Ernst & Young
July 27, 2026
•[ ransomware, finance, technology ]
Ernst & Young was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Professional Services. Country: United States of America. Website: ey.com. Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to release all the data and files. This is a final warning to reach out by 31 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 27 July 2026 | Warning: FINAL WARNING PAY OR LEAK
RingCentral, Inc.
July 27, 2026
•[ ransomware, technology ]
RingCentral, Inc. was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Technology. Country: United States of America. Website: ringcentral.com. Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 27 July 2026 | Warning: FINAL WARNING PAY OR LEAK
BH Security, LLC. (brinkshome.com)
July 27, 2026
•[ ransomware, technology ]
BH Security, LLC. (brinkshome.com) was listed as a victim on the leak site of the shinyhunters ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Professional Services. Country: United States of America. Website: brinkshome.com. Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. | Updated: 27 July 2026 | Warning: FINAL WARNING PAY OR LEAK
TFG Benefits, Inc.
July 20, 2026
•[ ransomware, finance ]
TFG Benefits, Inc. was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-20. Sector: Financial Services. Country: United States of America. Website: www.tfgbenefits.com. - Employee PII- Payroll- Benefits- Financials- Client HR- Identity Docs
KSL Dirtworks LLC
July 10, 2026
•[ ransomware, manufacturing, financial ]
KSL Dirtworks LLC was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-10. Sector: Manufacturing. Country: United States of America. Website: www.ksldirtworks.com. - HR Documents- Financial Documents- Contracts- Bids & Proposals- Project Documents- Office Documents- Construction Standards- Insurance Documents
Wings Argo Private Limited
July 5, 2026
•[ ransomware, manufacturing ]
Wings Argo Private Limited was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-05. Sector: Other. Country: India. Website: www.wingsprojects.com/agro. Wings Production DB
K. Venkatesh, Co
July 3, 2026
•[ ransomware, leak, finance ]
K. Venkatesh, Co was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-03. Country: India. Website: cavenkatesh.com. - Internal Documents
Furama Bukit Bintang
June 27, 2026
•[ ransomware, retail ]
Furama Bukit Bintang was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-06-27. Sector: Hospitality. Country: Malaysia. Website: www.furama.com/bukitbintang. - Executive Data- HR Data and Documents- Data for IT Department
OPTIDEA GmbH
June 24, 2026
•[ ransomware, technology, financial ]
OPTIDEA GmbH was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Technology. Country: Switzerland. Website: optidea.ch/de. - Internal Document- Financial & HR Documents- Design Data
MKS Transformator
June 20, 2026
•[ ransomware, manufacturing, financial ]
MKS Transformator was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-06-20. Sector: Manufacturing. Country: Turkey. Website: www.mksltd.net. - Accounting / Finance Documents- Projects Data, Purchasing / Procurement Documents- Quality / Document Control- Maintenance, and HR documents- Production / Manufacturing Data
Akribis Systems Pte Ltd
July 22, 2026
•[ ransomware, technology, manufacturing ]
Akribis Systems Pte Ltd was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-22. Sector: Technology. Country: Singapore. Website: www.akribis-sys.com. - All Motor Designs- CAD Files- Employee & HR Sensitive Data- Legal & Compliance- Machine Details
Kates Nussman Ellis Earle & Landolfi LLP
July 26, 2026
•[ ransomware, leak ]
Kates Nussman Ellis Earle & Landolfi LLP was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-26. Sector: Professional Services. Country: United States of America. Website: katesnussman.com.
The Mountain
July 19, 2026
•[ ransomware, financial ]
The Mountain was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-07-19. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.themountaincompany.co.uk. - HR & Payroll Data- Financial & Accounting Records- Payment & Credit Card Data- Customer & CRM Data- Orders & Supply Chain Data- SharePoint & Business Application Data
Groupe Fenwick
July 6, 2026
•[ ransomware, manufacturing ]
Groupe Fenwick was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-07-06. Sector: Manufacturing. Country: France. Website: www.fenwick.fr.
bnpdist.com
July 27, 2026
•[ ransomware, retail, hack ]
bnpdist.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Retail & E-Commerce. Country: United States of America. Website: bnpdist.com. Headquartered in New York City, the company has been operating since 1979 and supplies restaurants, hotels, retailers, and wine merchants
weier.org
July 27, 2026
•[ ransomware, manufacturing ]
weier.org was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Country: Germany. Website: weier.org. The company specializes in representing manufacturers of plumbing, heating, water treatment, pumping, drainage, and building services equipment throughout western Germany.
braywoodschool.co.uk
July 27, 2026
•[ ransomware, education ]
braywoodschool.co.uk was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Education. Country: United Kingdom of Great Britain and Northern Ireland. Website: braywoodschool.co.uk. Founded in 1858, the school has more than 165 years of educational history and serves children from early years through
hst.eu
July 27, 2026
•[ ransomware, manufacturing, technology ]
hst.eu was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Country: Germany. Website: hst.eu. Headquartered in Kressbronn am Bodensee, Germany, the company traces its mechanical engineering heritage back to 1950, while the original tea
landesmuseum.de
July 27, 2026
•[ ransomware, education ]
landesmuseum.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Education. Country: Germany. Website: landesmuseum.de. Established in 1919, the museum preserves and presents more than 50,000 years of human cultural history, ranging from prehistoric artifacts
paritaet-nrw.org
July 27, 2026
•[ ransomware, leak, healthcare ]
paritaet-nrw.org was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-07-27. Sector: Professional Services. Country: Germany. Website: paritaet-nrw.org. Headquartered in Wuppertal, the organization represents approximately 3,100 legally independent member organizations operating more than 7,000 social institutions and services
