gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local
September 9, 2026
•[ ransomware, leak, retail ]
gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local was listed as a victim on the leak site of the embargo ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Agriculture and Food Production. Country: United States of America. Website: gardensalive.com. Gardens Alive, Inc. is a privately held U.S. consumer goods company specializing in direct-to-consumer gardening products, plants, seeds, nursery stock, fertili... - 2tb data
John Engel Team
September 10, 2026
•[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
EASY JOB S.A.S.
September 10, 2026
•[ ransomware, finance, leak ]
EASY JOB S.A.S. was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: Colombia. Website: easyjobsas.com. Colombian Company.
Audit and Tax Audit with more than 5 years of experience
Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medelln Colombia.
Llmanos o escrbenos: 310 447 2013 - 313 796 9917
The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents
17000 documents [Size: 2.7 GB | Sector: Finance]
AK Stamping
August 19, 2026
•[ ransomware, manufacturing, leak ]
AK Stamping was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-08-19. Sector: Manufacturing. Website: akstamping.com. AK Stamping is a leader in precision metal stamping technology, offering engineered design solu
tions and a complete package of manufacturing capabilities, including prototyping, tooling, and
precision stamping for various manufacturing scales.
We will upload 30gb of corporate data soon. SQL and other internal files.
CO-OP URBAN BANK LTD
September 10, 2026
•[ ransomware, finance, leak ]
CO-OP URBAN BANK LTD was listed as a victim on the leak site of the Global Secret Group ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Financial Services. Country: India. Website: indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited. Country: India |
Website: https://indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited/ |
Revenue: $50 Million |
Industry: Bank, Finance |
Employees: 25-50 |
Properties: 41.3 GB (125,988 Files, 14,641 Folders)
Frisby Roofing (Frisby Construction LLC)
September 12, 2026
•[ ransomware, leak ]
Frisby Roofing (Frisby Construction LLC) was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Other. Country: United States of America. Website: frisbyconstruction.com. Residential roofing contractor (family-owned, locally operated). Complete roof tear-off and replacement, dimensional shingles (CertainTeed, Tamko Heritage, GAF), ice/water shield, flashing, ventilation, gutter aprons, pipe boot flashing. Phone: (513) 924-4377 (main/24-7), (513) 576-0679 (showroom/office); email Sales@FrisbyConstruction.com; web www.FrisbyRoofing.com. Suppliers: QXO (Cincinnati branch), Beacon Building Products (Tri-Built/CertainTeed), Mueller, NisbetBrower, The Patch Boys, Corken Steel, McCabe Lumber; subcontractor BullDogg Home Repairs (Kenny Goodin). Payroll: Paycor/PaySimple (staff incl. Nathan Wilson, Field Tech). Legal: mechanic's liens and lien releases (Hamilton/Clermont County Recorder), Chapter 13 case 1:26-bk-10008 (Pickelheimer). | USA, Ohio: 1375 State Route 131, Suite D1, Milford, OH 45150 (physical showroom); service area: Cincinnati metro / Hamilton, Butler, Clermont, Warren counties; BBB accredited since 02/25/2009, rating A+, 4.98/5 (131 reviews), 10,000+ roofs completed
瑞祥机电 (Ruixiang Jidian)
September 12, 2026
•[ ransomware, manufacturing, leak ]
(Ruixiang Jidian) was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Manufacturing. Country: China. Elevator manufacturer, brand (Yinhai). Produces machine-room-less (MRL) passenger elevators and OEMs elevator components (car top/bottom, car wall panels, COP, doors) for OTIS, KONE, Hitachi, Toshiba, TKS (). Export business (project DUBROVSKIY-2, customer ). Infrastructure: Synology NAS (admin), IT dept with Epson L1118. | China, Jiangsu Province ( / Limin North Road)
intherpro.com
September 12, 2026
•[ ransomware, leak, manufacturing ]
intherpro.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Professional Services. Website: intherpro.com. Intherpro LLC (International Thermal Insulation & Passive Fire Protection Company) is a UAE-based global leader in engin...
www.tender.mx
September 12, 2026
•[ ransomware, retail, leak ]
www.tender.mx was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-12. Sector: Government & Defense. Country: Mexico. Website: www.tender.mx. Tender (Carnicera Tender) is a Mexican premium butcher shop chain (carnicera) founded under the original brand Vigar...
Navitrans
September 13, 2026
•[ ransomware, leak, manufacturing ]
Navitrans was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-13. Sector: Transportation. Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. [Size: 223.2 MB | Sector: Manufacturing, Transportation]
Metropolitan Community Health Services
August 24, 2026
•[ ransomware, healthcare, leak ]
Metropolitan Community Health Services was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Healthcare. Country: United States of America. Website: www.agapechc.org. Agape Health Services, a CCBHC/FQHC run by Metropolitan Community Health Services, offers sliding-scale primary, preventive, dental, pharmacy, and behavioral health care, plus mobile, law-enforcement, training, and reentry services.
