Alpha Group Holdings
May 24, 2026
•[ ransomware, retail, leak ]
Alpha Group Holdings was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-05-24. Sector: Retail & E-Commerce. Country: New Zealand. Website: www.buy.alphagroup.nz.
BASE SPA
May 25, 2026
•[ ransomware, leak, financial ]
BASE SPA was listed as a victim on the leak site of the spacebears ransomware group; the attack is estimated to have taken place on 2026-05-25. Sector: Professional Services. Country: Italy. Website: www.basespa.com/en/the-company. BASE S.p.A.is a company internationally operating in the field ofgoods inspection, in themanagement of commodities loading/unloading and logistic services, in the pertinentcertificationsandcustoms brokerage, generally offers full assistance in the international trading being present in about35 countries worldwide. BASE S.p.A. is established in 1983 as International Freight Forwarder, Custom House Broker and Inspection Company and achieved important goals, becoming one of the more affirmed and known operator of the field of the port services. The Company got an immediate commercial success, all now is in continuous growth, increasing her own business volume day by day, developing in the years an international top quality network. The Company specialized itself incontainers and project cargo handling, waste recycling promotion, bulk dry & liquid cargo traffic, control and survey. The operative administrative centre is placed in Livorno, from where local staff, Italian branches, and companys world partners are monitored and followed up. The constant growth of business volume has allowed to saving and the private financing her own business by continuous investments in the staffs know-how, supporting the staff by training finalized to professional grew, in innovation and expansion of the national and international structures, making certain thebest solution to tradersto any tied up problem related to the commodities manipulation, allowing them to bringing trade in absolute serenity and safely. In fact ourefficacy consists of ensuring an individual solution to each client, sorting out for their demands. -Confidential information-Personal information of employees and clients-Financial documents-Other files https://www.basespa.com/en/the-company/
Eriell
May 26, 2026
•[ ransomware, energy, leak ]
Eriell was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-26. ERIELL Group RU specializes in providing oil and gas engineering services. The company focuses on advanced drilling solutions and offers a range of services tailored to the energy sector. Its clients include various oil and gas companies seeking innovative drilling technologies and operational enhancements. Established in 2014, ERIELL Group has expanded its workforce and capabilities to serve clients effectively - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
WG Neukölln
May 27, 2026
•[ ransomware, energy, leak ]
WG Neuklln was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Energy & Utilities. Country: Germany. Website: gwneukoelln.de. WG Neuklln eG is a cooperative based in Berlin that offers various housing options and services, including apartments and residential projects. The organization is committed to social engagement and provides a venue for events, as well as support for its members through social management. They focus on sustainable energy projects and aim to enhance the living experience for their tenants. Their intended clients include individuals and families seeking affordable housing solutions in the Neuklln area.
dentonfirm.com
May 27, 2026
•[ ransomware, leak ]
dentonfirm.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Professional Services. Country: United States of America. Website: dentonfirm.com. Denton Law Firm is committed to rapid response and providing real solutions.
Gone Fishin' Marine
May 27, 2026
•[ ransomware, retail, leak ]
Gone Fishin' Marine was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Hospitality. Gone Fishin' Marine specializes in offering a wide range of new and used boats from top brands
such as Ranger, KingFisher, Sea Ray, and more.
We will upload corporate data soon. Employee information, contracts and agreements, financials,
clients information, projects and so on.
FWMK Law Offices
May 27, 2026
•[ ransomware, leak ]
FWMK Law Offices was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Professional Services. Country: Israel. Website: fwmk-law.co.il. FWMK Law Offices is a full-service law firm known for its deep expertise in various legal areas, including high tech, mergers and acquisitions, and real estate. The firm provides top-quality legal advice and representation to a diverse clientele, including international clients, private investors, and public companies. With a team of highly skilled and responsive attorneys, FWMK emphasizes a professional yet friendly approach to client relations. Their commitment to excellence and understanding of business needs positions them as a trusted partner for organizations navigating the complexities of the legal landscape.
