Heartland Growers
May 28, 2026
•[ ransomware, manufacturing, retail ]
Heartland Growers was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Agriculture and Food Production. Country: United States of America. Website: heartlandgrowers.com. heartlandgrowers.com zoominfo.com/c/heartland-growers/48466328 Heartland Growers is a family-owned wholesale greenhouse in Westfield, Indiana, operated by the Gapinski family since 1984. They supply spring annuals, holiday plants, and hydroponic produce to garden centers, florists, and retailers across the Midwest. Their 30-acre modern facility features advanced automation and a skilled workforce of up to 175 employees. Committed to innovation and quality, they combine decades of expertise with sustainable growing practices
Fonderia Corra
May 28, 2026
•[ ransomware, manufacturing, leak ]
Fonderia Corra was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-28. Sector: Manufacturing. Country: Italy. Website: fonderiacorra.com. fonderiacorra.com zoominfo.com/c/fonderia-corra/371359796 Fonderia Corra is an Italian foundry founded in 1946, specializing in high-precision cast iron components for industrial sectors like railway, energy, and machinery. With over 70 years of expertise, they offer in-house services from design optimization to final finishing, ensuring quality, waste reduction, and ISO 9001 certification. The company operates two plants in Thiene and Montebelluna, producing lamellar and spheroidal graphite cast iron using advanced automation and skilled professionals. Family-led since its founding, Fonderia Corra combines tradition, innovation, and passion to shape metal into core elements for demanding global industries
Techmar
May 26, 2026
•[ ransomware, technology, manufacturing ]
Techmar was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-26. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland. Website: techmar.com. techmar.com https://www.zoominfo.com/c/techmar-inc/37699777 is a Dutch company specializing in 12 Volt outdoor lighting solutions since 2002. Headquartered in Hengelo, Netherlands, it designs, produces, and supplies lighting fixtures globally.Products serve gardens, landscapes, and commercial applications with a focus on quality and innovation.The brand emphasizes in-house development, sustainability, and reliable low-voltage technology
Mayelia Automotive
May 26, 2026
•[ ransomware, manufacturing, automotive ]
Mayelia Automotive was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-05-26. Sector: Manufacturing. Country: Mexico. Website: mayelia.com. mayelia.com zoominfo.com/c/mayelia-automotive/480899337 is an Ivorian automotive company specializing in vehicle technical inspections.Founded in 2019, it operates under Mayelia Participations holding across multiple African sectors.Services include technical checks, stickers, and corporate solutions for drivers and businesses.The company emphasizes customer service, modern equipment, and road safety education
Shanpoornam Metals
May 29, 2026
•[ ransomware, manufacturing ]
Shanpoornam Metals was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Manufacturing. Country: Malaysia. Website: shanpoornammetals.com. Shanpoornam Metals is a metal trading and fabrication company supplying a range of raw and processed metal products to manufacturers and construction firms. They provide custom cutting, processing, and distribution services to meet industrial.
Interstate Roofing
May 29, 2026
•[ ransomware, manufacturing ]
Interstate Roofing was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Manufacturing. Country: United States of America. Interstate Roofing brings its customers the best in quality and service. Since 1988, Interstate
has established itself as one of the largest and most trusted exterior-improvement companies i
n the Northwest.
We will upload 16gb of corporate data soon. Employee personal docs (scanned passports and LDs,
60 SSNs and so on), contracts and agreements, clients info, projects, etc.
*M**
May 29, 2026
•[ ransomware, healthcare, manufacturing ]
*M** was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-29. Country: United States of America. Website: .. A healthcare organization
Henry Molded Products Likely to Engage tag.
May 29, 2026
•[ ransomware, manufacturing, government ]
Henry Molded Products Likely to Engage tag. was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Manufacturing. Country: United States of America. Website: henry-molded.com. Henry Molded Products specializes in the manufacturing of custom molded pulp fiber products and packaging solutions. The company is recognized for its eco-friendly offerings, which are biodegradable, compostable, and recyclable, catering to a growing demand for sustainable packaging. Their products are designed for various clients, including government, industry, and environmentally conscious consumers. Henry Molded Products is committed to providing cost-effective solutions while leading in technology, design, and engineering in the molded fiber sector.
www.labexpress.com
May 29, 2026
•[ ransomware, brute-force, healthcare ]
www.labexpress.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Professional Services. Country: United States of America. Website: www.labexpress.com. LABEXPRESS & GARONIT PHARMA: 200 GB OF SHARED INFRASTRUCTURE
We have obtained 200 GB of internal data from a US-based group operating under two legal entities: Labexpress and Garonit Pharma. The materials show a single Active Directory domain (LABEXPRESS1.local), a shared file server, and extensive crosscompany records. This data will be made publicly available in the near future.
Active Directory Overview
- 65 computers, 142 user accounts, 98 groups, 11 organizational units (OUs).
- Domain controllers: DC01 (Server 2019), LABXDC01 (Server 2012 R2).
- A single AD domain serves both Labexpress and Garonit Pharma.
