon Telecommunications and now serves municipalities, state and federal agencies (including Pease Air National Guard Base), utilities and developers across six New Hampshire counties and Maine, with roughly $1525M annual revenue and 1150 staff. In 2008 Jessica Towne took ownership, making it a Women-Owned Business Enterprise (WBE) and, since 2011, the first WBE in New Hampshire to offer directional drilling (also DBE-certified). Landmark projects include drilling a 1,500-foot waterline under Newfound Lake and gas-line bores under Route 102. Key strengths are its niche HDD expertise, government bid cert
Agospap
September 29, 2026
•[ ransomware, hack, healthcare ]
Agospap was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Country: Greece. Website: agospap.com. agospap.com zoominfo.com/c/agospap/357851962 AGOSPAP (founded 2 November 1981, Paris) is a non-profit association (loi 1901) that manages social, cultural and leisure benefits for ~150,000 staff of the AP-HP hospital system and the City of Paris plus ~20 affiliated public bodies effectively a cross-institutional works-council fund. With 45 employees and income tied to 0.5% of the two founders' payroll (28M/year in subsidies; 49M total budget), it provides income-scaled holiday stays, children's camps (417), a cultural ticketing platform, Christmas gifts, social grants (birth/marriage/service medals) and the new Pass'Sport sports voucher. Led by president Jean-Paul Brandela (since Oct 2023) and director-general Anne Schaetzel (since 2013), it is ISO 9001-certified and holds an Atout France travel-operator license with UNAT financial guarantees. Funding remains politically sensitive: a 2M cut by the City in 2023 briefly suspended camp registrations
Groupe APROSEP
September 29, 2026
•[ ransomware, leak, technology ]
Groupe APROSEP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Other. Country: Senegal. Website: groupe-aprosep.com. groupe-aprosep.com guyanasso.org Groupe APROSEP (founded 1994, Cayenne, French Guiana) is a solidarity-economy network (groupement d'conomie solidaire) that unites and professionalizes associations across the region, focusing on employment insertion, training and social innovation. It runs several affiliated structures LIANE (job integration), OFA Guyane (training), GEIQ Jeun'ESS and GEPSL (shared employers for sports/youth/childcare jobs) and the Conciergerie Solidaire all housed in "L'Accordeur," a 1,600 m PTCE-labeled cooperative hub in downtown Cayenne supporting about 500 jobs and 240 associations. Led since 1997 by director Jean-David Poquet under president Jos Othily, the group celebrated its 30th anniversary in June 2025 and runs flagship projects like an AVIP integration crche (30 places), the EVA illiteracy-assessment center and the social enterprise Tisanes de Camopi. Its partner network spans France Travail, ANLCI, Orange
Datacomm Services
September 29, 2026
•[ ransomware, technology, government ]
Datacomm Services was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Country: United States of America. Website: dscdatacomm.com. dscdatacomm.com zoominfo.com/c/datacomm-services-corp/347799114 Datacomm Services Corporation (DSC) (operating since 1988, Memphis, Tennessee) is a low-voltage systems contractor serving the Memphis/Mid-South region (TN, MS, AR) for nearly 40 years. It designs and installs structured cabling (Cat 5eCat 6A and fiber optics), outside-plant networks, access control, CCTV, intrusion alarms and paging/AV systems acting as a single point of contact for all low-voltage building systems. Led by President Allen Hendry and EVP/CEO Chuck Jennings, it runs a lean ~22-person team with two certified RCDD designers on staff and revenue around $10 million/year. Clients range from small service tickets to $1M+ projects offices, industrial sites and especially school systems and government buyers (it holds TIPS purchasing contracts through 2028). It carries an A+ BBB rating and clean legal record, with strong reviews for workmanship and service. Main limits: purely regional footprint and dependence
Defencebit
September 29, 2026
•[ ransomware, technology, government ]
Defencebit was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Government & Defense. Country: United Kingdom of Great Britain and Northern Ireland. Website: defencebit.com. defencebit.com zoominfo.com/c/defencebit/532842616 DefenceBit (founded 2018, Lisbon) is a boutique cybersecurity consulting firm self-described "hackers, but the good ones" spun off from Bullray-CIT, an Angolan-government-focused critical-systems integrator. It provides offensive-security services: penetration testing, vulnerability assessments, hardening, source-code and web/API audits, mobile app audits, social-engineering tests and full Red Team engagements, working to PTES/OWASP/OSSTMM standards with manual verification. The team holds top certifications (CEH, CISSP, PMP, Checkpoint CCSE, ISO 27001) and its co-founder later moved to a senior role at the NATO Communications and Information Agency. A notable credential is its contract with Portugal's National Cybersecurity Centre (CNCS) to run the "Cidado Ciberseguro" course for government workers on the state NAU platform. It remains a very small company (110 staff)
M. B. Kahn Construction Co.
August 1, 2026
•[ ransomware, manufacturing, healthcare ]
M. B. Kahn Construction Co. was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-08-01. Sector: Manufacturing. Country: United States of America. Website: mbkahn.com. [AI generated] M. B. Kahn Construction Co. is a general contracting and construction management firm based in the United States, headquartered in Columbia, South Carolina. Founded in 1926, the company operates primarily across the southeastern United States. It serves sectors including commercial, industrial, healthcare, education, and government markets, delivering services such as design-build, preconstruction planning, and facility construction.
Mairie de Drancy
August 2, 2026
•[ ransomware, government ]
Mairie de Drancy was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-08-02. Sector: Government & Defense. Country: France. Website: www.drancy.fr.