jcripberger.com
May 27, 2026
•[ ransomware, leak, manufacturing ]
jcripberger.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Country: Germany. Website: jcripberger.com. J.C. Ripberger Construction Corporation is a full-service General Contractor, which self-performs Buildings/Structural Concrete, Carpentry, and Selective/Mass Demolition. Founded over 68 years ago in Zionsville, Indiana, our strategic focus has and continues to be new construction and renovations within the commercial, educational, health care and industrial sectors.
wsm.co.uk
May 27, 2026
•[ ransomware, finance, leak ]
wsm.co.uk was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: wsm.co.uk. The firm's core business is focused on UK tax services, which are provided to clients seeking an advisor with not only in-depth knowledge to navigate the country's complex tax system,
but also impeccable integrity to ensure optimal tax results.
At the core of the company is an experienced team of professionals providing expert knowledge and advice on UK tax matters to private and corporate clients both local, national, and international.
In the current climate of tightening anti-tax evasion measures, WSM specialists firmly believe in the ethical right of taxpayers to manage their financial affairs strictly within the law in a way that minimizes their tax liabilities.
In addition to tax services, the firm offers accounting, auditing, insolvency (bankruptcy) support,
due diligence, and consulting. Additionally, through its European partner network, Europe Fides,
the company assists clients seeking complex, often multi-jurisdictional, advice in developing their overall strategic plans.
ksmart.ca
May 27, 2026
•[ ransomware, leak, technology ]
ksmart.ca was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-27. Sector: Retail & E-Commerce. Country: Canada. Website: ksmart.ca. K. Smart Associates Limited is a consulting engineering and planning company established in 1975, specialising in civil engineering and land use planning.
lawants
May 28, 2026
•[ ransomware, finance, leak ]
lawants was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Professional Services. Country: Spain. Website: lawants.com. Lawants provides its clients with lawyers, Tax Advisors and Accountants accustomed to working in the international arena.
Our goal is to become the clients referents in the areas of expertise to address and solve all phases of a project, or issue, with an interdisciplinary and problem-solving-oriented approach.
Likewise, we believe that the client must necessarily be an integral part of the Lawants team.
We like to work, dialogue, confront each other and make our clients participants in every process that affects them to help them grow in their Business in Spain, the United States and South America.
Laek: 100GB
WE HAS COLLECTED SUCH DATA AS:
- Confidential documents
- Clients Data
- NDA
- Financial data
- Operations
- Corporate data
- Business Agreements
- Development
- Financial databases, all transactions, all clients
And a lot of other VERY IMPORTANT information!
xl africa group
May 28, 2026
•[ ransomware, technology, leak ]
xl africa group was listed as a victim on the leak site of the 0day Syndicate ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Professional Services. Country: Ghana. Website: xlafricagroup.com. XL Africa Group provides outsourcing services like HR, logistics, security, and cash management to other companies across Africa.
AKM
May 28, 2026
•[ ransomware, leak, technology ]
AKM was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Technology. Country: Japan.
Spedition Kern
May 28, 2026
•[ ransomware, leak ]
Spedition Kern was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Transportation. Country: Germany. Website: spedition-kern.com.
