Samwumed
September 29, 2026
•[ ransomware, healthcare, finance ]
Samwumed was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Healthcare. Country: South Korea. Website: samwumed.org. samwumed.org zoominfo.com/c/samwumed/346685548 SAMWUMED (founded 1952, Cape Town) is a closed, self-administered medical aid scheme serving South African municipal workers roughly 35,000 members and 73,000 covered lives. It collects about R1.9 billion/year in contributions, kept reserves over R1.3 billion and posted a R14.3 million surplus in 2024 (solvency 68% vs the 25% legal minimum). Plans are income-banded and cheap (from ~R750/month with a 60% employer subsidy), covering hospitals, doctors, medication, dentistry and optics. Led by Principal Officer Francina Mosoeu with a union-appointed board, it administers benefits with Medscheme across a network of private hospital groups. Key problems right now: membership shrinking ~15%/year as young people leave, and an ongoing court battle with the Melomed hospital group over contract exclusions plus the long-term threat of national health insurance reform.
Gardeners' Guild
September 30, 2026
•[ ransomware, leak ]
Gardeners' Guild was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Agriculture and Food Production. Country: United States of America. Website: gardenersguild.com. Gardeners' Guild is a full-service landscaping company based in the SF Bay Area, specializing in both interior and exterior landscape maintenance and construction. Founded in 1972 and employee-owned, they offer a range of services including irrigation repair, sustainable landscaping, and fire fuel reduction. Their clients include multi-family communities, commercial buildings, business parks, hospitality venues, and residential properties. The company is dedicated to transforming and maintaining landscapes while promoting water conservation and drought-tolerant designs.
The company headquarters is located in 2780 Goodrick Avenue, Richmond, CA 94801, United States.
51-200 Employees
West County Health Centers
September 30, 2026
•[ ransomware, healthcare ]
West County Health Centers was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Country: United States of America. West County Health Centers provides comprehensive, quality and accessible health care services to the communities of western Sonoma County.The company is a cohesive team of health care providers, support staff and volunteers dedicated to wellness, compassion, affordability and excellence of care. The company believes in non-judgmental and equal care for all members of the company's diverse community.
The company headquarters is located in 14045 Mill Street, Guerneville, CA 95446, United States. 51-200 Employees
clicks digital GmbH Information
September 30, 2026
•[ ransomware, technology ]
clicks digital GmbH Information was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Germany. clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More
MCAP — MortgageHub commercial lending platform
September 30, 2026
•[ ransomware, finance ]
MCAP MortgageHub commercial lending platform was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Financial Services. Country: Canada. Mortgage securitization and servicing (Canada) Canada | The complete MortgageHub borrower database of a major Canadian mortgage company: seven years of records with social insurance numbers, dates of birth, full addresses, and complete loan and payment histories; The daily commercial servicing book: the full national portfolio of active commercial mortgages with balances, interest rates, credit scores, insurer policy numbers, arrears, and investor reporting fields; The full backup archive of the platform, 2019 through today | [ACTIVE: deadline 2026-10-03 15:00 UTC]
Altmannshofer Sicherheits-Videotechnik
September 30, 2026
•[ ransomware, manufacturing, technology ]
Altmannshofer Sicherheits-Videotechnik was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: Germany. Website: altmannshofer.de. Altmannshofer Sicherheits-Videotechnik OHG is a German installer of electronic security systems from Affing near Augsburg, Bavaria. Since 1999 it plans and installs CCTV, burglar alarms (EMA), access control, electronic locks, fingerprint scanners
PROJAHN
September 30, 2026
•[ ransomware, manufacturing ]
PROJAHN was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Other. Country: Germany. Website: projahn.de. German manufacturer and distributor of professional precision
and hand tools (drill bits, masonry/wood/steel tools, thread tools, measuring tools, sockets, wrenches, screwdrivers, pliers, flashlights, workbenches).
Virtual Ideas
September 30, 2026
•[ ransomware, technology ]
Virtual Ideas was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Australia. Website: virtualideas.com.au. Virtual Ideas is an Australian 3D visualisation and digital content studio based in
Sydney. It specialises in architectural visualisation (CGI), 3D animation, marketing
films, product visualisation, shadow and visual-impact studies etc.
Becker Logistik
September 30, 2026
•[ ransomware, manufacturing ]
Becker Logistik was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Transportation. Country: Germany. Website: becker-logistik.de. German logistics and transportation company specializing in national and international freight transport, particularly bulk goods. The company operates its own fleet and provides reliable transport services across Germany and Europe.
Vinco Energy
September 30, 2026
•[ ransomware, energy ]
Vinco Energy was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Energy & Utilities. Country: United States of America. Website: vincoenergy.com. Vinco Energy Services is a Mexican oilfield services company providing engineering and operational solutions for the oil and gas sector. The company specializes in services like wireline logging, telemetry.