Notable account:
cn: Troy Austin
sAMAccountName: Taustin
memberOf: QuickBooks, LABEXPRESS, LABEXPRESSUSERS
The same person appears in Exchange mailboxes as taustin@garonitpharma.com.
Weak Passwords and BruteForce Indicators
- Administrator account: 3,193 failed logon attempts, last successful logon 2026-04-30.
- Computer accounts FRONTDESK$, DEV$, LABEL$ more than 3,000 failures each.
- Cleartext password found on FILE01\passwords.txt:
Admin: LabExpress2024!
- The Domain Admins group includes: Administrator, labadmin, adminiss, Protect, xtratech, LAE009-CT.
- Password for user Protect: Password123!
- Outdated password templates in the SBSUsers OU are still in use.
Mail Servers and Exchange
- LABSERVER2 runs Windows Server 2003 SP2 with Exchange 2007.
- Full mailbox export performed using the builtin Export-Mailbox cmdlet no special exploit required.
Contents of the Obtained Data (200 GB)
We have data from drive E:\, including:
1. Financial & Accounting
- QuickBooks Enterprise 2021 installer and data files (QB2021.DSN, QB2021.ND).
- Folder: E:\Garonit Documents\Clients 2022\ hundreds of invoices, COAs, and COCs (e.g., Amtrade International INV# 50268.pdf for ~21M USD, Estee Lauder Inv# 24.pdf).
- Folder: E:\Garonit Documents\ACCOUNTS PAYABLES 2022 09 22\ detailed accounts payable records for 50+ vendors.
2. Quality & Production
- Thousands of COA/COC files (e.g., CHG 20% Lot 429012 CoA.pdf, COC CHG 20%, Lot# 705103.docx).
- Complete batch records for 20232026 (folders Batch Records\2023, 2024, 2025, 2026).
- Stability study protocols and raw HPLC data for CHG 0.12% Oral Rinse.
3. ANDA & Regulatory Documentation
- Folder 00 Oral Rinse ANDA-Old One complete ANDA dossier, including DMF, method validation, stability, and correspondence with the FDA.
- Files: ANDA Checklist-Oral Rinse.docx, DMF Assessment in advance.pdf.
4. Vendor & Customer Records
- Folder: E:\Garonit Documents\Vendor from 2022 07 19 TO 2022 09 21\Vendor\ dossiers on each supplier (contracts, invoices, assessments).
- Folder: E:\LABEXPRESSDATA\ALL LEI ORDERS\ customer purchase orders and sales quotations.
5. Human Resources (HR)
- Folder: E:\LABEXPRESSDATA\HUMAN RESOURCES\ employment contracts, W9 forms, tax deductions, resignation letters.
- Passport scans, Green Card copies, health insurance records for many employees.
- Files: Employee Handbook.pdf, PTO Request Form.docx, Time off request form.pdf.
6. Internal Communications & Scans
- Directory C224E BIZHUB SCANNER DUMPS containing subfolders named after employees (Burcu, Frank, Iliany, Kelvin, Dave, Randy, Sudhir, etc.).
- Scans include: Green Cards, IDs, credit card authorization forms, bank letters, and correspondence with the IRS.
- Examples: Burcu Green Card.pdf, Rohit Garg X-Ray.pdf, SKM_C250i... (thousands of scanned documents).
7. Tax & Banking Documentation
- Correspondence with the IRS, State of New Jersey, Valley National Bank, Citibank.
- Files: IRS Notice Lab Express.pdf, Valley Bank Garonit Deceember 2020.pdf, Credit Application, Bank instructions.pdf.
Shared Infrastructure Observed Facts
- The same Active Directory domain and file server (drive E:\) store data for both Labexpress and Garonit Pharma.
- Crosscompany records reside in the same folders (e.g., Garonit Documents and LABEXPRESSDATA coexist on the same drive).
- User Troy Austin has an AD account (Taustin) and also uses the email address taustin@garonitpharma.com.
- Purchase orders, invoices, COA/COC files refer to both companies interchangeably.
- At the IT level, there is no separation between the two legal entities.
The obtained data demonstrates that Labexpress and Garonit Pharma operate on a single, shared IT infrastructure. All files, accounts, mailboxes, and production records are stored on the same systems. A 200 GB archive will be publicly released in the near future.
ecci-srl.com
May 30, 2026
•[ ransomware, manufacturing, retail ]
ecci-srl.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: Italy. Website: ecci-srl.com. Empresa dedicada al rubro de construccin de proyectos inmobiliarios, particularmente la Ciudad Nueva Santa Cruz. El ...
SIRILAK SEAFOOD (PW) LTD.
May 29, 2026
•[ ransomware, manufacturing ]
SIRILAK SEAFOOD (PW) LTD. was listed as a victim on the leak site of the titan ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Agriculture and Food Production. Country: Sri Lanka.
