Phoenix S&S GmbH
October 24, 2026
•[ ransomware, manufacturing, finance ]
Phoenix S&S GmbH was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: Germany. German company from Frankfurt am Main,
which deals with building maintenance, construction services,
logistics and security.
Archived personal and corporate data of employees and customers.
Here are the most important documents. [Sector: Manufacturing, Finance, Transportation]
Pure Grow Diamonds Inc.
October 25, 2026
•[ ransomware, manufacturing, financial ]
Pure Grow Diamonds Inc. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Manufacturing. diamond and lab grown diamond trading New York, New York, United States | Diamond stock and inventory lists with stock codes and certificate numbers; Customer return records with customer names and tracking references; More than 2,200 bank deposit and invoice documents | [NOT PAID EXPOSED]
mahsing.com.my
October 25, 2026
•[ ransomware, manufacturing, healthcare ]
mahsing.com.my was listed as a victim on the leak site of the Scarlettgroup ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Hospitality. Country: Malaysia. Website: mahsing.com.my. Mah Sing Group is a leading Malaysian property developer specializing in affordable residential and commercial properties, with additional businesses in healthcare and plastics manufacturing.
Ernesto Malvestiti S.p.A.
October 26, 2026
•[ ransomware, manufacturing, espionage ]
Ernesto Malvestiti S.p.A. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Italy. Website: Ernesto Malvestiti S.p.A.. [manufacturer] Ernesto Malvestiti S.p.A. a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM.
The exposed material spans the company's entire operations:
PAGHENET payroll database (1.1 GB SQL Server backup 7 copies) every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB 5).
GDPR Article 9 special-category data medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce.
50+ plaintext OEM portal credentials stored in a single file called accesso web.txt BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more.
SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export.
ADP payroll SFTP credentials stored in WinSCP.ini the channel used to transmit employee salary data to the external payroll processor.
614 MB of financial/controlling data consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships.
1.5 GB of engineering IP 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts.
160+ client/supplier contracts with pricing, commercial terms, and executed NDAs.
560+ job candidate CVs with full names, addresses, phone numbers, and career histories.
Five Star Sheets
October 26, 2026
•[ ransomware, retail, manufacturing ]
Five Star Sheets was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: United States of America. Website: www.fivestarsheets.com.
FIRMENGRUPPE APPL Holding GmbH
October 26, 2026
•[ ransomware, manufacturing ]
FIRMENGRUPPE APPL Holding GmbH was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Germany. Website: www.appl.de.
www.marvinpac.com
September 25, 2026
•[ ransomware, manufacturing, retail ]
www.marvinpac.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-25. Sector: Manufacturing. Country: United States of America. Website: www.marvinpac.com. Marvinpac CZ, s.r.o. the Czech subsidiary of Swiss group Marvinpac SA specialises in contract packaging and co-packing for some of the world's leading brands: Nespresso, L'Oral, COTY (Gucci, Hugo Boss, Calvin Klein), air up, LEGO, and others. The company has operated since 2010 at its production facility in anyJalovice near Prague, and forms part of an international group with divisions in Switzerland, France, and Italy.
POWERsonic Industries Inc.
October 19, 2026
•[ ransomware, manufacturing, leak ]
POWERsonic Industries Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Manufacturing. Country: United States of America. Website: POWERsonic Industries Inc.. [manufacturer] POWERsonic Industries Inc. a privately held wire harness and cable assembly contract manufacturer founded in 1998 with ~100-150 employees across 7 locations.
The exposed material spans every entity in the POWERsonic corporate structure:
Employee PII for 93-150 employees SIN documents, passports, I-20 visas, LMIA immigration approvals, W-2 tax forms, pay stubs, banking information. Plus 8 complete email archives totaling 13.2 GB.
Customer proprietary designs 7.5 GB of Demers Ambulance wiring harness data, 15 GB of CIRRIS cable test results, Mold Masters drawings, and a bilateral NDA with Husky Injection Molding.
Full financial records Dec 2025 balance sheet ($285K cash, $5.1M AP), trial balance, revenue data ($17.7M US), loan agreements, order margins (~45%), insurance policies.
SkyWorld Air Cargo
October 19, 2026
•[ ransomware, manufacturing ]
SkyWorld Air Cargo was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-19. Sector: Transportation. Country: United Arab Emirates. Website: www.skyworldaircargo.com.
Company #97
October 20, 2026
•[ ransomware, manufacturing ]
Company #97 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-20. Country: Tunisia. textile manufacturing Tunisia | [PENDING EXPOSURE]
Aveva
October 20, 2026
•[ ransomware, technology, manufacturing ]
Aveva was listed as a victim on the leak site of the Mimori ransomware group; the attack is estimated to have taken place on 2026-10-20. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Website: aveva.com. AVEVA is a British multinational industrial software company headquartered in Cambridge, England, and operating as an autonomous business unit of Schneider Electric. It provides engineering, design, operations management, data visualization, asset performance, and cloud-based industrial intelligence solutions for sectors including oil and gas, power, chemicals, manufacturing, marine, mining, and infrastructure. AVEVA's technology helps thousands of enterprises worldwide optimize industrial processes, improve operational efficiency, and support digital transformation across complex engineering and asset lifecycle management.
