KTU Shipyard
October 30, 2026
•[ ransomware, manufacturing ]
KTU Shipyard was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Transportation. Country: Philippines. Company: PT Karya Teknik Utama (KTU Shipyard)
Location: Batam, Indonesia
Founded: 1982
Industry: Shipbuilding & Marine Engineering
Website: https://ktushipyard.com/
What the company does
KTU Shipyard is an Indonesian shipbuilding company specializing in the construction, repair and maintenance of commercial vessels.
Its main products and services include:
- Tugboats
- Barges
- Tankers and cargo vessels
- Crane barges
- Ship repair and maintenance
Company size
- Privately owned company.
- Approximately 5011,000 employees.
- Multiple shipyard facilities in Indonesia.
- Claims to have built approximately 2,200 vessels.
Annual Revenue
~USD 200 million
Key Business Information
- Business model: B2B shipbuilding and marine services.
- Customers: Shipping companies, marine logistics operators and offshore businesses.
- Main market: Indonesia and regional maritime markets.
- Competitive advantage: Established shipbuilding experience, multiple facilities and diverse vessel manufacturing capabilities.
What was accessed: Internal ticketing systems, All users drive (including business, customer, confidential files over 3tb of data), customer data, etc. You have 20 days to reach out or let it be your downfall.
Attatched: Is a sample file from recent user drives, and a screenshot showing POA (proof of access)
We can be very reasonable and this can go well or it can not. You can start contact at the email: whitearmormember@proton.me
https://gofile.io/d/G981x5Rl
https://gofile.io/d/99sTtibR
(backup sample files)
Angeles Contractor
October 28, 2026
•[ ransomware, manufacturing, government ]
Angeles Contractor was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: Mexico. Website: angelescontractor.com. angelescontractor.com Angeles Contractor Inc is a general contractor founded in 1998 in City of Industry, California, with 8 CSLB license categories and 63 to 95 employees delivering construction projects across Southern California. It has completed 259 public works projects worth over 197 million dollars for 47 government agencies, led by San Bernardino County with 73 contracts. Its portfolio includes the Rose Bowl renovation, UCLA dining hall, CGV Cinemas, Paakuma K-8 School and a 14.5 million dollar Big Bear Airport terminal rebuild. Led by President Young W. Kang and VP Alex Cho, it maintains over 90 percent repeat business across education, healthcare, commercial and residential sectors. It holds multiple JOC contracts with San Bernardino, San Mateo and Sourcewell worth up to 30 million dollars per year. The company is a certified Minority Business Enterprise with active expansion into Northern California through offices in San Jose and Salinas.
Pure Perfection
October 26, 2026
•[ ransomware, retail, automotive ]
Pure Perfection was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: United States of America. Website: pureperfection.com. pureperfection.com Pure Perfection GmbH is a German live communication agency founded in 2008 in Wiesbaden, ranked number one in the 2026 BlachReport German Event Creativity Ranking ahead of insglck and Vok Dams. With 72 to 80 employees across offices in Wiesbaden, Berlin, Dsseldorf and Florida, it delivered 133 events in 2025, with 90 of them abroad including Shanghai, Miami and Singapore. Led by co-founders Jan Rogozinski and Kim Meisinger, the agency works through three units: Pure Live for events, Pure Space for brand spaces and architecture, and Pure Content for storytelling and PR. Major clients include Audi, KODA, L'Oral, Bentley and Nestl, with pharma being its largest vertical at 90 events per year. Revenue peaked at 26.4 million euro in 2023 and the agency won 60 MUSE Creative Awards in 2026 alone.
Incomelec
October 26, 2026
•[ ransomware, manufacturing, technology ]
Incomelec was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Colombia. Website: incomelec.com. incomelec.com Incomelec is a Colombian company founded in 2006 in Bogota, the Latin American leader in pedestrian, vehicle and passenger access control including turnstiles and automated barriers. With 52 employees and operations in 14 countries, it has installed equipment in over 20 airports, 90 parking facilities and 250 buildings, handling more than 85 percent of Colombia's toll booth systems. Its flagship product is BIOMIG, an automated migration control system used at El Dorado and Medellin airports with iris scanning and passport verification. It is the exclusive regional partner of Automatic Systems from the Bollore Group and the only distributor worldwide that locally assembles TR-490 and TR-491 turnstile lines. Led by CEO Kris De Sutter Gomez, it serves Metro de Medellin, TransMilenio and BD Bacata, Colombia's tallest building.
ASL İnsaat
October 26, 2026
•[ ransomware, manufacturing ]
ASL nsaat was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Turkey. Website: aslinsaat.com.tr. aslinsaat.com.tr ASL nsaat is a Turkish construction company based in Istanbul, operating in civil and industrial building contracting both domestically and internationally. It provides full-cycle services including design, general contracting and project management for residential, commercial and industrial projects. The company is privately held with estimated staffing of several hundred employees scaling with active construction sites. Turkey is the world's second largest market for international construction contractors, and ASL operates within this competitive ecosystem. Key sectors are residential complexes, shopping centers, hotels, factories and infrastructure. Typical strengths of Turkish contractors like ASL are cost competitiveness, speed of delivery and experience in challenging geographies across the Middle East, Africa and Central Asia.
