Heber City, UT
October 24, 2026
•[ ransomware, government ]
Heber City, UT was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Government & Defense. Country: United States of America. Website: www.heberut.gov.
Castle Howard Estate
October 24, 2026
•[ ransomware, retail ]
Castle Howard Estate was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Hospitality. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.castlehoward.co.uk.
AB InBev
October 25, 2026
•[ ransomware, manufacturing, retail ]
AB InBev was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Agriculture and Food Production. Country: Belgium. Website: ab-inbev.be. AB InBev is the world's largest brewer, headquartered in Belgium, known for Budweiser, Corona, and Stella Artois .
We hold 329,244 AB InBev social-listening alerts, 2,510 corporate emails across all subsidiaries, 19K access logs, GBS portal records, internal PKI certificates, and 3.2GB of Azure blob assets.
Our demand is $1,000,000 in BTC. [Sector: Retail, Manufacturing]
ETO
October 25, 2026
•[ ransomware, manufacturing, technology ]
ETO was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-25. Country: Germany. Website: www.etogruppe.com.
Hossner-Textil GmbH
October 25, 2026
•[ ransomware, manufacturing ]
Hossner-Textil GmbH was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Manufacturing. Country: Germany. Website: www.hossner-textile.de.
Miletic GmbH
October 26, 2026
•[ ransomware, manufacturing ]
Miletic GmbH was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-10-26. Country: Germany. Miletic GmbH is a German specialized contractor headquartered in Bad Schnborn that has been operating in the construction sector since 1989. The company's core business focuses on construction and repair work for ecologically sensitive industrial facilities, including gas stations, tank farms, and operations governed by German water protection laws (WHG Class LAU facilities). Its service portfolio includes joint sealing and remediation, the application of chemical-resistant protective coatings, concrete construction, and related earthworks.
Seufert Construction
October 26, 2026
•[ ransomware, manufacturing ]
Seufert Construction was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: United States of America. Website: www.seufertconstruction.com.
Gamdom
October 26, 2026
•[ ransomware, financial, technology ]
Gamdom was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million.
We hold Gamdom's full user database, 15,420,003 accounts with 146 columns, with Gamdom's total combined profit value exceeding $1 billion.
The way in was something internal, a machine account that was already sitting in their admin side (Metawin).
Issued years back, nobody ever rotated it. Never meant to leave the building.
It had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores.
About your provably fair: what it promised and what it delivered were never the same thing.
We demand $15,000,000 in BTC.
Emails with instructions will be sent to you directly.
To verify, a sample can be found below.
Ingelectus Innovative Electrical Solutions S.L.
October 26, 2026
•[ ransomware, energy, technology ]
Ingelectus Innovative Electrical Solutions S.L. was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Energy & Utilities. Country: Spain. smart grid engineering firm Spain | Live electrical telemetry sampled from the plant control network, with voltage, current and energy readings recorded on 23 October 2026; Complete inventory of 49 network devices including substation switches, remote terminal units, power meters and server management controllers, with locations and firmware details; Full maps of the internal control network segments and message broker metrics that carry the plant data | [NOT PAID EXPOSED]
Morrison Cohen
October 26, 2026
•[ ransomware, finance, government ]
Morrison Cohen was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Professional Services. Country: United States of America. [AI generated] Morrison Cohen LLP is a United States law firm headquartered in New York City. It provides legal services across practice areas including corporate law, litigation, bankruptcy and restructuring, real estate, intellectual property, and white-collar defense. The firm serves corporate clients, financial institutions, and individuals. It operates within the legal services industry, primarily serving businesses in the New York metropolitan area and nationally.
Natuzzi
October 27, 2026
•[ ransomware, manufacturing ]
Natuzzi was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Manufacturing. Country: Italy. [AI generated] Natuzzi S.p.A. is an Italian manufacturer and distributor of furniture, specializing in leather and fabric upholstered sofas, chairs, and home furnishings. Founded in 1959 and headquartered in Santeramo in Colle, Italy, the company operates in the home furniture and interior design industry. Natuzzi designs, produces, and markets its products globally, selling through its own branded stores and third-party retailers across multiple countries.
