Healthtrax Fitness &Wellness
March 13, 2026
•[ ransomware, healthcare, retail ]
Healthtrax Fitness &Wellness was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-03-13. Sector: Retail & E-Commerce. Country: United States of America. Website: healthtrax.com. Healthtrax, founded in 1979 and headquartered Glastonbury, CT, offers facilities and programs
that integrate fitness, wellness education, traditional medical services and rehabilitation. H
ealthtrax forms partnerships with leading health care systems to create a welcoming, centraliz
ed place for members of the community to achieve their personal fitness and health goals.
Here is the access to 10gb of corporate data. Employee and clients personal information (name,
Dl and passport numbers, SSNs), contracts and agreements, personal records, financials, NDA a
nd other confidential docs.
Click the download button.
You will find several password-free archives. Click on any of them to start the download.
SOMAFIX
May 29, 2026
•[ ransomware, healthcare ]
SOMAFIX was listed as a victim on the leak site of the gunra ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Healthcare. Country: France. Website: somafix.fr.
Capital Family Physicians
May 29, 2026
•[ ransomware, healthcare ]
Capital Family Physicians was listed as a victim on the leak site of the cmdorganization ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Healthcare. Country: United States of America. Website: www.capitalfamilymd.com. Capital Family Physicians provides quality healthcare services for families, focusing on comprehensive care for all ages. They offer same-day appointments and a patient portal for convenient access to medical records and billing. The practice emphasizes pediatric services, ensuring that children's health is prioritized. With over 15 years of experience, they are dedicated to supporting patients through every stage of life.
AcademyHealth
May 29, 2026
•[ ransomware, healthcare ]
AcademyHealth was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Healthcare. Country: United States of America. Website: academyhealth.org. They research and promote policy and innovations in healthcare.
*M**
May 29, 2026
•[ ransomware, healthcare, manufacturing ]
*M** was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-29. Country: United States of America. Website: .. A healthcare organization
www.labexpress.com
May 29, 2026
•[ ransomware, brute-force, healthcare ]
www.labexpress.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: United States of America. Website: www.labexpress.com. LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE
We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive crosscompany records. This data will be made publicly available in the near future.
Active Directory Overview
- 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs).
- Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2).
- A single AD domain serves both Labexpress and Garonit Pharma.
Notable account:
cn: Troy Austin
sAMAccountName: Taustin
memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS
The same person appears in Exchange mailboxes as taustin@garonitpharma.com.
Weak Passwords and BruteForce Indicators
- Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30.
- Computer accounts FRONTDESK$, DEV$, LABEL$ more than 3,000 failures each.
- Cleartext password found on FILE01\passwords.txt:
Admin: LabExpress2024!
- The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT.
- Password for user Protect: Password123!
- Outdated password templates in the SBSUsers OU are still in use.
Mail Servers and Exchange
- LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007.
- Full mailbox export performed using the builtin Export-Mailbox cmdlet no special exploit required.
Contents of the Obtained Data (200 GB)
We have data from drive E:\, including:
1. Financial & Accounting
- QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND).
- Folder: E:\Garonit Documents\Clients 2022\ hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf).
- Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ detailed accounts payable records for 50+ vendors.
2. Quality & Production
- Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx).
- Complete batch records for 20232026 (folders Batch Records\2023, 2024, 2025, 2026).
- Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse.
3. ANDA & Regulatory Documentation
- Folder 00 Oral Rinse ANDA-Old One complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA.
- Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf.
4. Vendor & Customer Records
- Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ dossiers on each supplier (contracts, invoices, assessments).
- Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ customer purchase orders and sales quotations.
5. Human Resources (HR)
- Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ employment contracts, W9 forms, tax deductions, resignation letters.
- Passport scans, Green Card copies, health insurance records for many employees.
- Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf.
6. Internal Communications & Scans
- Directory C224E BIZHUB SCANNER DUMPS containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.).
- Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS.
- Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents).
7. Tax & Banking Documentation
- Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank.
- Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf.
Shared Infrastructure Observed Facts
- The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma.
- Crosscompany records reside in the same folders (e.g., Garonit Documents and LABEXPRESSDATA coexist on the same drive).
- User Troy Austin has an AD account (Taustin) and also uses the email address taustin@garonitpharma.com.
- Purchase orders, invoices, COA/COC files refer to both companies interchangeably.
- At the IT level, there is no separation between the two legal entities.
The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future.
DentaQuest, LLC.
May 30, 2026
•[ ransomware, healthcare ]
DentaQuest, LLC. was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Healthcare. Country: United States of America. Website: dentaquest.com. The company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. | Size: 234GB+ (compressed) | Updated: 30 May 2026 | SHA256: db3088225c36be26ce2b458fa7a190176d071441e2e0830c0d82143e6323a3e1
Neurologic Associates Of Central Brevard
April 1, 2026
•[ ransomware, healthcare ]
Neurologic Associates Of Central Brevard was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-01. Sector: Healthcare. Country: United States of America. Website: www.neurologicassociatesofbrevard.com.
The Center for Hearing & Speech
April 2, 2026
•[ ransomware, healthcare ]
The Center for Hearing & Speech was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-04-02. Sector: Healthcare. Country: United States of America. Website: https:thecenterforhearingandspeech.localsearch.com. The Hearing and Speech Center provides comprehensive services in hearing diagnostics, speech therapy, and screening for people of all ages.