Rood Trucking
October 31, 2026
•[ ransomware, manufacturing ]
Rood Trucking was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Transportation. Country: United States of America. Established in 1962 by George and Diane Rood Sr., the company developed from a single-truck operation into a regional carrier
mars-semi.com.tw
October 31, 2026
•[ ransomware, manufacturing, technology ]
mars-semi.com.tw was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Manufacturing. Country: Taiwan. Website: mars-semi.com.tw. Established in 2001 and headquartered in Hsinchu Science Park, the company develops long-range, high-bandwidth wireless audio and video system-on-chip (SoC)
Tailormade Logistics
October 27, 2026
•[ ransomware, manufacturing ]
Tailormade Logistics was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Transportation. Country: Denmark. Website: www.tailormade-logistics.com. Belgium
TWICE SRL
October 27, 2026
•[ ransomware, manufacturing, finance ]
TWICE SRL was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-27. ompany from the Republic of San Marino,
associated with the production and sale of fashion clothing and accessories.
Archived personal and corporate data of employees and customers. [Sector: Manufacturing, Finance]
Marbre Design
October 28, 2026
•[ ransomware, manufacturing ]
Marbre Design was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: France. Marbre Design is a French company specializing in the processing of natural stone, marble, granite, and composite materials. The enterprise custom-manufactures kitchen countertops, bathroom fixtures, fireplace surrounds, and interior architectural elements. Its core operations focus on precision cutting, slab polishing, and the on-site installation of finished products.
CP Manufacturing, Inc.
October 30, 2026
•[ ransomware, manufacturing, financial ]
CP Manufacturing, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Website: CP Manufacturing, Inc.. [manufacturer] CP Manufacturing, Inc. a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems) operating since the 1970s under
the CP Group / CPG Sorting Technologies brand, with subsidiaries MSS Inc. (Nashville, TN), IMS Electronics Recycling, IMS Logistics, IMS Recycling Services,
Material Sales, HMM, and UK partner Recycleye.
The dataset includes complete server mirrors from HR, finance, engineering, legal, operations, and sales infrastructure, capturing the company's entire digital
footprint:
Sage/Epicor ERP accounting system for 8 entities (CPM, MSS, HMM, IMSR, IMSRE, MSIRE, CPGH, CP Global) with consolidated P&L showing $109.1M revenue, $10.2M net
income, and $12.1M EBITDA for FY2024, plus multi-year budgets (20212024), daily cash reports, and AR/AP data
~340 Social Security Numbers with full identity packages (name, DOB, health coverage status, premium amounts, tax withholdings) across 4 entities via ACA 1095-C
filings (20162022), biweekly payroll registers, 401(k) participant records, 10-year salary histories (20132023), and benefits administration across 5 carriers
(Anthem, Blue Shield, SIMNSA, UNUM, Western Dental)
Truist bank account details routing number 053101121 and account number 1180009812409 for CP Manufacturing LLC, plus ACH payment batch files spanning August 2025
through August 2026
277+ GB of proprietary engineering IP 22G of AutoCAD Electrical MRF designs with proprietary component catalogs (1.2G), 195G of Artec 3D scanner data for
manufactured equipment, 38G of CNC laser fabrication data (Amada LCG3015 AJ / FabriWin), PCB board designs (5 boards), SolidWorks Electrical templates, and Epicor
ERP Bill of Materials with proprietary part numbers
60+ customer contracts and 30+ NDAs with Republic Services, Waste Management, Recycleye/Nestl, Cal-Waste, Balcones, Wasatch, and international partners, plus
Declaration Partners acquisition due diligence documents, competitor proposals (BHS, Machinex, MISTRAL), and a complete project green list
Privileged legal materials active litigation subpoena (Hans Ouellet), Coastal Resources MWS settlement agreement with UCC1 financing statements,
separation/termination documents for named employees, restrictive covenant cease-and-desist letters, PIIAAs (invention assignment agreements), wage garnishment
orders, and corporate equity documents
200+ named job applicant resumes, 51 employee headshot photographs, 400+ vendor records with Tax IDs (including 3+ individual contractors with potential SSNs), and
a 7.8G Microsoft SQL Server backup (IMSROM) of undetermined contents
EAS Engineering
October 30, 2026
•[ ransomware, manufacturing ]
EAS Engineering was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Website: eas-eng.com. Specializes in navigating wetland regulations for landowners, developers, and their legal representatives at local, state, and federal levels.
Svedala Kommun
October 28, 2026
•[ ransomware, government, manufacturing ]
Svedala Kommun was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Government & Defense. Country: Sweden. Website: svedala.se. svedala.se Revenue $282.1 Million Svedala kommun is a municipality in Skne County, Sweden, part of Greater Malm with 23,722 residents and a projected growth to 26,800 by 2032. It jumped from 63rd to 15th place in Sweden's Bst att leva 2026 ranking, ranking number one nationwide in business climate, self-sufficiency and outbound commuting. The local economy centers on transport and warehousing driven by Malm Airport, with Sandvik SRP as the largest private employer and a new Airport City MMX business park planned to create 1,000 jobs. The municipality runs a balanced budget of SEK 1.66 billion with a tax rate below the national average. Education performs above average with 89.8 percent gymnasium eligibility and 80.3 percent qualified teachers. It is investing 431 million kronor in infrastructure 2025 to 2027.
