J.C. Cannistraro, LLC
October 4, 2020
•[ ransomware, leak, manufacturing ]
J.C. Cannistraro discovered unusual activity in its computer network on October 4, 2020 and determined that the network had been encrypted by ransomware. The company notified personnel on October 7 and later learned that personal information had been disclosed to an unauthorized party; regulatory reporting lists 1,660 affected individuals, and a former employee later received an alert that his Social Security number was on the dark web. Avaddon listed J.C. Cannistraro on its leak site in November 2020, supporting group attribution, although the company did not publicly confirm the actor. The technical source of the stolen data is not established, so the exploitive subtype remains undetermined.
Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Undisclosed U.S. industrial automation company
March 1, 2025
•[ espionage, manufacturing, technology ]
CISA and the FBI reported that foreign cyber actors on the network of an unnamed U.S. industrial automation integrator serving utilities and transport firms collected about 800 files of customer SCADA data, ICS device details and schematics in March-April 2025.
Central National Gottesman Inc.
February 26, 2026
•[ ransomware, leak, manufacturing ]
On or around February 26, 2026, an unauthorized third party accessed part of Central National Gottesman's network and obtained files from company systems. The incident was discovered by February 28. PayoutsKing publicly claimed the company on March 2. Regulatory filings report 9,126 affected individuals and confirm exposure of identity, financial, health, and payroll-related information. DataBreach.com separately indexed 207,519 rows associated with the incident.
Elliott-Lewis Corporation
March 11, 2026
•[ leak, financial, manufacturing ]
Interlock claimed responsibility for compromising Elliott-Lewis Corporation on March 11, 2026 and described a large database containing confidential contracts, project files, and customer and employee data, with approximately 1.07 terabytes allegedly stolen. DataBreach.com later indexed 319,305 structured rows containing personal identifiers and bank-account information. The explicit database claim and structured records support classification as Exploitation of Application Server, although the initial access vector was not disclosed. Elliott-Lewis is a Philadelphia-based mechanical contractor. The company has not publicly confirmed the attribution, claimed volume, encryption, or operational disruption.
Speed Group
March 19, 2026
•[ ransomware, manufacturing, hack ]
Forensic investigators found that unauthorized operators transferred files from a Speed Group server by March 19, 2026, then moved through the multinational manufacturers network using privileged credentials. On March 29 at about 19:59 the operators deployed ransomware that encrypted corporate servers and backups in France and the United States and a network storage device at the Chilean subsidiary in Quilicura. The company estimated that approximately 5% of its data was permanently lost. BlackNevas/Trial Recovery was attributed through forensic indicators and ransom notes and claimed theft of more than 1 TB, but that volume is unverified. The Chilean subsidiary filed a criminal complaint.
ZEGO Textilveredelungszentrum GmbH
March 29, 2026
•[ hack, manufacturing ]
On March 29, 2026, a cyberattack caused a complete production outage at ZEGO Textilveredelungszentrum for nearly six weeks. ZEGO said the resulting economic burden could not be fully offset and made an insolvency filing necessary. The filing did not end the business: the provisional insolvency administrator authorized continued operations, and ZEGO continued accepting and fulfilling orders while pursuing restructuring. No public source identifies the perpetrator or confirms ransomware, extortion, or data theft; the Criminal and Financial classifications are limited contextual inferences rather than confirmed attribution.
Undisclosed Middle Eastern manufacturing company
April 11, 2026
•[ ransomware, manufacturing, technology ]
Kaspersky reconstructed initial VPN access using compromised credentials on April 11, 2026, data theft on April 13 and operational disruption beginning April 14. Attackers deployed malicious Active Directory policies that disabled administrator accounts and displayed ransom demands. Stolen information was subsequently published. No Windows file encryption was confirmed. PAYLOAD identifies the associated ransomware family and malicious policy; the operator was not separately identified. April 11 dates initial access, not the first confirmed data theft. The victim's country and recovery duration were not disclosed.
NTN Bearing Corporation of America
April 24, 2026
•[ ransomware, manufacturing, leak ]
PayoutsKing claimed it compromised NTN Bearing Corporation of America and threatened publication of stolen data. Ransomware tracking places the estimated attack on April 24, 2026 and the public claim on May 13. DataBreach.com later indexed 115,671 leaked rows containing personal and contact information. No independently verified operational disruption has been established.
The Walman Optical Company
April 27, 2026
•[ ransomware, manufacturing, healthcare ]
Medusa publicly claimed Walman Optical on April 27, 2026. DataBreach.com subsequently indexed 690,400 records containing personal and identity information associated with the company. Multiple federal data-security lawsuits were filed against Walman in May 2026 following the incident. Federal contracting and environmental records identify Walman's primary activity as ophthalmic goods manufacturing. No independently verified operational disruption has been established.
Sinomax USA
May 28, 2026
•[ ransomware, manufacturing, retail ]
Qilin listed Sinomax USA on May 28, 2026 and threatened to release confidential data unless the company negotiated. DataBreach.com subsequently indexed 96,279 rows associated with the company. Public reporting did not confirm encryption, system unavailability, or operational disruption; therefore, only the achieved data-theft effect is coded.
