bwi-bau.de
October 5, 2026
•[ ransomware, leak, technology ]
bwi-bau.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: Germany. Website: bwi-bau.de. The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally
Michael K Shelby, CPA
October 6, 2026
•[ ransomware, finance, leak ]
Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi
ve range of tax and accounting services. They provide individual tax preparation, estate and tr
ust tax services, and business tax services, ensuring clients meet their tax obligations effici
ently.
We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs
, payment information), projects, client internal information and so on.
Kennametal
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
Morcon Developments
October 6, 2026
•[ ransomware, leak ]
Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A
I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
AmplifAI (GoDaddy instance)
November 1, 2026
•[ ransomware, leak, technology ]
AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump
================================================
URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7
============================================================
USER DATABASE 13,565 unique employees
============================================================
File: all_users.json
Fields per user:
"name": "",
"email": "",
"userseq": ,
"firstname": "",
"lastname": "",
"ad_id": "",
"password": "",
"aduser": "true/false",
"usertype": "1/2/3/4",
"employeenumber": ""
User Type Key:
1 = Admin
2 = Manager
4 = Agent
Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9
============================================================
ORGANIZATIONS 34 total
============================================================
1. Agent Dashboard Organizations
1. DEM Sales_Support - ALL
2. DEM Sales_Support - GDDY
3. DEM Sales_Support - TP
4. GD International Independents
5. GD US Independents
6. Commerce - GDDY
7. Commerce - TP
8. DEM Sales_Support - SGS
9. EMEA Brands - ALL
10. EMEA Brands - GDDY
11. EMEA Brands - TP
12. GAO - GDDY
13. GD Teleperformance
14. Global Messaging Ops - GDDY
15. Global Messaging Ops - Genpact
16. Global Messaging Ops - SGS
17. Global Messaging Ops - TP
2. Performance Dashboard Organizations
18. ROW Sales_Support - ALL
19. ROW Sales_Support - Genpact
20. ROW Sales_Support - SGS
21. Services - SGS
22. US Sales_Support - SGS
3. Analytics Organizations
23. Global Messaging Ops - ALL
24. ROW Sales_Support - TP
25. Services - ALL
26. Services - GDDY
27. Services - TP
28. US Sales_Support - ALL
29. US Sales_Support - GDDY
4. Non Core Care Organizations
30. US Sales_Support - TP
31. Non Core Care - GDDY
32. Non Core Care - Genpact
33. Non Core Care - SGS
34. Non Core Care - TP
============================================================
LOGIN LOGS 4,451 records
============================================================
File: login_logs.json
Fields per record:
"Name": "",
"Title": "",
"Module": "",
"Access Date": "",
"Access Time": "",
"Time Zone": "",
"Access Device": "",
"Primary Program": "",
"Organization": "",
"Location": "",
"Manager Name": "",
"OpsManager Name": ""
Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy
Sample devices: Desktop, Mobile
============================================================
ROSTER DATA 1,201 records (1,193 with @godaddy.com emails)
============================================================
File: roster.json
Fields per record:
"RosterExportID": "",
"companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8",
"employeeid": "",
"email": "",
"fname": "",
"lname": "",
"managerid": "",
"pbxid": null,
"location": "",
"primaryprogram": "",
"title": "",
"recorddate": "",
"hiredate": null,
"termdate": null,
"loginuserid": "",
"customfield1": null,
"customfield2": null,
"customfield3": null,
"customfield4": null,
"customfield5": null,
"customfield6": null,
"customfield7": null,
"customfield8": null,
"customfield9": null,
"customfield10": null,
"otherprogram1": null,
"otherprogram2": null,
"otherprogram3": null,
"otherprogram4": null,
"otherprogram5": null,
"otherprogram6": null,
"otherprogram7": null,
"otherprogram8": null,
"otherprogram9": null,
"otherprogram10": null,
"varcharemployeeid": "",
"varcharmanagerid": "",
"organization": "",
"movedToCosmos": "False",
"glidepathtitle": null,
"gltitleid": null,
"coach": null,
"programstartdate": null,
"RequestID": ""
Roster by Organization:
US Sales_Support - GDDY: 405 records
Global Messaging Ops - Genpact: 191 records
EMEA Brands - GDDY: 176 records
Commerce - GDDY: 135 records
DEM Sales_Support - GDDY: 103 records
ROW Sales_Support - SGS: 101 records
Commerce - TP: 41 records
Non Core Care - Genpact: 37 records
Services - TP: 12 records
----------------------------------------
TOTAL: 1,201 records
25 organizations have no roster data available.
