Construction Sciences
April 28, 2026
•[ ransomware, manufacturing ]
Construction Sciences was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-28. Sector: Manufacturing. Country: United States of America. Website: www.constructionsciences.net.
boxtopia.co.uk
April 29, 2026
•[ ransomware, retail, manufacturing ]
boxtopia.co.uk was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: boxtopia.co.uk. +44 1476576090 . Boxtopia is the UK's leading supplier of custom cardboard boxes and printed boxes, specializing in short runs for small businesses with no minimum order. Stolen: 166gb 280k files
rotak.it
April 29, 2026
•[ ransomware, technology, healthcare ]
rotak.it was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Technology. Country: Italy. Website: rotak.it. Rotak (specifically in the context of Rotak Instruments) focuses on the distribution of specialized medical and analytical instrumentation, with related entities in industrial engineering and automation Stolen: 22.5gb 20k files
pricon.com.ph
April 17, 2026
•[ ransomware, manufacturing, technology ]
pricon.com.ph was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-04-17. Sector: Professional Services. Country: Philippines. Website: pricon.com.ph. Pricon Microelectronics, Inc. (PMI) is an Original Equipment Manufacturer (OEM) and a subsidiary of...
Costa Solutions, LLC
April 29, 2026
•[ ransomware, financial, technology ]
Costa Solutions, LLC was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: United States of America. Website: costasolutions.com. [warehouse] Costa Solutions, LLC a privately held managed-labor and warehousing company headquartered in San Antonio, Texas, with ~$140M annual revenue and 2001,000 employees.
The file server contained the complete operational, financial, legal, and human resources infrastructure of the company:
3,0008,000+ individuals' personal data current employees, former employees (12 years of records), independent contractors, employee dependents, and job applicants. SSNs on W-2s, W-4s, 1099s, I-9s, background checks. Bank account and routing numbers on 200+ direct deposit forms.
Medical and injury records 150+ employee injury/medical files from 20132026, FMLA medical certifications, drug test results (random, reasonable suspicion, post-incident, promotional), and workers' compensation claims for 23+ named individuals.
CEO's entire file system Josh Wean's Documents folder (5.3 GB) including P&L statements, a 17-subfolder "Confidential" directory, legal correspondence, strategic plans, a C-12 peer advisory group archive, and a $RECYCLE.BIN with 60+ deleted items.
Client contracts and competitive intelligence pricing, SLAs, and contract terms for HEB, CVS, Sysco, Amazon, McLane, Labatt, Valvoline. Competitor pricing intelligence. RFP bid documents with cost models.
Active legal case files litigation records (20212022), HR internal investigation notes (20182021), arbitration files, active investigations marked "DO NOT DELETE" all subject to attorney-client privilege.
Infrastructure secrets an HEB production server TLS certificate, a Cisco AnyConnect VPN installer, and the CEO's Remote Desktop connection file.
Corporate financials multi-year budgets, valuation & sale documents (indicating possible M&A activity), PPP loan forgiveness records, Form 5500 ERISA filings, and annual reporting.
Atlas Metal Industries Inc
April 29, 2026
•[ ransomware, leak, manufacturing ]
Atlas Metal Industries Inc was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: Canada. Website: atlasfoodserv.com. [food, metal] Atlas Metal Industries Inc. a privately held commercial-foodservice-equipment manufacturer headquartered in Miami, Florida.
The dataset is a complete Microsoft Dynamics GP environment: production databases, payroll records, system credentials, Autodesk Vault product-design backups, CNC fabrication programs, and all supporting infrastructure configuration. The exfiltration occurred on or about April 8, 2026; the attack was identified April 22, 2026.
The exposed material includes:
15.8 GB of payroll-records database (PYREC) full Employee Master with SSNs, DOBs, addresses, direct-deposit bank routing numbers, salary, W-4 tax data, garnishments, and check history dating to at least 2018.
30+ SQL Server login accounts with password hashes in a sp_help_revlogin dump named employees, system admins (DYNSA, sa), service accounts, and Active Directory domain accounts.
74 GB of Autodesk Vault Professional backup complete product-design history from 2019 through 2026, covering every product line Atlas Metal manufactures.
Hundreds of CNC fabrication programs laser-cutter and Amada punch-press G-code for the full catalogue of sheet-metal components.
A base64-encoded SQL credential for the TimeClock Plus timekeeping system, stored in plaintext XML.
8 SQL Server databases with full backup chains ATLAS (primary), PYREC (payroll), DYNAMICS (system), TEST (18 GB dev clone), TWO, AMIT, plus system databases (master, msdb, DynamicsGPSecurity).
Probity Contracting Group
April 29, 2026
•[ ransomware, manufacturing ]
Probity Contracting Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Professional Services. Country: Australia. Website: www.probitycg.com.
Iowa Spring Manufacturing & Sales
April 29, 2026
•[ ransomware, leak, manufacturing ]
Iowa Spring Manufacturing & Sales was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-04-29. Sector: Manufacturing. Country: United States of America. Website: iowaspring.com. Iowa Spring
is a well-established manufacturer specializing in a variety of springs, including those for overhead garage doors, mechanical applications, and agricultural equipment. Founded in 1977 and based in Adel, Iowa, the company has built a strong reputation for quality and reliability in the spring manufacturing industry.