Malmsten
October 26, 2026
•[ ransomware, manufacturing ]
Malmsten was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Sweden. Website: malmsten.com. malmsten.com Malmsten AB is a Swedish family-owned company founded in 1975 in Tby, the world's leading manufacturer of swimming pool and open water equipment including lane lines, buoys, starting blocks and safety gear. With around 30 employees and global distribution, its equipment has been used at 11 consecutive Olympic Games from Moscow 1980 to Paris 2024. Founder Robert Malmsten received the FINA Gold Pin Award in 2024 for 48 years of service to the international swimming federation's equipment committee. The company's proprietary wave calming technology reduces turbulence in competition lanes, making its Golden Series the gold standard for elite swimming events. Led by CEO David Malmsten in the second generation, it operates a subsidiary in Australia and serves 100 plus national swimming federations worldwide. Key strengths are FINA approval, Olympic heritage and a full product range from elite competition to public pool equipment.
Farmacias 911
October 26, 2026
•[ ransomware, healthcare, manufacturing ]
Farmacias 911 was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Healthcare. Country: Ecuador. Website: farmacias911.com.ec. farmacias911.com.ec Gettareq S.A., known as Farmacias 911, is a major Ecuadorian pharmaceutical company founded in 2013 in Guayaquil, combining retail pharmacy, wholesale distribution, OEM manufacturing and medical consulting across the whole country. The group operates six brands including Farmacias 911 retail, ACOSAR wholesale distribution, Galenic for private label manufacturing, One Laboratory for quality testing and Conseplus for consulting. It has grown from 11 to 500 employees with a 166 percent increase in headcount, working with global pharmaceutical giants like Abbott, Bayer, Bristol Myers Squibb, Takeda and Roche. Led by founder and CEO Marlon Morillo, the company hosted Ecuador's largest pharmaceutical convention in 2025 alongside APESFA. Its vertical integration from import and production to retail and lab testing is unique in the Ecuadorian market.
tum.com.mx
September 1, 2026
•[ ransomware, manufacturing, retail ]
tum.com.mx was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Education. Country: Mexico. Website: tum.com.mx. TUM Transportistas Unidos Mexicanos Divisin Norte, S.A. de C.V. is the largest trucking company in Mexico, founded in ...
VPC Builders
October 27, 2026
•[ ransomware, manufacturing ]
VPC Builders was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Country: United States of America. Website: www.vpcbuilders.com. United States
Meleghy Automotive & Cie. GmbH
October 28, 2026
•[ ransomware, manufacturing, automotive ]
Meleghy Automotive & Cie. GmbH was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: Germany. Website: Meleghy Automotive & Cie. GmbH. [automotive] The exposed material includes:
Passport/visa/student-admission dossiers
Tesla Model Y/Opal tooling, CAD and DFM tree
Employee contract and HR folders
MEB/BMW NCAR metrology and plant-layout trees
PLC/SPS/robot backups and cross-reference DBs
TISAX/IATF audit and corrective-action records
Restricted management meeting/WLAN record
Browser profile SQLite databases
Noelker and Hull
October 28, 2026
•[ ransomware, financial, healthcare ]
Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
MAA Group Consulting Engineers
October 29, 2026
•[ ransomware, technology, manufacturing ]
MAA Group Consulting Engineers was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975, with over 1,000 professionals operating across East and Southeast Asia. The group provides comprehensive integrated solutionsranging from conceptual planning and engineering design to project managementacross infrastructure, buildings, land resources, environment, and information technology. Renowned for its industry-leading expertise in Building Information Modeling (BIM), MAA Group has successfully completed major high-speed rail, mass rapid transit (MRT), and tunnel projects throughout Taipei, Hong Kong, Bangkok, and Singapore.
The client data and internal documents youve leaked go well beyond what youve seen here. We have taken several terabytes of filesthis is just a small sample. In fact, we have obtained sensitive documents pertaining to virtually all of your clients.
Warning: You have 3 days to enter negotiations. Once the deadline passes, the negotiation window will be permanently closed and all exfiltrated data will be published. Additionally, the encrypted data will be rendered completely unrecoverable.
sample files:
https://mega.nz/file/CgxxTKCZ#PzGFlZt67HDF2oLsP4jn_W_QdrquHJpNAfVm-jXGYxo
https://mega.nz/file/2ogzwAyY#r8F31SFQTqyW6bzQA-e8HNzgw-rEW_gn7fhwY5TAByg
https://mega.nz/file/2gIRXQwY#-4IzU70FjqvSYotZoaJuod_H2P5sXoGTvsja9Patte0
https://mega.nz/file/alQU0JaT#2GgaPb1Z-z1xB1FfAd_NohXbfkbfRfhfZ_OwtxPd0cc [Sector: Construction]
