Bomchil
November 29, 2025
•[ ransomware, technology ]
Bomchil was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-29. Sector: Professional Services. Country: Argentina. Website: www.bomchil.com.ar.
Asia Condominium Association
November 29, 2025
•[ ransomware, retail ]
Asia Condominium Association was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-29. Sector: Hospitality. Country: United States of America. Website: www.asiamiamicondo.com.
Division 10
November 30, 2025
•[ ransomware, manufacturing ]
Division 10 was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2025-11-30. Sector: Other. Country: United States of America. Website: division10inc.com. Division 10 Inc is a company based in Memphis, Tennessee, specializing in supplying specialty products to the construction industry since 1989. They offer services including product sales, estimating services, and installation quotes. Their clients range from contractors to automotive companies, evidenced by testimonials highlighting their successful project contributions. The company prides itself on its commitment to quality and customer satisfaction
Battaglioli
November 30, 2025
•[ ransomware, manufacturing ]
Battaglioli was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-30. Sector: Manufacturing. Country: Italy. Website: www.battaglioli.it.
ILCA Targhe s.r.l.
November 30, 2025
•[ ransomware, manufacturing ]
ILCA Targhe s.r.l. was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-30. Sector: Manufacturing. Country: Italy. Website: www.ilcatarghe.it.
Veton Ai
November 30, 2025
•[ ransomware, technology ]
Veton Ai was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-30. Sector: Technology. Country: United States of America. Website: www.veton.ai.
WR Comercial
November 24, 2025
•[ ransomware, technology ]
WR Comercial was listed as a victim on the leak site of the medusa ransomware group; the attack is estimated to have taken place on 2025-11-24. Sector: Professional Services. Country: Brazil. Website: wrcomercial.com.br. Ransom demand: 100000. WR Comercial helps businesses find great staff for important jobs like cleaning, security, and front desk work. They connect companies with skilled workers who can handle all kinds of tasks, making it easy for businesses to get the help they need quickly and reliably. Whether you run a small office or a big building, WR Comercial has people ready to support your team.
company is headquartered in Rua Giancarlo Palanti 22B, Vila R, So Paulo, CEP 03661-050, Brazil.
11-50 Employees
Universidade Municipal de São Caetano
November 24, 2025
•[ ransomware, education ]
Universidade Municipal de So Caetano was listed as a victim on the leak site of the medusa ransomware group; the attack is estimated to have taken place on 2025-11-24. Sector: Education. Country: Brazil. Website: uscs.edu.br. Ransom demand: 250000. USCS offers a diverse range of educational programs including in-person and distance learning undergraduate degrees, technical courses, and postgraduate studies such as MBAs and doctorates. The university also provides non-degree courses aimed at skill enhancement and is equipped with facilities for secondary education. Services include free legal assistance, fiscal education, and health services, catering to both students and the community. With a focus on quality and flexibility, USCS serves a wide array of clients including students at various academic levels and professionals seeking further education.
company is headquartered in Rua Santo Antnio, 50 Centro, So Caetano do Sul, SP, CEP 09521-160.
501-1,000 Employees,
HWL Ebsworth
January 1, 2023
•[ ransomware, hack ]
hacked by ALPHV
Australian Clinical Labs (Medlab Pathology)
January 1, 2022
•[ ransomware, healthcare ]
ransomware attack
Neogen
August 29, 2026
•[ ransomware, technology, leak ]
In August 2026, the food and animal safety organisation Neogen was the target of a ShinyHunters "pay or leak" extortion attempt. The group later published data it claimed had been obtained from Neogen. The data consisted largely of corporate contact records and included 436k unique email addresses from mailing lists, employee records and other contacts.
Medela
September 7, 2026
•[ ransomware, healthcare, leak ]
In September 2026, Swiss medical device company Medela was the target of a ShinyHunters "pay or leak" extortion campaign. The data allegedly obtained in the breach was later published publicly and included 424k unique email addresses belonging predominantly to healthcare professionals, Medela staff and leads. The exposed data consisted primarily of corporate contact information, including names, physical addresses and phone numbers, with some records also containing associated support tickets.
Carhartt
August 13, 2026
•[ leak, ransomware, retail ]
In August 2026, clothing retailer Carhartt was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly obtained from the company including 12.9M unique email addresses, names, phone numbers and physical addresses. The published corpus also contained millions of synthetic records that did not relate to real individuals and were excluded from the breach.
RingCentral
July 27, 2026
•[ ransomware, leak, technology ]
In July 2026, the cloud-based business communications platform RingCentral was the target of a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they claimed was obtained from the platform, which included 1.6M unique email addresses along with names, physical addresses and phone numbers. In their disclosure notice, RingCentral advised that the incident affected "a limited portion of RingCentral customers" and that it was communicating directly with those affected.
Alcon
August 1, 2026
•[ ransomware, leak, healthcare ]
In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address.
Brinks Home
July 13, 2026
•[ ransomware, leak, technology ]
In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice, they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law".
Inter-Con Security
June 18, 2026
•[ ransomware, technology ]
In June 2026, Inter-Con Security was targeted in a ShinyHunters pay or leak extortion campaign. The group subsequently published data it alleged was taken from the company, including 276k unique email addresses along with names, physical addresses, job titles and phone numbers. The data encompassed a combination of contacts, internal users and leads.
Fluke
July 1, 2026
•[ ransomware, technology ]
In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign. The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.
Glendale Community College
June 15, 2026
•[ ransomware, leak, education ]
In June 2026, Glendale Community College was the target of a ShinyHunters "pay or leak" extortion campaign. Data allegedly obtained from Glendale was later published online and included almost 800k unique email addresses along with various other data fields, including names, addresses, phone numbers, Social Security numbers and other information relating to student enrolments. In its disclosure notice, the college advised that "the potentially impacted information may vary for each individual and may include all or just one of the above-listed types of information".