GreenbergFarrow
October 27, 2026
•[ ransomware, technology, finance ]
GreenbergFarrow was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Professional Services. Website: GreenbergFarrow. [architecture] GreenbergFarrow a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada.
The dataset spans three major divisions:
Client Libraries (152 client folders, AF): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.
Corporate Library: The entire institutional memory 24 years of accounting (invoicing, cleared checks, budgets from 20022026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.
Discipline Libraries (283 GB): Complete architecture reference library.
The exposed material includes:
300650+ individuals' personal data SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package including Medicare enrollment and voicemail recording.
7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 20142023.
Complete active litigation file for GF v. Storm/RFW (1:25-cv-03532) complaint, amended complaint, answers to interrogatories, discovery requests and responses, settlement negotiations, D&O insurer correspondence, and engagement letters. The entire attorney-client privilege chain.
FBI facility clearance documents SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.
Complete acquisition records for 7 deals (5 completed + 2 in progress) including purchase prices, due diligence materials, certified financial statements, and wire instructions.
Hudson River Museum
October 27, 2026
•[ ransomware, education ]
Hudson River Museum was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Education. Country: United States of America. Website: www.hrm.org. Museums, Historical Sites, and Zoos Stolen data: 115 GB.
Kerckstede vzw
October 27, 2026
•[ ransomware, healthcare ]
Kerckstede vzw was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Other. Country: Belgium. Website: www.althus.be. Hospitals and Health Care Stolen data: 10 GB.
MicroSearch
October 27, 2026
•[ ransomware, technology ]
MicroSearch was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Technology. Website: www.microsearch.net. United States
UPDATE: UNM
October 27, 2026
•[ ransomware, education, healthcare ]
UPDATE: UNM was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Education. We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way.
Company #112
October 28, 2026
•[ ransomware, technology ]
Company #112 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-28. Country: Malaysia. telecommunications services Malaysia | [PENDING EXPOSURE: settlement window open]
EWM Group
October 28, 2026
•[ ransomware, retail, financial ]
EWM Group was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: EWM Group. [fashion] EWM Group the parent group behind Bonmarch, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains.
The exposed material includes:
503,878 loyalty programme member records full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 20002026.
~21,000 employee records salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details.
100+ GB of Outlook PST email archives complete email histories for named staff members spanning years of business operations.
313+ SQL Server database backups across 122 unique databases the entire digital brain of the retail operation.
83 GB of e-commerce transaction data every online order from January 2021 to August 2026.
Roberts Consulting Services
October 28, 2026
•[ ransomware, leak ]
Roberts Consulting Services was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Website: jsrconsulting.com. RCS is a full-service engineering firm specializing in Construction Materials Testing, Construc
tion Engineering and Inspection (CEI), and QA/QC services, founded in 2013. With over 60 years
of combined FDOT experience, RCS provides high-quality professional services to clients in road
way and bridge construction projects throughout Central Florida.
We will upload 28gb of corporate data soon. Detailed employee information (passport scans, DLs,
SSN), contracts and agreements, client information, financials, NDA, etc.
Trulife
October 28, 2026
•[ ransomware, healthcare, leak ]
Trulife was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Healthcare. Website: trulife.com. Trulife is an internationally recognized company with over 60 years of experience in the develo
pment and manufacture of specialized healthcare and consumer products. Their extensive product
range includes breastcare solutions, orthotics, lower limb prosthetics, walking aids, and press
ure care products.
We will upload 68gb of corporate data soon. Detailed employee information (passport scans, DLs,
medical certs, birth certs), contracts and agreements, confidential files (employee violations
, terminations and so on), financials, NDA, etc.