However, it is not responsible for the security of your personal data; as a result of their negligence, a large amount of personal data belonging to clients and employees, as well as their confidential information, projects, and incident reports, was leaked online.
*****d **d**** ****o**
March 31, 2026
•[ ransomware, healthcare ]
*****d **d**** ****o** was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-03-31. Sector: Healthcare. Country: United States of America. Website: www.***.com. Functions as a comprehensive healthcare ecosystemcombining clinical care, surgical services, research innovation, and workforce developmentall under one organization dedicated to improving community health in California
Shiraume Hospital
April 3, 2026
•[ ransomware, healthcare ]
Shiraume Hospital was listed as a victim on the leak site of the netrunner ransomware group; the attack is estimated to have taken place on 2026-04-03. Sector: Healthcare. Country: Japan. Website: www.shiraume.or.jp. Shiramume Hospital is a regional general hospital in Japan providing comprehensive inpatient and outpatient care. It offers services in internal medicine, surgery, emergency care, obstetrics/gynecology, and rehabilitation, supported by diagnostic imaging and laboratory facilities.
Nippon Medical School Musashi Kosugi Hospital
April 3, 2026
•[ ransomware, healthcare ]
Nippon Medical School Musashi Kosugi Hospital was listed as a victim on the leak site of the netrunner ransomware group; the attack is estimated to have taken place on 2026-04-03. Sector: Healthcare. Country: Japan. Website: www.nms.ac.jp/kosugi-h. Nippon Medical School Musashi Kosugi Hospital is a 372-bed regional teaching hospital in Nakahara-ku, Kawasaki (Musashi-Kosugi area), affiliated with Nippon Medical School. Established in 1937, it offers comprehensive services across 36 clinical departments, including emergency and critical care, ICU, NICU, perinatal and pediatric care, cancer treatment, and minimally invasive endovascular procedures. The hospital serves as a regional hub with disaster-resistant facilities and an on-site heliport, and emphasizes advanced, patient-centered care and medical education.
Community Connections
April 4, 2026
•[ ransomware, healthcare ]
Community Connections was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-04. Sector: Healthcare. Country: United States of America. Website: communityconnectionsdc.org. Community Connections operates as a non-profit behavioral health organization dedicated to serving vulnerable populations including women, men, youth, and children who face systemic barriers to healthcare access. The organization addresses critical gaps in mental health and substance use treatment by providing comprehensive services tailored to the specific needs of marginalized communities. The organization delivers an integrated continuum of care that combines behavioral health treatment, residential support services, and primary health care coordination.
Siam Okamura International Co
April 4, 2026
•[ ransomware, manufacturing, retail ]
Siam Okamura International Co was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-04-04. Sector: Manufacturing. Country: Thailand. Website: www.okamura.co.th. Siam Okamura International Co., Ltd., established in Thailand in 1996, is a leading provider of high-quality Japanese-designed ergonomic office furniture and interior solutions. Based in Bangkok with local manufacturing via Siam Okamura Steel Co., Ltd., they offer products and services for offices, education, healthcare, and retail spaces.
Das Labor
April 4, 2026
•[ ransomware, healthcare ]
Das Labor was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-04-04. Sector: Healthcare. Country: Germany. Website: daslabor.eu. daslabor.eu zoominfo.com/c/friedrich-holzweber/549578383 is an Austrian private medical and chemical diagnostic laboratory led by Dr. Margit Striednig-Zechner and Dr. Beatrix Sterz. The lab offers a dedicated online ordering system called Cyberlab for referring physicians and healthcare professionals, emphasizing quality-oriented and service-driven care. It is a regional clinical diagnostics practice focused on delivering reliable medical and chemical laboratory testing to local healthcare providers
VirtaHealth
March 29, 2026
•[ ransomware, healthcare ]
VirtaHealth was listed as a victim on the leak site of the lapsus$ ransomware group; the attack is estimated to have taken place on 2026-03-29. Sector: Healthcare. Country: United States of America. Website: virtahealth.com. Healthcare research
ASTRAZENECA CORP
March 25, 2026
•[ ransomware, healthcare, leak ]
ASTRAZENECA CORP was listed as a victim on the leak site of the lapsus$ ransomware group; the attack is estimated to have taken place on 2026-03-25. Sector: Healthcare. Country: United Kingdom of Great Britain and Northern Ireland. Website: astrazeneca.co.uk. Source Code, Employee DB, API Keys, MongoDB/MySQL Creds
academyhealth.org
March 16, 2026
•[ ransomware, healthcare ]
academyhealth.org was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-03-16. Sector: Healthcare. Country: United States of America. Website: academyhealth.org. Is a U.S.-based nonprofit professional organization headquartered in Washington, D.C., dedicated to advancing the fields of health services research and
School Health
March 11, 2026
•[ ransomware, healthcare, retail ]
School Health was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-03-11. Sector: Healthcare. Country: United States of America. Website: schoolhealth.com. School Health was founded in 1957. This company provides the reta
iling of health and wellness supplies to K-12 schools. Their head
quarters are located in rolling Meadows, Illinois.
We will upload 15gb of corporate data soon. Financials, a bit of
HR files, drawings, projects, customer info, etc.