BC3 Tecnologia
May 30, 2026
•[ ransomware, technology, manufacturing ]
BC3 Tecnologia was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Technology. Country: Brazil. Website: bc3tech.com. BC3.com.br is the website for BC3 Tecnologia, a Brazilian company that develops and sells ERP (Enterprise Resource Planning) software specifically for the corrugated packaging and cartonage industry. Their flagship product is the ERP KRP- Nova Provide tree and samples from stolen data, free 2 files decrypt to the company when its get in touch with support department.
LTI Services and Larick Towing
May 30, 2026
•[ ransomware, leak, automotive ]
LTI Services and Larick Towing was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Transportation. Country: United States of America. Website: ltiservices.com. ltiservices.com - laricktowing.com - LTI Services is a leading customization and accessory shop specializing in customizations, repairs, and aftermarket parts for the heavy-duty trucking industry. They work with major truck brands such as Peterbilt, Kenworth, Volvo, International, Freightliner, and Western Star, offering a wide range of services including collision repair, custom fabrication, and electrical repairs. The company prides itself on providing quality parts and accessories while collaborating closely with customers to bring their design visions to life. With a focus on transparency and comprehensive service, LTI Services ensures that clients are informed and confident throughout the project process -
Larick Towing Inc. is a family-owned and operated business that has been providing vehicle transportation services since 1978. They offer nationwide vehicle transportation, including pick-up and delivery services for transporters, as well as transport to all ship ports and terminals. Their services cater to both individual clients and auto dealers, facilitating vehicle transport to and from auctions and dealer swaps. The company is known for its customer-focused approach and commitment to quality service - Nova provide free decrypt 2 files as proof, we will leak only DBs, not source code because company may recover from leak) 11 days available to reach us or no recover possible, both sites seized.
Indiana Mills and Manufacturing
May 29, 2026
•[ ransomware, manufacturing ]
Indiana Mills and Manufacturing was listed as a victim on the leak site of the termite ransomware group; the attack is estimated to have taken place on 2026-05-29. Sector: Manufacturing. Country: United States of America. Website: www.imminet.com. You have 24 hours to contact us.
Siveco -
May 30, 2026
•[ ransomware, technology, manufacturing ]
Siveco - was listed as a victim on the leak site of the coinbasecartel ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Technology. Country: France. Website: siveco.com. [AI generated] Siveco is a French software company specializing in computerized maintenance management systems (CMMS) and enterprise asset management (EAM) solutions. Founded in France, the company operates internationally, offering software and services to help organizations manage industrial maintenance, infrastructure, and assets. Its clients span sectors such as energy, transportation, manufacturing, and public utilities across Europe, Africa, and Asia.
Wentworth
May 30, 2026
•[ ransomware, manufacturing ]
Wentworth was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-05-30. Sector: Professional Services. Country: United States of America. Website: wentworthstudio.com. the DC Metro area's premier design-build firm
Grupo Mauá
May 31, 2026
•[ ransomware, manufacturing, energy ]
Grupo Mau was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-05-31. Sector: Manufacturing. Country: Brazil. Website: www.grupomaua.com.br. Operates in the construction, real estate, energy, and infrastructure sectors.
Swagelok
April 1, 2026
•[ ransomware, manufacturing, leak ]
Swagelok was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-04-01. Sector: Manufacturing. Country: United States of America. Website: swagelok.com. Swagelok is a worldwide leader in industrial fluid system manufac
turing and support. Since the introduction of the revolutionary,
leak-tight Swagelok tube fitting in 1947, they have applied a pa
ssion for making high-quality products and an unwavering focus on
meeting customer needs to help a wide range of industries safely
, efficiently, and reliably move liquids and gases in demanding a
pplications.
We will upload 90gb of corporate data soon. Employee passports, a
nd other personal information, detailed client information (finan
cials, agreements with Nikon, Kawasaki, Mitsubishi and others), p
rojects, HR files, etc.
Builtrite
December 1, 2025
•[ ransomware, manufacturing, leak ]
Builtrite was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-12-01. Sector: Manufacturing. Country: United States of America. Website: builtrite.com. Northshore Manufacturing offers 3 main product lines that are mar
keted under the Builtrite Brand. The company also produce compone
nts for several O.E.M.'s and tackle custom projects within the co
mpany's realm of expertise.
We will upload 40gb of corporate data soon. Detailed employee pas
sports, DLs (13 persons), SSNs and other personal information, fi
nancials, violations, police records, NDA, etc.
Elara Engineering
April 1, 2026
•[ ransomware, technology, manufacturing ]
Elara Engineering was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-04-01. Sector: Manufacturing. Country: United States of America. Website: elaraeng.com. Elara Engineering is a full-service Mechanical, Electrical, Plumbing, Fire Protection, and Technology consulting engineering firm based in Chicago, Illinois. With 25 years of experience, the company specializes in the design, costing, delivery, and oversight of building and utility systems, offering both pre-design and post-construction services. Their clients include educational institutions, municipal entities, and residential developers, focusing on sustainable and innovative engineering solutions. Elara Engineering is committed to reducing energy consumption and carbon footprints through its projects and embraces diversity within its workforce