============================================================
PROGRAMS 227 unique GoDaddy call center programs
============================================================
File: programs.json
Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services
============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================
Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)
AD User Identity Format:
"Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, username@godaddy.com, EMAIL format
Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
VPNE
September 24, 2026
•[ ransomware, technology, leak ]
VPNE was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Technology. Website: .. A company that specializes in managing people, transportation and other services for its clients in various industries
Terca
August 21, 2026
•[ ransomware, leak ]
Terca was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-08-21. Sector: Other. Country: Brazil. Website: www.terca.com.br. TERCA Zilli is a leading logistics operator in Esprito Santo, Brazil, offering innovative solutions and synonymous with logistical efficiency. The company provides a wide range of services including general warehousing, customs areas, and specialized storage for hazardous chemicals and vehicles. With a rich history and extensive experience, TERCA Zilli caters to diverse client needs while optimizing operations to reduce costs.
Thai Lion Air
October 2, 2026
•[ ransomware, leak ]
Thai Lion Air was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Transportation. Country: Thailand. Website: www.lionairthai.com.
Mandurah State Emergency Service
October 2, 2026
•[ ransomware, government, leak ]
Mandurah State Emergency Service was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Government & Defense. Country: Australia. Website: mandurahses.org.au. mandurahses.org.au Mandurah State Emergency Service is a volunteer emergency rescue unit (part of DFES Western Australia), founded in 1976/78 and celebrating its 50th anniversary in 2026, based at 31 Education Drive, Greenfields, WA 6210. It is a non-profit organization there is no revenue; funding comes from DFES (WA Government) and community donations. The unit has ~80+ active volunteers and 6090 cadets (ages 1217), one of the largest SES cadet programs in WA (26 years running), led by Local Manager Chris Stickland ESM (volunteer since 1986, unit leader since 2010). It responds 24/7/365 to storms, floods, land searches, water/cliff rescues and fires support logging ~3,5004,300 operational hours and up to 8,000 community hours per year.
Zelham
September 30, 2026
•[ ransomware, retail, leak ]
Zelham was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-30. Website: zelham.com. zelham.com rocketreach.co/zelham-inc-profile_b580fe5ef66e1a3f Zelham, Inc. is a U.S. hospitality renovation general contractor headquartered in Boise, Idaho, founded in 2000 and owned since 2023 by President & CEO Stephen Horel. The company specializes in hotel remodeling, rebranding, and ADA conversions, with 500+ completed projects and licenses in 47 states. It employs approximately 5557 people across 15 states, generating an estimated annual revenue of $9.6M$41.6M (sources vary). Zelham works with 20+ major hotel brands (Marriott, Hilton, IHG, Sonesta, Four Seasons), offering pre-construction planning, free estimates, and turnkey project management.
States Industries
October 2, 2026
•[ ransomware, manufacturing, leak ]
States Industries was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Manufacturing. Country: United States of America. Website: statesind.com. States Industries is a privately held American manufacturer specializing in premium hardwood plywood, custom wood veneer panels, prefinished panels, and specialty components. Founded in Eugene, Oregon, in 1966, the company serves woodworkers, architects, designers, cabinetmakers, furniture manufacturers, and commercial fabricators across North America. Its products include custom hardwood panels, ApplePly, NOVA prefinished panels, wall paneling, and precision-manufactured components. States Industries emphasizes innovation, quality, and environmentally responsible manufacturing, offering customizable veneer species, cores, finishes, sizes, and performance specifications. The company operates its primary manufacturing facility in Eugene and also operates DrawerBox Specialties in Orange, California. States Industries currently employs more than 300 people.
The company headquarters is located in 29545 Enid Road East, Eugene, OR 97402, United States. 201-500 Employees
Unident Group
October 4, 2026
•[ ransomware, leak ]
Unident Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Other. Country: United States of America. Website: www.unidentgroup.net.
