Johnson Investment Counsel
September 18, 2026
•[ ransomware, finance ]
Johnson Investment Counsel was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: johnsoninv.com. Johnson Investment Counsel is an independent, employee-owned wealth management firm founded in 1965 and headquartered in Cincinnati, Ohio. The company provides comprehensive financial services to individuals, families, businesses, corporations, retirement plans, foundations, and nonprofit organizations. Its services include investment management, financial planning, retirement and cash-flow planning, estate planning, trust services, charitable planning, and business solutions. Johnson Investment Counsel operates as a fee-only Registered Investment Advisor and emphasizes fiduciary responsibility, long-term relationships, and customized financial strategies. As of June 30, 2026, the firm manages approximately $23 billion in assets and has 159 employees, serving clients across all 50 U.S. states.
The company headquarters is located in 7755 Montgomery Road, Suite 180, Cincinnati, OH 45236, United States.51-200 Employees
American Casting Company
September 18, 2026
•[ ransomware, manufacturing, technology ]
American Casting Company was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: americancastingco.com. American Casting Company is an ISO 9001 and AS9100 certified investment casting foundry located in Hollister, California, specializing in premier quality investment castings for the aerospace and medical industries. The company offers a variety of castings made from super alloys and other high-performance materials, ensuring the industry's shortest lead times through advanced manufacturing processes, including 3D printing and vacuum melting. Their services include design for manufacturability, NADCAP heat treating, and non-destructive testing, catering to clients in sectors such as medical, aerospace, defense, and industrial applications. With a focus on innovation and quality, American Casting Company commits to delivering precise, durable, and strong investment castings perfect for complex geometries.
The company headquarters is located in 205 Apollo Way, Suite A, Hollister, CA 95023, United States. 51-200 Employees
Inland and Offshore Contractors
September 18, 2026
•[ ransomware, energy ]
Inland and Offshore Contractors was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Energy & Utilities. Country: Trinidad & Tobago. Website: www.iocltt.com.
Grupo Juste
September 18, 2026
•[ ransomware, healthcare ]
Grupo Juste was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Mexico. Website: www.grupojuste.com.
Futuro Forestal
September 18, 2026
•[ ransomware, manufacturing ]
Futuro Forestal was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Chile. Website: www.futuroforestal.com.
Ceres Tolvas
September 18, 2026
•[ ransomware, manufacturing ]
Ceres Tolvas was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Agriculture and Food Production. Country: Argentina. Website: www.cerestolvas.com.ar.
Ascend Com
September 18, 2026
•[ ransomware, technology ]
Ascend Com was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Singapore. Website: www.ascendcom.com.sg.
www.kendallhunt.com
September 18, 2026
•[ ransomware, education ]
www.kendallhunt.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: www.kendallhunt.com. Founded in 1944, Kendall Hunt Publishing is a publisher of hands-on, inquiry-based science, mathematics, and gifted curricula for grades PreK-12. Their research and standards-based programs are available in both print and digital components that encompass students, teachers, and parents. Kendall Hunt is headquartered in Dubuque, IA.
www.roancampingholidays.com
September 18, 2026
•[ ransomware, retail, leak ]
www.roancampingholidays.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Hospitality. Country: Netherlands. Website: www.roancampingholidays.com. Roan Luxury Camping Holidays is a Dutch tour operator specializing in deluxe mobile home and tent rentals at 4- and 5-star campsites across Europe
Anderson Industries
September 18, 2026
•[ ransomware, manufacturing, financial ]
Anderson Industries was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: anderson-industries.com. Anderson Industries is a cutting-edge engineering and manufacturing company that assists forwar
d-thinking businesses in bringing innovative products to market. They offer a range of products
including agricultural equipment, trailers, and foundry services.
We will upload 9gb of corporate data soon. Employee personal information, client information, l
ots of projects, specifications, orders, financials, NDAs and so on.
United Federation of Teachers
September 18, 2026
•[ ransomware, education ]
United Federation of Teachers was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: United States of America. Website: uft.org. Education / Labor Union US New York | The unions complete legal case archive approx. 181,420 documents: grievance and arbitration files, disciplinary appeal decisions and personnel case files, each named for a member; Contract documents: CBAs, MOUs, MOAs and side letters; Nurse-federation and health-benefit-fund case materials; Teacher evaluation and class-size complaint files; Staff search and case-view audit logs | Publication proceeds in batches after the deadline. The victim can verify everything and settle in their private negotiation room. | [ACTIVE: deadline 2026-09-19 14:58 UTC]
BeLi Teacher / FSC education centers (AWS)
September 18, 2026
•[ ransomware, education, technology ]
BeLi Teacher / FSC education centers (AWS) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: Vietnam. Website: beliteachers.com. Education / edtech Vietnam | The complete CRM lead database: 152,044 contact records names, emails, +84 phone numbers, cities, study interests, engagement history; The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 02:47 UTC]
AstraZeneca Türkiye
September 18, 2026
•[ ransomware, healthcare, manufacturing ]
AstraZeneca Trkiye was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: Turkey. Website: astrazeneca.com.tr. Pharmaceutical manufacturing (GxP) Trkiye | Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings; 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications | All sites are enforcing a total network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Argentem Creek Partners (investment firm)
September 18, 2026
•[ ransomware, finance, technology ]
Argentem Creek Partners (investment firm) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: argentemcreek.com. Investment management / private credit United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Ministry of Education — Argentina
September 18, 2026
•[ ransomware, government, education ]
Ministry of Education Argentina was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: Argentina. Website: argentina.gob.ar. Government / education Argentina | Complete network-security configuration of the ministry network; 1.08M connection records: national library (BNM), school-book selection platform, scholarship systems (becasprogresar), titulosvalidez, certificadosinfd, sitrared; Evidence of the Monero cryptocurrency miner operating inside the ministry network | The ministry network is under a total blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
PayPal support operations (Transcom WorldWide)
September 18, 2026
•[ ransomware, finance, technology ]
PayPal support operations (Transcom WorldWide) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: Sweden. Website: transcom.com. Outsourced customer support / financial services Netherlands / Tunisia | 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems; Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites | All 8 sites are enforcing a network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Prefix Corp
September 18, 2026
•[ ransomware, manufacturing ]
Prefix Corp was listed as a victim on the leak site of the securotrop ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: United States of America. Website: www.prefix.com. Status: AWAITING
Size: 1135 GB
Paid Victim 192EB2B6AD7B98D9
September 18, 2026
•[ ransomware ]
Paid Victim 192EB2B6AD7B98D9 was listed as a victim on the leak site of the AuditTeam ransomware group; the attack is estimated to have taken place on 2026-09-18. Country: Russian Federation. [AI generated] N/A
I don't have any reliable information about a company named "Paid Victim 192EB2B6AD7B98D9." This appears to be an anonymized or coded identifier, possibly from a ransomware leak site or threat intelligence feed, rather than an actual company name. Without access to the specific database or source that generated this identifier, I cannot provide factual details about its operations, industry, or country.
PITTSRAD
September 18, 2026
•[ ransomware, healthcare ]
PITTSRAD was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: United States of America. Website: pittsrad.net. [AVAILABLE DATA] Radiology and health imaging, client personal and health data.
Barrett Mahony Consulting Engineers
September 18, 2026
•[ ransomware, leak, technology ]
Barrett Mahony Consulting Engineers was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Professional Services. Country: Ireland. Website: www.barrettmahony.com. Ireland
