Farmacias 911
October 26, 2026
•[ ransomware, healthcare, manufacturing ]
Farmacias 911 was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Healthcare. Country: Ecuador. Website: farmacias911.com.ec. farmacias911.com.ec Gettareq S.A., known as Farmacias 911, is a major Ecuadorian pharmaceutical company founded in 2013 in Guayaquil, combining retail pharmacy, wholesale distribution, OEM manufacturing and medical consulting across the whole country. The group operates six brands including Farmacias 911 retail, ACOSAR wholesale distribution, Galenic for private label manufacturing, One Laboratory for quality testing and Conseplus for consulting. It has grown from 11 to 500 employees with a 166 percent increase in headcount, working with global pharmaceutical giants like Abbott, Bayer, Bristol Myers Squibb, Takeda and Roche. Led by founder and CEO Marlon Morillo, the company hosted Ecuador's largest pharmaceutical convention in 2025 alongside APESFA. Its vertical integration from import and production to retail and lab testing is unique in the Ecuadorian market.
Hygiena
October 27, 2026
•[ ransomware, healthcare, hack ]
Hygiena was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Healthcare. Country: United States of America. Website: www.hygiena.com. United States
Noelker and Hull
October 28, 2026
•[ ransomware, financial, healthcare ]
Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
ClaimTek Systems
October 29, 2026
•[ ransomware, healthcare, finance ]
ClaimTek Systems was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Financial Services. Website: claimtek.com. ClaimTek Systems ClaimTek Systems specializes in preparing individuals for successful entry into the medical billing and practice management business with a comprehensive training and support system. They offer a range of scalable products and services, including state-of-the-art billing software and marketing tools, targeted towards aspiring entrepreneurs in the healthcare industry. More
NOVADATA
October 30, 2026
•[ ransomware, technology, finance ]
NOVADATA was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: Argentina. Website: novadata.com.ar. novadata.com.ar NOVADATA S.A. is an Argentine IT integration group founded in 1994 in Buenos Aires, comprising Novadata, Net Service and Compaa Global de Servicios with 130 plus certified professionals. It provides IT infrastructure, business continuity, AI, pay-per-use HPE GreenLake, microinformatics and 24/7 Service Desk services to major corporations across Argentina. It holds HPE Platinum, Microsoft Gold, Cisco Silver, VMware Enterprise and Symantec Gold partner certifications, adding Huawei Enterprise Authorized Reseller status in 2026. Major clients include Bayer, Veolia, La Annima, Petrobras, Citibank, Roche and Bimbo, many with over 10 years of partnership. The group completed a financial restructuring agreement from 2014, declared fulfilled by court in March 2026. Recent strategic moves include an AI alliance with AYI Group, Fortinet cybersecurity training and launch of Novadata GREEN IT asset disposition services.
GIO Dental
October 28, 2026
•[ ransomware, healthcare, technology ]
GIO Dental was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Healthcare. Country: Sierra Leone. Website: giodentalsl.com. giodentalsl.com GIO Dental SL is a modern dental clinic and laboratory founded by Nigerian dentist Dr. Gift Nwachukwu Obiorah in Freetown, Sierra Leone, with an additional location in Koidu, Kono District. It is Sierra Leone's first fully integrated dental provider offering clinical treatment, a prosthetics laboratory, dental technology education and equipment repair under one brand. Services span general and cosmetic dentistry, orthodontics, oral surgery, custom prosthetics fabrication and community oral health programs. Led by founder Dr. Gio, the company trains local dental technicians and runs outreach campaigns to make premium dental care accessible across the country. Its vertical model combining treatment, manufacturing and education is unique in the Sierra Leonean healthcare market. It also provides equipment repair and supply services to other dental clinics in the region.
StarImage
October 26, 2026
•[ ransomware, healthcare, technology ]
StarImage was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Technology. Country: United States of America. Website: starimagesouthlake.com. starimagesouthlake.com StarImage Dental Boutique & Oral Surgery is a premium dental practice in Southlake, Texas, opened in January 2021 as the second location of StarImage Dentistry founded by Dr. James Green in Wichita Falls over 25 years ago. Led by Dr. Green, oral surgeon Dr. Dustin Van Tassell and Dr. Susan Millner, it offers cosmetic and reconstructive dentistry, dental implants, full mouth rehabilitation, oral surgery, TMJ treatment and sleep apnea care all under one roof. The clinic is one of the most technologically advanced dental offices in the US, equipped with Planmeca ProMax 3D CBCT imaging, MLS laser therapy, VELscope cancer screening and CT-guided implant surgery. Both lead doctors hold Fellow status at the Las Vegas Institute for Advanced Dental Studies, and the practice maintains a perfect 5.0 rating across 50 plus reviews. Its dedicated TMJ and Sleep Center provides a high-margin specialization in jaw disorders and obstructive sleep apnea.
N***************
September 2, 2026
•[ ransomware, healthcare ]
N*************** was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-09-02. Country: United States of America. Website: www.****************.com. Medical center with 9 locations offers coordinated care for patients and families, including dentistry, digital X-rays, ultrasound, bone density scans, mammograms, lab testing, and mental health counseling in a comfortable setting.
Proliance Surgeons
August 18, 2026
•[ ransomware, healthcare ]
Proliance Surgeons was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: United States of America. Website: proliancesurgeons.com. [AI generated] Proliance Surgeons is a large physician-owned surgical group based in the United States, primarily operating in Washington State. The organization brings together hundreds of independent surgeons across dozens of specialties, including orthopedics, general surgery, and sports medicine. It operates numerous clinics and surgical centers throughout the Pacific Northwest, providing outpatient and inpatient surgical care to patients across the region.