Sector: Technology - Files: 177234 - Publication planned: 2026-10-23T19:09:39Z
GSE-M Technology Sdn. Bhd.
October 21, 2026
•[ ransomware, technology, manufacturing ]
GSE-M Technology Sdn. Bhd. was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Technology. Country: Malaysia. Website: www.gse.com.my. Industrial Engineering, Manufacturing Automation and Custom Machinery Solutions.
Lindauer Dornier
October 21, 2026
•[ ransomware, manufacturing, technology ]
Lindauer Dornier was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: Germany. [AI generated] Lindauer Dornier GmbH is a German mechanical engineering company based in Lindau, Germany. Founded in 1950, it specializes in manufacturing textile machinery, particularly weaving machines, as well as equipment for composite materials, plastics film stretching lines, and paper machine components. The company operates globally, serving industrial manufacturing sectors, and is part of the broader Dornier industrial group with a long engineering heritage.
WEPOS Chemie
October 21, 2026
•[ ransomware, manufacturing ]
WEPOS Chemie was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: Germany. Website: wepos-chemie.de. WEPOS Chemie is a German company founded in 2007 that develops, manufactures, and sells specialized cleaning and care products for homes, gardens, floors, tiles, and hygiene, including mold removers. Its products are made in Germany.
DR.SCHNELL GmbH & Co. KGaA
October 22, 2026
•[ ransomware, manufacturing, technology ]
DR.SCHNELL GmbH & Co. KGaA was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Manufacturing. Country: Germany. DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA full network dump. 175,151 files / 2.52 TB.1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement).Complete HR & payroll for Germany, Switzerland, Austria: home addresses, personal emails, payslips with social-security and tax IDs, long-term sick lists (GDPR Art. 9 data).Family-office accounting: signed annual statements of dozens of related entities, bank statements, a EUR 35M credit-line agreement.CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns.Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists. More
PROTEX Confection
October 23, 2026
•[ ransomware, manufacturing, leak ]
PROTEX Confection was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Manufacturing. Country: Tunisia. textile manufacturing Tunisia | Client master records of the group's accounting and commercial dossiers: 84 records with client names, addresses, Tunisian tax registration numbers, phones and emails; Supplier master records: 32 records with the same level of detail; Article and inventory data of both confection workshops and the Bizerte branch; Business documents of 2026: quotes, invoices and delivery notes for named clients; Print and production templates of the group | The victim can verify everything in their private negotiation room. | [NOT PAID EXPOSED]
Bravilor Bonamat
October 23, 2026
•[ ransomware, manufacturing, leak ]
Bravilor Bonamat was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Manufacturing. Country: Netherlands. Bravilor Bonamat is a family-owned manufacturer of professional coffee machines and hot water d
ispensers. The company offers espresso, filter, fresh brew, instant coffee, and bulk brewing so
lutions designed for offices, restaurants, hotels, retail locations, and other commercial envir
onments.
We will upload 100gb of corporate data soon. Employee personal information (passports, drivers
licenses and so on), customer information, contracts and agreements, confidential information (
partners personal documents), lots of NDAs and so on.
JS Constructor, INC
October 23, 2026
•[ ransomware, manufacturing ]
JS Constructor, INC was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Manufacturing. Country: United States of America. JS Contractor Inc. is a Philippine recruitment and manpower agency that specializes in recruiting, screening, processing, and deploying Filipino workers for overseas employment. Established in 1977, the company connects qualified applicants with international employers across industries such as manufacturing, engineering, technical services, and skilled labor. Through its website, applicants can explore job opportunities, submit applications, and access information about overseas employment.
We have all your critical files, encrypted with the strongest encryption, along with over 150,000 resumes and applicants' vaccination records. This includes 3.5 GB of your databases containing sensitive applicant information. PI and SPI data. A total of millions.
Contact us, or we will publish your applicants' data and critical files. Other threat actors will use it for identity theft and other crimes. We will ensure your company's reputation will be in hell. Your business integrity will be compromised. Loss of stakeholders will follow. And the company's credibility will be damaged. This will be your downfall.
session: 05690c095fbbc61a04e6bdb09d92c535f4866f571db2e2d54e31bbb245ac886d43
Homepage: emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion
Client: emprdrcfhpvym7uwqvxky6ympquibzxfxuor6qeexk7lz3sxz5t2ubqd.onion/client [Sector: Other]
mickeybody.com
October 23, 2026
•[ ransomware, retail, manufacturing ]
mickeybody.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Retail & E-Commerce. Country: United States of America. Website: mickeybody.com. Mickey Truck Bodies has been family owned and operated since the company was started in High Point, NC in 1904. Today Mickey manufactures all-aluminum beverage bodies and beverage trailers, dry freight and refrigerated van bodies, emergency vehicles and specially engineered equipment for customers t
Trinity Custom Homes
October 24, 2026
•[ ransomware, manufacturing ]
Trinity Custom Homes was listed as a victim on the leak site of the Deadlock ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Manufacturing. Country: United States of America. Website: trinitycustom.com. Trinity Custom Homes is a custom home builder that specializes in building 100% custom, solid wood homes directly on the customers land across several states in the Southeast, including Georgia, Alabama, North Carolina, South Carolina, and Tennessee.