Astidental di Sabbione
September 30, 2026
•[ ransomware, manufacturing ]
Astidental di Sabbione was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: Italy. Website: bquadro.it. is a leading Italian distributor with over 60 years of experience specializing in dental equipment, instruments, and dental laboratory supplies. The company provides comprehensive services, including dental office turnkey design, digital workflow
Dr Damiel Pugliese
September 30, 2026
•[ ransomware, finance, healthcare ]
Dr Damiel Pugliese was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Website: pugliese.lo. Dr. Daniel P. Pugliese is a certified Argentine accountant graduated from the prestigious University of Buenos Aires (U.B.A.). He is officially registered with the Professional Council of Economic Sciences of Buenos Aires (C.P.C.E.C.A.B.A.), which
dfiretailgroup.com
September 8, 2026
•[ ransomware, leak, retail ]
dfiretailgroup.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-08. Sector: Retail & E-Commerce. Country: United States of America. Website: dfiretailgroup.com. DFI RETAIL GROUP 27 Years of Email Archives + 397 Illegal Stores + 40,000 Medical Files Over 160 mai...
Buford-Thompson Company, LTD
September 30, 2026
•[ ransomware, manufacturing, financial ]
Buford-Thompson Company, LTD was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: United States of America. Website: Buford-Thompson Company, LTD. [construction] Buford-Thompson Company, LTD, a Texas construction general contractor with 30+ years of history building schools for K-12 districts across the state.
The exposed dataset totals 1.707 TB and includes:
5 years of W-2 EFW2 files (20212025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees every SSN readable without any decryption.
9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation legal strategy, discovery responses, and counsel communications.
Complete Frost Bank infrastructure four account numbers, ACH routing credentials, line-of-credit agreements (renewed April 2026), signature cards, and monthly bank statements spanning 20222026.
36+ active school construction projects blueprints, bid estimates, cost structures, subcontractor pricing, and change orders for ISD projects across Texas. A competitor's dream dataset.
2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts.
QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accounting, donor, and likely payroll data.
Thompson family personal records owner personal insurance, loans, ranch property (Jack County), airplane ownership, bond dividends, and personal tax documents.
Blaise C. Bender, PC
September 30, 2026
•[ ransomware, leak, finance ]
Blaise C. Bender, PC was listed as a victim on the leak site of the interlock ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Professional Services. Country: United States of America. Website: bcbenderlaw.com. The law firm of Blaise C. Bender, PC handles confidential client tax records/working papers, mergers and acquisitions (M&A) and transaction agreements, estate/trust documents, corporate management records, and confidential attorney-client communications, and fails to maintain security. Due to this negligent mishandling, we disclose confidential information that will subject Blaise C. Bender, PC to disciplinary action by the Bar/CPA, penalties under Section 7216 of the Internal Revenue Code and the Texas Privacy Act, civil claims for professional negligence/breach of fiduciary duty/breach of contract, and serious damage to our reputation and clients.
Orth Automobile
March 6, 2024
•[ ransomware, manufacturing ]
Orth Automobile was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2024-03-06. Sector: Manufacturing. Country: Germany. Website: www.orth-automobile.de. Germany
Titus
September 30, 2026
•[ ransomware, leak, technology ]
Titus was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Germany. Website: www.titus.de. Germany
Le Centre National de l'Expertise Hospitalière (CNEH)
September 30, 2026
•[ ransomware, healthcare, hack ]
Le Centre National de l'Expertise Hospitalire (CNEH) was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Healthcare. Country: France. Website: cneh.fr. Le Centre National de l'Expertise Hospitalire (CNEH) est une cole de rfrence et un organisme franais fond en 1974 qui accompagne les professionnels de sant et les tablissements sanitaires et mdico-sociaux.
wolfusofsky.de
September 30, 2026
•[ ransomware, manufacturing ]
wolfusofsky.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-09-30. Country: Germany. Website: wolfusofsky.de. The group provides a broad range of construction and infrastructure services to public and private clients in Rhineland-Palatinate, Saarland, neighboring
The Japan Times
September 30, 2026
•[ ransomware, technology ]
The Japan Times was listed as a victim on the leak site of the Eclipse ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Other. Country: Japan. Website: www.japantimes.co.jp. The Japan Times is a leading English-language news outlet that provides comprehensive coverage of Japan's business, politics, culture, sports, and entertainment. It offers various subscription options, including digital and print formats, catering to a diverse audience interested in Japanese news and insights. The company also features specialized services such as academic and business subscriptions, as well as access to its digital archives. Its intended clients include local and international readers seeking reliable information about Japan and its global interactions.