Policlinico Triestino
September 1, 2026
•[ ransomware, healthcare ]
Policlinico Triestino was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Healthcare. Country: Italy. Policlinico Triestino S.p.A. is a private healthcare network based in Trieste, Italy, that operates hospitals, nursing homes, and outpatient clinics.
SITES Medical
September 1, 2026
•[ ransomware, healthcare, manufacturing ]
SITES Medical was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Healthcare. Country: United States of America. Website: sitesmedical.com. SITES Medical is a trusted partner for orthopedic implant companies, offering innovative orthopedic technologies and a rapid product concept-to-launch process. They provide comprehensive R&D services, including regulatory filings, and contract manufacturing capabilities to ensure high-quality products at reduced costs. Their expertise spans various markets, including orthopedic, spine, dental, and more, with a focus on enhancing product offerings through advanced technologies like OsteoSync Ti. SITES Medical collaborates closely with clients to integrate these technologies into their product lines, supporting their success in the competitive medical market.
The company headquarters is located in 4707 East Park 30 Drive, Columbia City, IN 46725, United States.
11-50 Employees
uicc.org
September 1, 2026
•[ ransomware, healthcare ]
uicc.org was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Professional Services. Country: Switzerland. Website: uicc.org. The Union for International Cancer Control (UICC) is the world's largest international cancer membership non-profit orga...
Nutex Health
August 31, 2026
•[ ransomware, healthcare ]
Nutex Health was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-08-31. Sector: Healthcare. Country: United States of America. Website: nutexhealth.com. nutexhealth.com zoominfo.com/c/nutex-health-inc/372032478 (NUTX, Nasdaq) US healthcare company, based in Houston, Texas, founded in 2011 by Dr. Thomas Vo.
It runs 27 small "micro-hospitals" in 12 states small hospitals with full 24/7 emergency rooms.
Model: fast, cheaper ER care between urgent care and giant hospitals; most revenue comes from Texas.
Q2 2026: net income $65.8M (vs loss a year ago), EBITDA $90M, cash $205M, debt only $31M.
Profit exploded because it wins 85%+ of insurance arbitrations (IDR) and got paid at higher out-of-network rates.
Plans: 7 new hospitals by 2027 plus two share buyback programs.
Main risk: the whole profit engine depends on the arbitration system new regulation could cut it.
Cheap-looking: P/E around 6, but volatile small-cap with thin analyst coverage.
seashellhospital.com
September 1, 2026
•[ ransomware, healthcare ]
seashellhospital.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Healthcare. Country: India. Website: seashellhospital.com. Seashell Hospital is a comprehensive private Egyptian hospital located in New Cairo, Egypt, offering world-class multidi...
neolife.com
August 18, 2026
•[ ransomware, healthcare, financial ]
neolife.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-18. Sector: Healthcare. Country: United States of America. Website: neolife.com. COMPLETE DATA BREACH Golden Neo Life: Mexican MLM Network with Legal Problems, Financial Collapse an...
medevolve.com
August 11, 2026
•[ ransomware, healthcare, finance ]
medevolve.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-11. Sector: Healthcare. Country: United States of America. Website: medevolve.com. MedEvolve: Internal Documents of an American Medical Billing Company PROLOGUE MedEvolve is an Americ...
int.diasorin.com
August 25, 2026
•[ ransomware, healthcare ]
int.diasorin.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-08-25. Sector: Healthcare. Country: Italy. Website: int.diasorin.com. DIASORIN This article covers only a portion of the data we've chosen to publish. Everything else wil...
ligacancerguate.org
September 3, 2026
•[ ransomware, healthcare ]
ligacancerguate.org was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-03. Sector: Healthcare. Country: Guatemala. Website: ligacancerguate.org. INCAN Instituto de Cancerologa y Hospital Dr. Bernardo del Valle S. is Guatemala's premier private cancer treatmen...
Katten Muchin Rosenman
September 3, 2026
•[ ransomware, finance, healthcare ]
Katten Muchin Rosenman was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-09-03. Sector: Professional Services. Country: United States of America. Website: katten.com. [AI generated] Katten Muchin Rosenman is a full-service law firm headquartered in the United States. Operating across multiple offices in major American cities and internationally, the firm provides legal services in areas including corporate law, litigation, financial markets, real estate, intellectual property, and regulatory compliance. It serves clients across industries such as finance, entertainment, and healthcare, and is recognized as a prominent firm within the U.S. legal sector.
Studio Oculistico Ciraci
September 3, 2026
•[ ransomware, healthcare ]
Studio Oculistico Ciraci was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-09-03. Sector: Healthcare. Country: Italy. Website: www.oculisticaciraci.it. Studio Oculistico Ciraci - ophthalmology clinic based in Bari, Italy, that opened in 1989 as a center accredited with the Italian National Health Service (SSN). With more than two decades of experience, it focuses on the prevention and treatment of major eye conditions using modern diagnostic technologies. Its main areas of expertise include glaucoma, vitreoretinal diseases (especially maculopathies), correction of refractive errors (Excimer laser PRK and cataract surgery), strabismus, keratoconus, and the renewal of special driving licenses. The clinic is run by specialists Dr. Giuseppe Ciraci and Dr.ssa Lorenza Ciraci and emphasizes high-quality, safe care supported by a professional team. https://www.oculisticaciraci.it/