Fonderia Corra
May 28, 2026
•[ ransomware, manufacturing, leak ]
Fonderia Corra was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Manufacturing. Country: Italy. Website: fonderiacorra.com. fonderiacorra.com zoominfo.com/c/fonderia-corra/371359796 Fonderia Corra is an Italian foundry founded in 1946, specializing in high-precision cast iron components for industrial sectors like railway, energy, and machinery. With over 70 years of expertise, they offer in-house services from design optimization to final finishing, ensuring quality, waste reduction, and ISO 9001 certification. The company operates two plants in Thiene and Montebelluna, producing lamellar and spheroidal graphite cast iron using advanced automation and skilled professionals. Family-led since its founding, Fonderia Corra combines tradition, innovation, and passion to shape metal into core elements for demanding global industries
Peña & Bromberg
May 28, 2026
•[ ransomware, leak ]
Pea & Bromberg was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Professional Services. Country: United States of America. Website: jonathanpena.com. A legal firm dedicated to safeguard the rights of its clients
powerhousenow.com
May 28, 2026
•[ ransomware, leak ]
powerhousenow.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Professional Services. Country: United States of America. Website: powerhousenow.com. STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS
ENTITY: Powerhouse (powerhousenow.com)
THE REALITY OF POWERHOUSE
We have been in possession of your internal data for some time. We have attempted to engage with your management to resolve this incident professionally, but their silence speaks
BCD Travel
May 29, 2026
•[ ransomware, leak, technology ]
BCD Travel was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: Netherlands. Over 700k Salesforce records and various Sharepoint sites corporate data has been compromised. This is a final warning to reach out by 1 June 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. Pay or Leak. | Updated: 29 May 2026 | Warning: FINAL WARNING PAY OR LEAK
Schacht Law Office
April 17, 2026
•[ ransomware, leak, finance ]
Schacht Law Office was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Professional Services. Website: schachtlaw.com. Schacht Law Office specializes in intellectual property legal services, focusing on the protect
ion of patents, trademarks, copyrights, and trade secrets. They assist clients in defining and
safeguarding their ideas to ensure the prosperity of their intellectual property and brand.
We will upload 20gb of corporate data soon. Lots of clients data (credit cards, name, addresses
, phones and so on), contracts and agreements, NDAs, projects, etc.
www.labexpress.com
May 29, 2026
•[ ransomware, brute-force, healthcare ]
www.labexpress.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: United States of America. Website: www.labexpress.com. LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE
We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive crosscompany records. This data will be made publicly available in the near future.
Active Directory Overview
- 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs).
- Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2).
- A single AD domain serves both Labexpress and Garonit Pharma.
Notable account:
cn: Troy Austin
sAMAccountName: Taustin
memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS
The same person appears in Exchange mailboxes as taustin@garonitpharma.com.
Weak Passwords and BruteForce Indicators
- Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30.
- Computer accounts FRONTDESK$, DEV$, LABEL$ more than 3,000 failures each.
- Cleartext password found on FILE01\passwords.txt:
Admin: LabExpress2024!
- The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT.
- Password for user Protect: Password123!
- Outdated password templates in the SBSUsers OU are still in use.
Mail Servers and Exchange
- LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007.
- Full mailbox export performed using the builtin Export-Mailbox cmdlet no special exploit required.
Contents of the Obtained Data (200 GB)
We have data from drive E:\, including:
1. Financial & Accounting
- QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND).
- Folder: E:\Garonit Documents\Clients 2022\ hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf).
- Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ detailed accounts payable records for 50+ vendors.
2. Quality & Production
- Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx).
- Complete batch records for 20232026 (folders Batch Records\2023, 2024, 2025, 2026).
- Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse.
3. ANDA & Regulatory Documentation
- Folder 00 Oral Rinse ANDA-Old One complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA.
- Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf.
4. Vendor & Customer Records
- Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ dossiers on each supplier (contracts, invoices, assessments).
- Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ customer purchase orders and sales quotations.
5. Human Resources (HR)
- Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ employment contracts, W9 forms, tax deductions, resignation letters.
- Passport scans, Green Card copies, health insurance records for many employees.
- Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf.
6. Internal Communications & Scans
- Directory C224E BIZHUB SCANNER DUMPS containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.).
- Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS.
- Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents).
7. Tax & Banking Documentation
- Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank.
- Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf.
Shared Infrastructure Observed Facts
- The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma.
- Crosscompany records reside in the same folders (e.g., Garonit Documents and LABEXPRESSDATA coexist on the same drive).
- User Troy Austin has an AD account (Taustin) and also uses the email address taustin@garonitpharma.com.
- Purchase orders, invoices, COA/COC files refer to both companies interchangeably.
- At the IT level, there is no separation between the two legal entities.
The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future.