EnTrans International LLC
May 28, 2026
•[ ransomware, leak, manufacturing ]
Chaos listed EnTrans International LLC on 28 May, said it had possessed the company's internal data for some time, and threatened publication after a 72-hour deadline. A subsequently published searchable dataset contains personal and vehicle information. EnTrans, which operates as Engineered Transportation International, has not publicly confirmed the incident or disclosed the access method, encryption, or operational impact. No system outage or other operational disruption was identified in public reporting.
At least one PTC Windchill/FlexPLM customer
June 1, 2026
•[ ransomware, technology, finance ]
Ransom-ISAC assesses that Cl0p affiliates likely began exploiting CVE-2026-12569 as a zero-day in early June 2026 against internet-exposed PTC Windchill and FlexPLM systems. Attackers deployed custom JSP webshells capable of credential theft and large-scale data exfiltration. Extortion emails were observed beginning July 20, and Cl0p later named more than 40 alleged victims, including Shell, Philips, Fiserv, Zebra Technologies, Mindray, and others. Victim-specific stolen-data volumes ranged from about 1 GB to several terabytes according to Cl0p, although many individual claims remain unconfirmed.
Canopy Brands
June 2, 2026
•[ leak, manufacturing ]
Settra publicly listed canopybrands.us on June 26, 2026 and said it would publish the remaining data after releasing a sample. DataBreach.com indexed 12,130 structured records dated June 2 containing names, email addresses, and phone numbers. Canopy Brands is a Concord, North Carolina-based manufacturer and holding company for safety, access, mobility, and infrastructure-product businesses. No victim statement or independent reporting confirmed the initial access vector, encryption, or operational disruption.
Undisclosed Turkish defense contractor
June 7, 2026
•[ espionage, hack, government ]
Beginning on or after June 7, 2026, unidentified operators associated with the FortiBleed campaign used a captured FortiGate VPN session cookie to enter an undisclosed Turkish defense contractor's internal network and access two SMB file shares with an administrator account. They exfiltrated more than 12,000 files totaling 105 GB, including sensitive military documentation, technical files, field imagery, diagnostic records, and employee identification documents.
Mackay Sugar Limited
June 10, 2026
•[ hack, manufacturing, technology ]
Mackay Sugar detected unauthorized external access on June 10, 2026, and shut down affected enterprise and logistics systems while investigating. The incident suspended harvesting, cane haulage, and crushing at the Farleigh and Racecourse mills. Operations resumed in phases beginning June 18, and all three mills were operational by June 26. TheGentlemen claimed responsibility and threatened to publish data, but Mackay Sugar did not publicly attribute the incident to the group or confirm data theft; therefore, the record is coded only for the confirmed operational disruption.
AS Latvijas valsts meži
June 11, 2026
•[ ransomware, financial, technology ]
Intrusion indicators show that the attacker entered AS Latvijas valsts mei systems on 2026-06-11 and remained undetected until malicious activity was identified during the night of 2026-06-22 to 2026-06-23. The attacker exfiltrated company data and deployed ransomware, while LVM disconnected LVM GEO, its map-services system, the Mednis application, and several internal customer- and provider-facing systems. CERT.LV confirmed that 44 GB of stolen data was published, including internal documents, emails, source code, digital certificates, cryptographic keys, and user credentials, and assessed that the attacker likely obtained more data. Timber deliveries were reduced after the attack and returned to full volume on 2026-07-01, although other systems remained under restoration on 2026-07-09. Public threat-monitoring sources identify ByteToBreach as the claimant, but CERT.LV has publicly described the perpetrator only as a foreign financially motivated ransomware actor.
Eastman Kodak Company
June 15, 2026
•[ ransomware, leak, technology ]
ShinyHunters listed Eastman Kodak Company on its extortion site on June 15, 2026, claiming theft of more than 2.2 million customer records and internal corporate data and threatening publication on June 18. Kodak confirmed that an unauthorized third party temporarily accessed a limited amount of company data, stated that the incident was contained, and reported no threat to its systems or operations. Kodak did not confirm the actor's claimed volume or contents.
SLEEMAN BREWERIES LTD.
June 17, 2026
•[ ransomware, hack, retail ]
Sapporo Holdings confirmed unauthorized access to SLEEMAN BREWERIES LTD. on June 17, 2026 and disconnected related systems and equipment. A Canadian liquor-industry association subsequently relayed that Sleeman's network outage was caused by a cybersecurity incident and that sales and delivery were continuing manually. Chaos listed Sleeman on July 14, and monitoring sources reported an alleged 420-gigabyte theft; Sleeman has not confirmed the attribution or data claim. Sleeman separately disclosed a January 26 ransomware incident involving personal information, so the January data categories are not attributed to this June event. Sapporo found no causal relationship with the Pokka intrusion and no impact on its Japanese domestic operations.
Inission Power Oy (including Inission Power Finland Oy)
June 22, 2026
•[ ransomware, technology, manufacturing ]
Inission Power Oy and subsidiary Inission Power Finland Oy disclosed a single ransomware-related compromise of their shared server environment, detected June 22, 2026. The environment was isolated and restored the same day, with normal business operations continuing. Portions of affected databases were later found online. The company did not identify distinct intrusions or separately attributable data theft at each legal entity; successful encryption and attacker-caused operational disruption were not established. The intrusion start and data-acquisition dates remain unknown.
