Betopia Group
October 26, 2026
•[ ransomware, technology, leak ]
Betopia Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Cyprus. Website: betopiagroup.com. betopiagroup.com Betopia Group Betopia Group is a Bangladeshi tech holding based in Dhaka, formally created in July 2025 by consolidating 22 business units including Bdcalling IT, Softvence, Sparktech, JVAI and Zencore, claiming 5,000 employees and 36 million dollars in annual revenue. Founded by Muhammad Monir Hossain, who went from freelancing on oDesk in 2013 to launching Bdcalling IT in 2017 with just 500,000 taka and 7 people, the group now serves clients in over 80 countries with 80 to 90 percent of business from the United States. Its units span software development, AI, cloud infrastructure via ZenexCloud, Odoo ERP implementation, renewable energy through PulseGrid and IT education. In July 2026 the group unveiled Vision 2030, planning to double its workforce and build Betopia City, an AI-powered smart tech hub in Bangladesh. The company is embroiled in a major scandal, with Fiverr suspending around 300 accounts linked to Betopia for coordinated marketplace manipulation.
Malmsten
October 26, 2026
•[ ransomware, manufacturing ]
Malmsten was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Sweden. Website: malmsten.com. malmsten.com Malmsten AB is a Swedish family-owned company founded in 1975 in Tby, the world's leading manufacturer of swimming pool and open water equipment including lane lines, buoys, starting blocks and safety gear. With around 30 employees and global distribution, its equipment has been used at 11 consecutive Olympic Games from Moscow 1980 to Paris 2024. Founder Robert Malmsten received the FINA Gold Pin Award in 2024 for 48 years of service to the international swimming federation's equipment committee. The company's proprietary wave calming technology reduces turbulence in competition lanes, making its Golden Series the gold standard for elite swimming events. Led by CEO David Malmsten in the second generation, it operates a subsidiary in Australia and serves 100 plus national swimming federations worldwide. Key strengths are FINA approval, Olympic heritage and a full product range from elite competition to public pool equipment.
Farmacias 911
October 26, 2026
•[ ransomware, healthcare, manufacturing ]
Farmacias 911 was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Healthcare. Country: Ecuador. Website: farmacias911.com.ec. farmacias911.com.ec Gettareq S.A., known as Farmacias 911, is a major Ecuadorian pharmaceutical company founded in 2013 in Guayaquil, combining retail pharmacy, wholesale distribution, OEM manufacturing and medical consulting across the whole country. The group operates six brands including Farmacias 911 retail, ACOSAR wholesale distribution, Galenic for private label manufacturing, One Laboratory for quality testing and Conseplus for consulting. It has grown from 11 to 500 employees with a 166 percent increase in headcount, working with global pharmaceutical giants like Abbott, Bayer, Bristol Myers Squibb, Takeda and Roche. Led by founder and CEO Marlon Morillo, the company hosted Ecuador's largest pharmaceutical convention in 2025 alongside APESFA. Its vertical integration from import and production to retail and lab testing is unique in the Ecuadorian market.
layam.com
October 31, 2026
•[ ransomware, retail ]
layam.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Country: Israel. Website: layam.com. Its product portfolio includes food and provisions, beverages, tobacco products, perfumes, cosmetics, electronics, confectionery, gifts and other duty-free merchandise. The
jumonji-u.ac.jp
October 31, 2026
•[ ransomware, education ]
jumonji-u.ac.jp was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: Japan. Website: jumonji-u.ac.jp. The institution is operated by Jumonji Gakuen Educational Corporation and focuses on providing undergraduate and postgraduate education in humanities, education,
Ivan Smith Furniture
October 31, 2026
•[ ransomware, retail, leak ]
Ivan Smith Furniture was listed as a victim on the leak site of the sarcoma ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Country: Philippines. For 65 years, Ivan Smith Furniture has believed that great service starts with treating people like neighbors. What began as a small-town furniture store has grown to 40 locations across Louisiana, Texas, and Arkansas, but the values that built our business remain the same.Geo: USA - Leak size: 500 gb - Contains: Files and data bases
Kraft Lernen
October 31, 2026
•[ ransomware, education ]
Kraft Lernen was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Education. Country: Germany. Website: kraft-lernen.de. Kraft Lernen is a German company that specializes in supplying didactic and developmental materials for kindergartens, schools, and therapeutic institutions. Its product catalog includes educational aids, Montessori materials, board games, and supplies for motor skills, creative arts, and inclusive learning. Based in Germany, the company primarily targets educators, childcare professionals, and institutional procurement for educational centers.