RoadEx America
September 14, 2026
•[ ransomware, leak ]
RoadEx America was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Transportation. Country: United States of America. Website: www.roadexamerica.com.
Winston Contracting, LLC
September 14, 2026
•[ ransomware, leak ]
Winston Contracting, LLC was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Professional Services. Country: United States of America. Website: winstoncontracting.com.
HandyTrac (Greystar Litchfield Park, AZ)
September 15, 2026
•[ ransomware, technology, leak ]
HandyTrac (Greystar Litchfield Park, AZ) was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Other. Country: United States of America. Website: new.handytrac.com. We have access to sensitive data. It's in your best interest to contact us and negotiate since it will just hurt you if you don't. We stole a lot of sensitive info including the following:
- Physical-to-Digital Key Maps (Reports)
- Property Intelligence & Vulnerability Logs (HandyTrac Key Control.pdf)
- Employee Identity & Credential Data (Employees)
- Financial & Vendor Records (Open_and_closed_Invoices)
- Administrative Portal Control (Dashboard / Administration)
This is not a joke or a bluff it's a sign of a corporate disaster. Figure it out and negotiate and the picture for proof is on are site at the below
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/Screenshot_proof.png
As you can see negotiate within 72 hours or we will leak the full data.
TMI Tecnicas Mecanicas Ilerdenses
September 14, 2026
•[ ransomware, manufacturing, leak ]
TMI Tecnicas Mecanicas Ilerdenses was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Manufacturing. Country: Spain. Website: tmipal.com. tmipal.com zoominfo.com/c/tmi-tecnicas-mecanicas-ilerdenses-sl/372767545 TMI Tecnicas Mecanicas Ilerdenses Spanish machining and metal-casting factory from Lleida, Catalonia founded 1991, producing and repairing components for agricultural machinery and industrial customers (custom parts made to customer drawings; "Ilerdenses" refers to Ilerda, the Roman name of Lleida). Classic quiet Catalan workshop serving Spain's fruit-growing capital, where farm equipment wears out fast and OEM replacement parts aren't always available.
Agenzia Vittoria Assicurazioni
September 14, 2026
•[ ransomware, finance, leak ]
Agenzia Vittoria Assicurazioni was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Financial Services. Country: Italy. Website: assicurazionilodi.it. assicurazionilodi.it zoominfo.com/c/agenzia-vittoria-assicurazioni-lodi-stazione/1342235416 Vittoria Assicurazioni "Lodi Stazione" agency (#393 in the network) a private insurance agency owned by Massimo Garati in Lodi, Lombardy (Via Nino dall'Oro 28/30, RUI A000169373, registered 30.11.2010, Section A agent under IVASS supervision). Garati's story: he ran an ITAS agency for years, then in 2016 executed a full portfolio transfer (travaso di portafoglio) from ITAS to Vittoria Assicurazioni a rare mandate switch carrying his entire client base and built an unusual digital edge for provincial Italy: a generic city domain ("assicurazioni Lodi" = local SEO gold), Google Ads/My Business management and a content-rich FAQ site. He sells the full Vittoria line: auto/mobility, home, family, pets, savings, pensions, legal protection, agriculture, crafts, offices/hotels, transport. Behind it stands the parent Vittoria Assicurazioni S.p.A. (Milan, founded 1921 )
Asada Sarapiqu
September 15, 2026
•[ ransomware, leak ]
Asada Sarapiqu was listed as a victim on the leak site of the arcusmedia ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Agriculture and Food Production. Country: Costa Rica. Website: asadasarapiqui.com. asadasarapiqui.comAsada Sarapiqu is an organization focused on providing water supply ser Deadline: 2026-09-22 11:37:00.000000
Resolve Law Group
September 15, 2026
•[ ransomware, leak ]
Resolve Law Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Professional Services. Country: United States of America. Website: www.resolvelawgroup.com.
Southern California Telephone Company
September 15, 2026
•[ ransomware, technology, leak ]
Southern California Telephone Company was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Energy & Utilities. Country: United States of America. Southern California Telephone Company (SCTC) is a dynamic telecom provider with over 30 years o
f experience, offering a comprehensive range of services for both residential and business clie
nts. Their product lineup includes high-speed internet, mobility solutions, virtual fax service
s, and VoIP offerings, catering to various connectivity needs.
We will upload 34gb of corporate data soon. Employee personal information (passports, w-9s and
so on), customer information (phone numbers and other sensitive information), contracts and agr
eements, NDAs, confidential certificates and so on.
Taurus Ibérica
September 15, 2026
•[ ransomware, leak, manufacturing ]
Taurus Ibrica was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-15. Sector: Manufacturing. Country: Spain. Website: www.taurusiberica.com.
