hillandbeyer.com
November 3, 2026
•[ ransomware, leak, healthcare ]
hillandbeyer.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Professional Services. Country: United States of America. Website: hillandbeyer.com. Hill & Beyer is a law firm that provides legal representation and related client services.
Management at Hill & Beyer has been officially informed regarding a major breach involving highly sensitive data.
The compromised file repository encompasses a broad spectrum of confidential documents, notably featuring private patient medical histories and health records, audio recordings alongside transcripts from 911 emergency dispatches, investigative files concerning legal infractions, and comprehensive logs and transcripts of formal interrogations.
Initially, an effort was made to resolve the matter privately and confidentially. Numerous phone calls, warnings, and formal notifications were dispatched to the organization's administration and leadership. However, management chose to disregard these warnings and severed all communication without implementing any remediation measures. Consequently, this public statement is being issued.
butler.legal
November 3, 2026
•[ ransomware, leak ]
butler.legal was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Professional Services. Country: United States of America. Website: butler.legal. client data personal case
IHG Hotels & Resorts (Estate)
November 3, 2026
•[ ransomware, misconfiguration, leak ]
IHG Hotels & Resorts (Estate) was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-11-03. Sector: Hospitality. Country: United Kingdom of Great Britain and Northern Ireland. Nice LDAP Binding Password being '123'. Rotating things won't really save you casue it's not hard to hop back on your network. Anyways, we now have; Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store. Additionally we have reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property) with Access to the AD + All Financial Records. This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc you can pick up what we are putting down at this point. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
ASLAN TEKSTİL ve KONFEKSİYON San.ve Tic. A.Ş.
November 4, 2026
•[ ransomware, manufacturing, leak ]
ASLAN TEKSTL ve KONFEKSYON San.ve Tic. A.. was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: Turkey. Status: leaked | Data size: 3.27 GB | Files: 6457 files | Deadline: 2026-11-04T00:00:00Z
Juge, Napolitano, Ruli, Putfark & Pittman
November 4, 2026
•[ ransomware, leak, healthcare ]
Juge, Napolitano, Ruli, Putfark & Pittman was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Professional Services. Juge, Napolitano, Ruli, Putfark & Pittman Juge, Napolitano, Ruli, Putfark & Pittman / 'WC Defense' - insurer & corporate defense law firm.The Juge Firm (Metairie / Covington, LA, founded 1983) is one of the oldest workers' compensation defense law firms, protecting employers, insurers and TPAs against injured workers' claims.Clients (148 client-guideline files): Sedgwick, Gallagher Bassett, Broadspire/Crawford,ESIS/ACE, AIG, Allstate, Chubb, Zurich, Amazon, Walmart, Home Depot, CVS Health, FedEx, Lyft, Costco, Hilton, Northrop Grumman, State Farm,Travelers, Coca-Cola, Fluor, GEO Group, Archdiocese of New Orleans, the cities of New Orleans / Baton Rouge / Shreveport, and others.2,383,324 files, ~3.2 TB.- 4,477 full workers' comp defense case files: 175,993 PDFs, 73,239 DOCX, 61,622 DOC, 55,798 MSG emails, 28,244 TIF scans;- claimant medical imaging: 6,461 DICOM files (MRI/CT/X-ray);- 28,410 medical EOBs and disputed LDOL-WC-1008 claims (full PII + diagnoses of injured workers);- 1,884 new-file intake sheets with complete claimant PII (SSN, address, DOB, injury);- 3,265 counterparty W-9 forms (EINs, signatures, current 20242025);- 850 claimant surveillance videos ('Surveillance', 214 GB) - covert footage of injured workers;- inbound attorney-correspondence faxes, live ECF/PACER court logins, and 148 confidential insurer client guidelines. More
Company #128
November 4, 2026
•[ ransomware, leak, technology ]
Company #128 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-11-04. Country: United States of America. consumer identity data and analytics United States | [PENDING EXPOSURE]
jhz-bernardshof.de
November 4, 2026
•[ ransomware, healthcare, leak ]
jhz-bernardshof.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Hospitality. Country: Germany. Website: jhz-bernardshof.de. Established in 1928, the organization provides residential, semi-residential and outpatient support services for children, adolescents and young adults who require
cadorath.com
November 4, 2026
•[ ransomware, manufacturing, leak ]
cadorath.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-11-04. Country: Germany. Website: cadorath.com. [AI generated] N/A
I don't have reliable, verified information about a company at "cadorath.com" to provide an accurate factual description. Rather than risk providing inaccurate details about this organization's operations, industry, or location, I'm responding with N/A as instructed. If you can share additional context or verified details about this company, I'd be glad to help analyze or summarize that information instead.
ciscocems.com
November 4, 2026
•[ ransomware, technology, leak ]
ciscocems.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Country: United States of America. Website: ciscocems.com. [AI generated] N/A
I don't have reliable, verified information about "ciscocems.com" as a distinct company. This domain name superficially resembles "Cisco," but I cannot confirm any legitimate affiliation, business purpose, industry, or country of operation without verified data. Fabricating details about an unfamiliar or potentially suspicious domain would be inappropriate, especially given the risk it may be associated with phishing or impersonation activity.
hhjcpa.com
November 4, 2026
•[ ransomware, finance, leak ]
hhjcpa.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Professional Services. Country: United States of America. Website: hhjcpa.com. [AI generated] N/A
I don't have reliable, verified information about a specific company operating at the domain "hhjcpa.com." While the domain name suggests it could be associated with a CPA (Certified Public Accountant) firm, likely offering accounting, tax, or financial advisory services, I cannot confirm details such as its specific business operations, industry positioning, size, or country of operation without risking providing inaccurate or fabricated information.
