Casale Del Giglio
April 27, 2026
•[ ransomware, leak, retail ]
Casale Del Giglio was listed as a victim on the leak site of the orca ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Agriculture and Food Production. Country: Italy. Website: www.casaledelgiglio.it. Casale del Giglio was founded in 1967 by Dr. Berardino Santarelli, a native of t...
novoair-bd.com
April 27, 2026
•[ ransomware, leak ]
novoair-bd.com was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Transportation. Country: Bangladesh. Website: novoair-bd.com. novoair-bd.com is the website of Novoair, a private airline based in Bangladesh. Internal documen...
minerasancristobal.com
April 27, 2026
•[ ransomware, energy, leak ]
minerasancristobal.com was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Energy & Utilities. Country: Mexico. Website: minerasancristobal.com. Minerals & Mining. financial docs, internal docs, personal docs.
bms.com
April 27, 2026
•[ ransomware, healthcare, leak ]
bms.com was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Healthcare. Country: United States of America. Website: bms.com. Pharmaceutical company. personal data - 302 lines
sansirostadium.com
April 27, 2026
•[ ransomware, retail, leak ]
sansirostadium.com was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Hospitality. Country: Iran. Website: sansirostadium.com. UEFA personal contact data.
polleninformation.at
April 27, 2026
•[ ransomware, healthcare, leak ]
polleninformation.at was listed as a victim on the leak site of the apt73 ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Healthcare. Country: Austria. Website: polleninformation.at. Pollen situation informational site. Personal info + Pass. 22140 lines
Floyd Skeren Manukian Langevin, LLP Information
April 28, 2026
•[ ransomware, leak ]
Floyd Skeren Manukian Langevin, LLP Information was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Professional Services. Floyd Skeren Manukian Langevin, LLP is a multi-service law firm with ten offices throughout California
Birtcher Anderson & Davis
April 27, 2026
•[ ransomware, leak, finance ]
Birtcher Anderson & Davis was listed as a victim on the leak site of the worldleaks ransomware group; the attack is estimated to have taken place on 2026-04-27. Sector: Professional Services. Country: United States of America. Website: www.birtcherandersondavis.com. A fully integrated commercial real estate investment and management company
DIME Distribuidora
April 10, 2026
•[ ransomware, leak ]
DIME Distribuidora was listed as a victim on the leak site of the worldleaks ransomware group; the attack is estimated to have taken place on 2026-04-10. Sector: Transportation. Country: Brazil. Website: www.dimedistribuidora.com.br.
Intikom
April 28, 2026
•[ ransomware, technology, finance ]
Intikom was listed as a victim on the leak site of the worldleaks ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Technology. Country: Indonesia. Website: www.intikom.com. [AI generated] Intikom is an Indonesian information technology company that provides IT solutions and services primarily to the banking and financial sector. The company offers system integration, software development, infrastructure management, and managed services. Headquartered in Jakarta, Indonesia, Intikom has been a long-standing technology partner for major Indonesian banks, supporting digital transformation and core banking operations across the country.
moser-spiel.at
April 25, 2026
•[ ransomware, leak, retail ]
moser-spiel.at was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-04-25. Sector: Retail & E-Commerce. Country: Austria. Website: moser-spiel.at. moser-spiel.at is an Austrian company specializing in the design and manufacture of outdoor play equipment and sports pa...
nbd3pl.com
April 29, 2026
•[ ransomware, leak ]
nbd3pl.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Transportation. Country: United States of America. Website: nbd3pl.com. North Bay Distribution has been in the warehousing, order fulfillment, and shipping industry for more than 30 years. They are a full service outsourcing logistics service provider. They are based in northern California's City of Vacaville. The proximity of their facility provides streamlined deliveries from the Port of Oakland for goods manufactured and arriving from the Pacific Rim
https://www.fulcrumre.com/
April 11, 2026
•[ ransomware, finance, leak ]
https://www.fulcrumre.com/ was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-11. Sector: Professional Services. Country: United States of America. Website: fulcrumre.com. 2tb data all company data
osoftec.com
April 29, 2026
•[ ransomware, technology, leak ]
osoftec.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Germany. Website: osoftec.com. +91 9717385459 . Optimization Software Technologies, LLP. is an advanced technology solutions development company that focuses on improving operational efficiency and profitability for its clients Stolen: 222gb 113k files
rainforestclean.com
April 29, 2026
•[ ransomware, retail, leak ]
rainforestclean.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United States of America. Website: rainforestclean.com. Rainforest Carwash and Oil Change, along with its owner, enjoys giving back to our local community. Hopefully you are inspired to help after seeing the ways in which we try to help others. Stolen: 259gb 77k files
anvilarts.org.uk
April 29, 2026
•[ ransomware, leak, retail ]
anvilarts.org.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: anvilarts.org.uk. Anvil Arts is the largest performing arts organization in Hampshire, operating as an independent charitable trust. It manages three venues in Basingstoke, including The Anvil and The Haymarket, providing a diverse range of performances and cultural events. Stolen: 480gb 299k files
Bayou Title, Inc.