OMUR HIRDAVAT LTD
October 4, 2026
•[ ransomware, manufacturing, leak ]
OMUR HIRDAVAT LTD was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Turkey. A Turkish company engaged in the wholesale and
retail trade of construction and household fittings
The archives contain several thousand documents with
personnel and customer data [Sector: Manufacturing]
Royal Selangor
October 4, 2026
•[ ransomware, manufacturing, leak ]
Royal Selangor was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Malaysia. Website: royalselangor.com. Both, your Registered Users & Customer list have been affected. 300K Lines Total, Includes: Names, Emails, Phone Numbers, Addresses, Purchase Amount, Payment Method, Pretty Juicy stuff you don't want getting out there. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
Cam Group LLC
October 5, 2026
•[ ransomware, leak ]
Cam Group LLC was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Other. Status: upcoming | Deadline: 2026-10-15T00:00:00Z
Sheppard, Mullin, Richter & Hampton
October 5, 2026
•[ ransomware, leak, finance ]
Sheppard, Mullin, Richter & Hampton was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. They offered $4.900.000 to keep the data from being published.
magnals.com
October 6, 2026
•[ ransomware, leak, legal ]
magnals.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: magnals.com. confidential data belonging to all these companies; magnals.com is responsible for the leak.
alunanuova@magnals.com
sraynal@magnals.com
info@ranshelpfi.com
kcawley@kirkland.com
pforan@hueston.com
mtodisco@hueston.com
sschnier@hueston.com
tking@hueston.com
lcohen@omm.com
lhack@motleyrice.com
monica.pedroza@morganlewis.com
thomas.hilton@morganlewis.com
kvose@motleyrice.com
lshaarda@motleyrice.com
mmontoya@skikos.com
tamara.giulianelli@morganlewis.com
karl.stampfl@kirkland.com
lshuler@hueston.com
khermiz@motleyrice.com
zachary.byer@kirkland.com
paul.weeks@kirkland.com
mpendell@motleyrice.com
mrivera@kirkland.com
mrobinson@robinsonfirm.com
zac.ciullo@kirkland.com
kcalcagnie@robinsonfirm.com
mcrawford@skikos.com
pdagostino@robinsonfirm.com
maureen.barber@morganlewis.com
pwilson@occourts.org
judith.hanratty@morganlewis.com
lelliott@motleyrice.com
Paulie.Fabian@da.ocgov.com
kding@hueston.com
mkaba@hueston.com
jhueston@Hueston.com
lstarks@hueston.com
mpurpura@hueston.com
smayer@hueston.com
tbecerra@omm.com
rebecca.zieben@morganlewis.com
kgrossman@omm.com
jschneller@omm.com
rmassing@hueston.com
mkaiser@omm.com
meimark-itc-1290@meimark.com
rwells@meimark.com
kdeighan@calfee.com
jhartman@merchantgould.com
jmiller@merchantgould.com
dylansuggsvideo@gmail.com
mso@levinperconti.com
MMirkovic@levinperconti.com
production@magnals.com
b.scott@magnals.com
samuel.ventresca@blankrome.com
JFeigenbaum@PostSchell.com
dspencer@magnals.com
jfrancis@magnals.com
dbrown@magnals.com
nbernik@magnals.com
mcantu@magnals.com
shorwitz@maganls.com
jtaran@jtaranlaw.com
michael@martinovskylaw.com
lori@costanzo-law.com
lucy.goodnough@costanzo-law.com
lawdesk@lex-omni.com
babbdesignsinc@gmail.com
gt@turitzadr.com
fburke@burkemediation.com
skaplan@Steptoe.com
mail@questvideoservice.com
balindadunlap@yahoo.com
lucy.marrone@costanzo-law.com
smisbah@steptoe.com
standard
shorwitz1@gmail.com
jnuttall@Steptoe.com
ktellez@steptoe.com
casey.griffin@ankura.com
marc.blanch@ankura.com
ECarapella@littler.com
rwangsness@occourts.org
mdjuric@omm.com
vharting@occourts.org
rhickman@magnals.com
revaldez@omm.com
cmonroe@motleyrice.com
csuarez@Steptoe.com
tfu@Steptoe.com