2112 Greene Street
P.O. Box 130
Adel, IA 50003, US
www.iowaspring.com
Leaked data: 49,4Gb
Accounting, product development and testing, laboratory defect analysis, supply logistics, contracts, NDA, financial indicators, corporate information, and much more
Lc Industries
February 19, 2026
•[ ransomware, manufacturing, government ]
Lc Industries was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-02-19. Sector: Manufacturing. Country: United States of America. Website: lcindustries.com. [AI generated] LC Industries is a nonprofit organization based in the United States that provides employment and training opportunities for people who are blind or visually impaired. Operating primarily in North Carolina, it manufactures and supplies a range of products including military and government goods, fulfilling contracts through the AbilityOne Program, which connects nonprofit agencies with federal procurement opportunities.
Florida East Coast Railway
March 2, 2026
•[ ransomware, manufacturing ]
Florida East Coast Railway was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-03-02. Sector: Transportation. Country: United States of America. Website: fecrwy.com. [AI generated] Florida East Coast Railway is a regional freight railroad operating in the United States, primarily serving the state of Florida. Founded in the 1890s by Henry Flagler, it runs approximately 351 miles of track along Florida's eastern corridor from Jacksonville to Miami. The company transports intermodal containers, vehicles, and various commodities, playing a key role in Florida's freight logistics and supply chain infrastructure.
Powell Electronics
February 26, 2026
•[ ransomware, manufacturing, technology ]
Powell Electronics was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-02-26. Sector: Manufacturing. Country: United States of America. Website: powell.com. [AI generated] Powell Electronics is a US-based authorized distributor of electronic components and assemblies. Founded in 1946 and headquartered in Camp Hill, Pennsylvania, the company serves aerospace, defense, industrial, and commercial markets. It supplies connectors, cables, electromechanical components, and custom assemblies from leading manufacturers, offering supply chain solutions, engineering support, and value-added services to customers across North America.
Sofinter S.p.a
February 24, 2026
•[ ransomware, manufacturing, energy ]
Sofinter S.p.a was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-02-24. Sector: Professional Services. Country: Italy. Website: sofinter.it. [AI generated] Sofinter S.p.A. is an Italian industrial company specializing in the design and manufacturing of heat recovery systems, boilers, and thermal energy equipment. Operating in the energy and power generation sector, it serves industries including oil and gas, petrochemical, and power plants. Headquartered in Italy, Sofinter provides engineering solutions focused on steam generation and waste heat recovery, supporting both domestic and international markets.
Maderas del Alto Urgel
January 14, 2026
•[ ransomware, manufacturing ]
Maderas del Alto Urgel was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-01-14. Sector: Manufacturing. Country: Spain. Website: mausa.es.
Ash & Lacy Holdings
January 14, 2026
•[ ransomware, manufacturing ]
Ash & Lacy Holdings was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-01-14. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: ashandlacy.com. [AI generated] Ash & Lacy Holdings is a UK-based manufacturing company specialising in building envelope products and construction systems. It produces metal framing, rainscreen cladding, and roofing solutions primarily for the construction industry. Operating from the West Midlands, England, the company serves commercial and residential sectors, supplying architects, contractors, and specifiers with structural and aesthetic building components.
Aero-Coating
January 14, 2026
•[ ransomware, manufacturing ]
Aero-Coating was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-01-14. Sector: Manufacturing. Country: Germany. Website: aero-coating.de.
V. FRAAS
January 14, 2026
•[ ransomware, retail, manufacturing ]
V. FRAAS was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-01-14. Sector: Retail & E-Commerce. Country: Germany. Website: vfraas.com. [AI generated] V. Fraas is a German textile manufacturer specializing in scarves, shawls, blankets, and accessories. Founded in 1880 and headquartered in Helmbrechts, Bavaria, Germany, the company is known for producing high-quality woven and knitted textiles. It operates in the fashion and home textile industry, serving both retail and wholesale markets globally. V. Fraas is recognized for its craftsmanship and broad range of seasonal accessories.
Caunton Engineering
January 14, 2026
•[ ransomware, manufacturing ]
Caunton Engineering was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-01-14. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Website: caunton.co.uk. [AI generated] Caunton Engineering is a UK-based structural steelwork contractor and fabricator headquartered in Nottinghamshire, England. The company specialises in the design, fabrication, and erection of structural steelwork for commercial, industrial, and infrastructure projects. Operating within the construction and engineering sector, Caunton serves clients across the United Kingdom and has built a reputation for delivering large-scale steel frame structures.
Abazia SpA
April 16, 2026
•[ ransomware, manufacturing ]
Abazia SpA was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-16. Sector: Manufacturing. Country: Italy. Website: www.abazia.com.
ATF Aerospace
April 30, 2026
•[ ransomware, leak, manufacturing ]
ATF Aerospace was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-04-30. Sector: Manufacturing. Country: United States of America. ATF Aerospace specializes in aerospace manufacturing and distribution, offering high-quality me
chanical and electrical components sourced from leading manufacturers. Their manufacturing capa
bilities focus on CNC milling and lathe operations, emphasizing short runs and quick turnaround
projects.
We will upload 45gb of corporate data soon. Detailed employee personal documents (passports, SS
Ns, DLs and so on), client information (BOEING files again and other confidential projects and
specification), contracts and agreements, insurance files, NDAs, etc.
Jayeff Construction
April 30, 2026
•[ ransomware, manufacturing ]
Jayeff Construction was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-04-30. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.jayeff.com.