April 29, 2026
•[ ransomware, finance, leak ]
Bayou Title, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Financial Services. Country: United States of America. Website: bayoutitle.com. [insurance] Bayou Title, Inc. the largest title insurance agent and closing/settlement services provider in Louisiana, with 19 full-service locations statewide.
The exfiltrated data spans 20+ years of operations (20042026) and includes:
70,000100,000+ Social Security numbers paired with names, addresses, and sale proceeds from 1099-S real-estate closing worksheets covering all 19 offices across three tax years (20182020), plus W-2 and 1099-MISC filings.
Complete employee payroll databases 10+ instances of Sage 50 EMPLOYEE.DAT files containing SSNs, bank account numbers, routing numbers, pay rates, tax withholding, and direct deposit details for current and former employees.
103 GB of title abstracts ~34,000+ PDFs documenting ownership chains, liens, and mortgages for properties across Louisiana.
44 GB of GreenFolders DMS transaction packages (2012, 2013, 2019) complete closing file archives containing HUD-1 settlement statements, identity verification documents, SSN cards, and tax records. Filenames contain encoded tags (ssn, hud, soc, tax).
Plaintext credentials for government portals a file literally named Lafayette Assessors lcmenard Password4321.url, plus a PDF containing Orleans Parish system login credentials.
Attorney-client privileged documents wills, attorney engagement letters, and legal opinions prepared by licensed Louisiana attorneys.
Atlas Metal Industries Inc
April 29, 2026
•[ ransomware, leak, manufacturing ]
Atlas Metal Industries Inc was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: Canada. Website: atlasfoodserv.com. [food, metal] Atlas Metal Industries Inc. a privately held commercial-foodservice-equipment manufacturer headquartered in Miami, Florida.
The dataset is a complete Microsoft Dynamics GP environment: production databases, payroll records, system credentials, Autodesk Vault product-design backups, CNC fabrication programs, and all supporting infrastructure configuration. The exfiltration occurred on or about April 8, 2026; the attack was identified April 22, 2026.
The exposed material includes:
15.8 GB of payroll-records database (PYREC) full Employee Master with SSNs, DOBs, addresses, direct-deposit bank routing numbers, salary, W-4 tax data, garnishments, and check history dating to at least 2018.
30+ SQL Server login accounts with password hashes in a sp_help_revlogin dump named employees, system admins (DYNSA, sa), service accounts, and Active Directory domain accounts.
74 GB of Autodesk Vault Professional backup complete product-design history from 2019 through 2026, covering every product line Atlas Metal manufactures.
Hundreds of CNC fabrication programs laser-cutter and Amada punch-press G-code for the full catalogue of sheet-metal components.
A base64-encoded SQL credential for the TimeClock Plus timekeeping system, stored in plaintext XML.
8 SQL Server databases with full backup chains ATLAS (primary), PYREC (payroll), DYNAMICS (system), TEST (18 GB dev clone), TWO, AMIT, plus system databases (master, msdb, DynamicsGPSecurity).
PROM (Peakside Ros Outlet Management)
April 29, 2026
•[ ransomware, leak, retail ]
PROM (Peakside Ros Outlet Management) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Retail & E-Commerce. PROM (Peakside Ros Outlet Management) is a joint venture established by the investment firm Peakside Capital and the operator Ros Retail to manage outlet centers across Europe. The organization specializes in the strategic development of retail real estate, handling the full lifecycle from brand acquisition to operational marketing. Its primary objective is to maximize asset value and performance by implementing international management standards within the outlet sector.
Edenshaw Developments
April 29, 2026
•[ ransomware, leak ]
Edenshaw Developments was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.edenshaw.com.