Food Bank of Central Louisiana
November 4, 2026
•[ ransomware, leak, financial ]
Food Bank of Central Louisiana was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Agriculture and Food Production. Country: United States of America. Website: www.fbcenla.org. About Food Bank of Central Louisiana\ The Food Bank of Central Louisiana is a nonprofit organization dedicated to alleviating hunger in Central Louisiana through collaboration and food distribution programs. They provide assistance to over 42,500 households annually, offering resources such as SNAP applications and mobile pantry services. Their initiatives include programs aimed at strengthening children and nourishing seniors, addressing the specific needs of vulnerable populations. The organization encourages community involvement through donations and volunteer opportunities to support their mission. The Central Louisiana Food Bank was the victim of a cyberattack, resulting in the theft of more than 130 GB of confidential data. The stolen data includes documents such as banking and financial information, personal data of employees and clients, databases, and other important company information.
Homestead Creamery
November 4, 2026
•[ ransomware, leak, finance ]
Homestead Creamery was listed as a victim on the leak site of the Dark Project ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Agriculture and Food Production. Country: United States of America. Website: www.homesteadcreameryinc.com. About Homestead Creamery Homestead Creamery specializes in premium dairy products made from milk sourced from local A2A2 cows. They offer minimally pasteurized milk, rich ice cream, and all-natural lemonade, all crafted to preserve flavor and quality. Their products are available in returnable glass bottles and can be found in various stores. The company aims to provide delicious, wholesome dairy options for consumers who appreciate quality and taste. As a result of the attack on Company Homestead Creamery, more than 70 GB of confidential data was stolen. More than 120,000 files were not secured by Company and contain data such as banking and other financial information, as well as employees' personal data.
Unilever
November 4, 2026
•[ ransomware, manufacturing, leak ]
Unilever was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Unilever is a British multinational consumer goods company headquartered in London. It owns over 400 brands, including Dove, Knorr, Hellmann's, and Rexona, spanning beauty, personal care, home care, and foods, serving consumers in around 190 countries worldwide.
We hold 665K contacts, 5.5K OTM accounts with roles and logins, 14M locations, 3.8M shipments, 229M status records, 13.8K invoices, plus 838K distributor loyalty profiles and ledgers. 79 gigabytes, 1.8 million files, three regions.
Unilever7.z is about 79GB decompressed.
Our ransom demand is only $15,000,000 in BTC
Emails with instructions will be sent to you shortly, if you have failed to receive them,
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
hamiltonhealthcenter.com
November 4, 2026
•[ ransomware, healthcare, leak ]
hamiltonhealthcenter.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Healthcare. Country: Canada. Website: hamiltonhealthcenter.com. [AI generated] N/A
I don't have verified, reliable information about a specific organization operating at "hamiltonhealthcenter.com." There are multiple healthcare facilities with similar names ("Hamilton Health Center," "Hamilton Health Centers," etc.) in different locations, and without confirmed details I cannot accurately report on its services, industry specifics, or country of operation without risking providing inaccurate information.
The Courier Guy
November 4, 2026
•[ ransomware, leak ]
The Courier Guy was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Transportation. Country: South Africa. The Courier Guy (thecourierguy.co.za) is a South African courier company. The dump covers its operations: purchase orders to suppliers, staff recruitment and training records, leave schedules, shopping-centre lease renewals (Wonderpark, South Coast Mall, Growthpoint The Avenues), security SLAs, and vehicle finance documents.
Geetees
November 4, 2026
•[ ransomware, retail, leak ]
Geetees was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. G.Twist (Wholesale) Ltd. wholesales goods, including licensed merchandise such as Harry Potter and Christmas items. The company also tracks orders, inventory, and online sales through payment systems.
Harvard
November 18, 2025
•[ hack, leak, education ]
In November 2025, Harvard University suffered a data breach later linked to a ShinyHunters "pay or leak" extortion attempt. The data contained 851k unique email addresses relating to the university's alumni and fundraising systems, along with extensive profile information for donors, alumni, parents and some faculty, staff and students. In Harvard's disclosure notice, the university stated that the breach impacted "personal information such as email addresses, telephone numbers, home and business addresses, event attendance, details of donations to the University, and other biographical information pertaining to University fundraising and alumni engagement activities".
J.C. Cannistraro, LLC
October 4, 2020
•[ ransomware, leak, manufacturing ]
J.C. Cannistraro discovered unusual activity in its computer network on October 4, 2020 and determined that the network had been encrypted by ransomware. The company notified personnel on October 7 and later learned that personal information had been disclosed to an unauthorized party; regulatory reporting lists 1,660 affected individuals, and a former employee later received an alert that his Social Security number was on the dark web. Avaddon listed J.C. Cannistraro on its leak site in November 2020, supporting group attribution, although the company did not publicly confirm the actor. The technical source of the stolen data is not established, so the exploitive subtype remains undetermined.
Order Express, Inc.
July 29, 2022
•[ ransomware, finance, leak ]
An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
University of Health Sciences and Pharmacy in St. Louis
April 1, 2023
•[ ransomware, education, healthcare ]
The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