jcooper@steptoe.com
nathan.carpenter@dlapiper.com
sivakumarm@ballardspahr.com
sbylina@ziliak.com
disaacs@morrisoncohen.com
Michelle.Gorman@lewisbrisbois.com
kayla.clark@morganlewis.com
djensen@skikos.com
rklink@motleyrice.com
katherine.vaky@morganlewis.com
madock@rescar.com
aschaffer@rescar.com
mshepard@babstcalland.com
carolwarfield2005@yahoo.com
mlmarais@gmail.com
sean.nicholson@cornell.edu
justin.mccrary@gmail.com
minnie@b-henry.com
BVinci@duanemorris.com
jgoldsmith@magnals.com
mdundervill@motleyrice.com
karen.angelo@lewisbrisbois.com
rbaeza@bsfllp.com
vayala@bsfllp.com
teutafani@quinnemanuel.com
violatrebicka@quinnemanuel.com
joten@hueston.com
ddelgrande@hueston.com
edunbar@magnals.com
bmccafferty@magnals.com
VNestor@magnals.com
MJimenez@ktanda.com
HValgoi@magnals.com
VRice@ktanda.com
HPorter@CHDLawyers.com
eflorian@coplancrane.com
david@yegeresq.com
scaldwell@pmtlawfirm.com
gstrong@gllawgroup.com
mguararra@guararralaw.com
RFUMO@travelers.com
manan74@yahoo.com
johara@fbzlaw.com
dperkins@robinsonfirm.com
sfranklin@magnals.com
sarajenkins@quinnemanuel.com
dstraite@dicellolevitt.com
brichardson@BSFLLP.com
rmcgee@forthepeople.com
jcabezas@forthepeople.com
wsangster@magnals.com
SWood@chuhak.com
cemling@cyp-law.com
chartley@magnals.com
RKrishnapriyan@durietangri.com
enyborg-burch@bsfllp.com
trodriguez@bsfllp.com
jomairecrawford@quinnemanuel.com
carlspilly@quinnemanuel.com
eharding@magnals.com
ABrausa@durietangri.com
VRanieri@durietangri.com
drew@kzllp.com
michael@skipti.com
ttucker@calfee.com
bliu@calfee.com
dlikens@calfee.com
outsider12b@hanmail.net
ProcopioITC1290@procopio.com
youngmin.hwang@lge.com
hojun.suh@lge.com
jaeoak.kho@lge.com
jin.seomoon@lge.com
Nicholas.jackson@dentons.com
Kevin.greenleaf@dentons.com
Tyler.goodwyn@dentons.com
Mark.hogge@dentons.com
Song.jung@dentons.com
alexjo.translator@gmail.com
annpark@pacls.com
kuyoung.son@lge.com
byunghwan.ahn@lge.com
tg.kong@lge.com
ejmichelle@gmail.com
Vivian.sandoval@dentons.com
Matthew.sim@dentons.com
Nah-eun.kim@dentons.com
jhochberger@meimark.com
jzhang@meimark.com
mei@meimark.com
rmyers@prmpclaw.com
kfisch@Steptoe.com
sreid@steptoe.com
willowashlynn@gmail.com
vikashni@vashlegalservices.com
sbowlby@plunkettcooney.com
arodas@magnals.com
rkappers@steptoe.com
tyebernetsky@Steptoe.com
dgelwicks@Steptoe.com
kcappaert@steptoe.com
bholt@steptoe.com
tmurray@magnals.com
amanda@levinzeiger.com
mmiller@steptoe.com
johnsmith@supercoolattorneys.org
AnnieLee@mofo.com
ckwark@steptoe.com
pbirdsall@steptoe.com
johnsmith@magnals.com
VCTeam@magnals.com
Tema Hwt
November 1, 2026
•[ ransomware, leak, manufacturing ]
Tema Hwt was listed as a victim on the leak site of the Shiba ransomware group; the attack is estimated to have taken place on 2026-11-01. Country: Germany. Website: tema-hwt.de. TEMA Heizung Berlin is a company that provides heating services in Berlin. They offer a range of heating options including heating pumps, maintenance, and optimization. They also provide services for existing oil/gas heating.
Hospital Hermilio Valdizán
August 21, 2026
•[ ransomware, healthcare, leak ]
Hospital Hermilio Valdizn was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-08-21. Sector: Healthcare. Country: Peru. Website: www.hhv.gob.pe. HHV public psychiatric hospital in Lima, Peru, operated by MINSA. It provides specialized mental health services, including inpatient and outpatient psychiatric care, psychotherapy, rehabilitation, and neurology. Its main clients are low-income patients, many covered by SIS.