System Soft
October 31, 2026
•[ ransomware, technology ]
System Soft was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Technology. Country: Bulgaria. Website: systemsoft.info. systemsoft.info
Commission de la construction du Quebec
September 1, 2026
•[ ransomware, government ]
Commission de la construction du Quebec was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Government & Defense. Country: Canada. Website: www.ccq.org.
dmt-group.com
September 1, 2026
•[ ransomware, technology ]
dmt-group.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Germany. Website: dmt-group.com. DMT Consulting Private Limited is an Indian private limited company incorporated on September 25, 1998, formerly known a...
tum.com.mx
September 1, 2026
•[ ransomware, manufacturing, retail ]
tum.com.mx was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Education. Country: Mexico. Website: tum.com.mx. TUM Transportistas Unidos Mexicanos Divisin Norte, S.A. de C.V. is the largest trucking company in Mexico, founded in ...
Burris & MacOmber
October 27, 2026
•[ ransomware, leak ]
Burris & MacOmber was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. [AI generated] N/A
I don't have reliable, verifiable information about a company called "Burris & MacOmber." I'm not able to confirm its existence, industry, operations, or location, and providing fabricated details would be inaccurate and potentially misleading for threat intelligence purposes. If you have additional context or source material about this entity, I'd be glad to help analyze it.
OR Technology
October 27, 2026
•[ ransomware, technology ]
OR Technology was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Technology.
Charter Township of Commerce
October 27, 2026
•[ ransomware, government ]
Charter Township of Commerce was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Government & Defense. Country: United States of America. Website: www.commercetwp.com. Government Administration Stolen data: 155 GB.
Hygiena
October 27, 2026
•[ ransomware, healthcare, hack ]
Hygiena was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Healthcare. Country: United States of America. Website: www.hygiena.com. United States
VPC Builders
October 27, 2026
•[ ransomware, manufacturing ]
VPC Builders was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Country: United States of America. Website: www.vpcbuilders.com. United States
wagyu.xyz unfairness
October 28, 2026
•[ ransomware, financial, technology ]
wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence:
1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).
2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).
Evidence to support this can be found below:
Meleghy Automotive & Cie. GmbH
October 28, 2026
•[ ransomware, manufacturing, automotive ]
Meleghy Automotive & Cie. GmbH was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Manufacturing. Country: Germany. Website: Meleghy Automotive & Cie. GmbH. [automotive] The exposed material includes:
Passport/visa/student-admission dossiers
Tesla Model Y/Opal tooling, CAD and DFM tree
Employee contract and HR folders
MEB/BMW NCAR metrology and plant-layout trees
PLC/SPS/robot backups and cross-reference DBs
TISAX/IATF audit and corrective-action records
Restricted management meeting/WLAN record
Browser profile SQLite databases
Insurance Services
October 28, 2026
•[ ransomware, finance, leak ]
Insurance Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Financial Services. CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a
uto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv
es over 20,000 policyholders across Ontario.
We will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs
and other personal docs), projects (client personal information and other documents (~250 perso
ns (DL numbers, name, addresses, phones and so on)), contracts and agreements, NDA, etc.
Noelker and Hull
October 28, 2026
•[ ransomware, financial, healthcare ]
Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
