Allmand-Smith Limited
October 21, 2026
•[ ransomware, manufacturing, finance ]
Allmand-Smith Limited was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Manufacturing. Country: United Kingdom of Great Britain and Northern Ireland. Website: Allmand-Smith Limited. [distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent.
Domain admin credentials in plaintext and a full DC dump STORMGUARD\MichaelAdmin / 5t0rmGuard
Complete NatWest banking infrastructure blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus
WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15
entities. NatWest has 3 outstanding registered charges (Jun 2026).
Full payroll for every employee, current and former Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE
history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records.
Complete financial records for 15 entities Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan,
Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds, plus the consolidated
age200_AllmandSmithLtd.bak (2.1 GB). Management accounts (JanJul 2024), nominal trial balances, bank reconciliations (102,662 cash at year-end). Revenue:
17.66M, profit: 1.01M, financial health: 12/100 (distressed).
mvjllp.com
October 21, 2026
•[ ransomware, finance ]
mvjllp.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Website: mvjllp.com.
prosomnus.com
October 21, 2026
•[ ransomware, healthcare, manufacturing ]
prosomnus.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Healthcare. Country: United States of America. Website: prosomnus.com. [AI generated] ProSomnus Inc. is a U.S.-based medical device company specializing in the design and manufacture of precision oral appliances for the treatment of obstructive sleep apnea and snoring. Operating in the healthcare and medical device industry, the company focuses on sleep medicine solutions as an alternative to CPAP therapy. ProSomnus is headquartered in California, United States, and serves dental and sleep medicine professionals.
clinicaromero.com
October 21, 2026
•[ ransomware, healthcare ]
clinicaromero.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Healthcare. Country: Argentina. Website: clinicaromero.com. [AI generated] N/A
I don't have reliable, verified information about "clinicaromero.com" to provide an accurate factual description. Rather than guess based on the name alone (which suggests it could be a medical clinic, possibly in a Spanish-speaking country), I'd be fabricating details about its operations, industry specifics, or location that I cannot confirm. If you have additional context or source material about this entity, I can help analyze that instead.
Company #106
October 22, 2026
•[ ransomware, finance ]
Company #106 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-22. Financial Advisory & Restructuring (US) Chicago, Illinois, USA | [PENDING EXPOSURE]
PWC
October 22, 2026
•[ ransomware, finance, technology ]
PWC was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. [AI generated] PwC (PricewaterhouseCoopers) is a multinational professional services network headquartered in London, United Kingdom. It is one of the "Big Four" accounting firms, offering audit and assurance, tax, consulting, and advisory services to businesses, governments, and organizations worldwide. PwC operates across numerous industries including finance, technology, healthcare, and energy, serving clients in over 150 countries globally.
Bethany Press International
October 21, 2026
•[ ransomware, leak, retail ]
Bethany Press International was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Retail & E-Commerce. Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib
ute millions of life-changing Christian books each year. They offer industry-leading publishing
services for both short-run and long-run printing and distribution.
We will upload 40gb of corporate data soon. Employee personal information (financials and so on
), customer information, financials, contracts and agreements, and so on.
Barrow & Grimm
October 22, 2026
•[ ransomware, finance ]
Barrow & Grimm was listed as a victim on the leak site of the bravox ransomware group; the attack is estimated to have taken place on 2026-10-22. Country: United States of America. Website: barrowgrimm.com. Legal Services, Business Litigation and Corporate Law.
istanbultrading.com
October 22, 2026
•[ ransomware, retail, technology ]
istanbultrading.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Retail & E-Commerce. Country: Turkey. Website: istanbultrading.com. Istanbul Foodstuff Trading Co LLC is a company that operates in the Computer Equipment & Peripherals...
SEPIVER
October 22, 2026
•[ ransomware, leak ]
SEPIVER was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-22. Country: Mexico. Website: sepiver.com.mx.
EMARKETER
October 23, 2026
•[ ransomware, technology ]
EMARKETER was listed as a victim on the leak site of the fulcrumsec ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: United States of America. [AI generated] EMARKETER is a market research and business intelligence company based in the United States, specializing in digital marketing, media, and commerce data. It provides forecasts, analysis, reports, and trends on topics like advertising, e-commerce, social media, and emerging technology. The company serves marketers, advertisers, and businesses seeking insights into consumer behavior and industry trends.
Kale Balata A
October 23, 2026
•[ ransomware, manufacturing, hack ]
Kale Balata A was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Agriculture and Food Production. Country: Turkey. Website: www.kalebalata.com.
Labaid Cancer Hospital And Super Speciality Center
October 23, 2026
•[ ransomware, healthcare ]
Labaid Cancer Hospital And Super Speciality Center was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Healthcare. Country: Bangladesh. Website: www.labaidcancer.com.
ARX Group SA
October 23, 2026
•[ ransomware, technology ]
ARX Group SA was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Other. Country: Switzerland. Website: ARX Group SA. [consultancies, engineering] ARX Group SA one of Switzerland's premier engineering consultancies, with 25+ offices in 17+ countries, known for iconic projects including the Ceneri Base Tunnel and dozens of USTRA/SBB federal infrastructure contracts.
The exposed material includes:
9,510 project fee structures with internal/external billing rates for every engineer the complete pricing intelligence for one of Switzerland's largest infrastructure consultancies.
8 GB of Ceneri Base Tunnel documentation as-built engineering records for Swiss national critical infrastructure.
881,205 time entries spanning years of daily work activity for every employee, with task descriptions and project assignments.
Conax Technologies
October 23, 2026
•[ ransomware, technology, manufacturing ]
Conax Technologies was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Technology. Country: Norway. Website: conaxtechnologies.com. conaxtechnologies.com Conax Technologies US manufacturer founded in 1952 in Buffalo, New York, producing temperature sensors like thermocouples and RTDs together with high-pressure compression seal fittings for extreme conditions. Owned by the private equity firm May River Capital, it has around 200 to 500 employees and estimated revenue of roughly 41 million dollars. Its products operate in extreme temperatures up to 2000 Fahrenheit and pressures up to 100,000 psi across aerospace, defense, semiconductor, medical and energy markets. The company runs a 101,000 square foot plant with 150 machines, holds AS9100, NADCAP and ISO certifications, and has over 45 patents with 100 million products installed worldwide. Under CEO John LeFevre since 2023 it is expanding through acquisitions such as Vulcan Electric and Sorregosa Spain plus growth in semiconductor and medical verticals.
Penco Products
October 23, 2026
•[ ransomware, manufacturing ]
Penco Products was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Manufacturing. Country: United States of America. Website: pencoproducts.com. pencoproducts.com Penco Products US metal manufacturer founded in 1869, now based in Greenville, North Carolina, making steel lockers, shelving, pallet racks and garment dispensers at its 375,000 square foot ISO certified plant in Hamilton. It is part of the IMC industrial group and has around 200 employees, up to 350 in summer peaks. Its lockers are an American standard in schools, gyms, hospitals and military facilities, with new smart locker lines for contactless pickup. Led by CEO Craig Atwater since 2021, it sells through a national distributor network with QuickShip warehouses across the country. Strengths are 157 years of brand trust, full US vertical production and diversification into school furniture.
Morrow Meadows Corporation
September 23, 2026
•[ ransomware, manufacturing, technology ]
Morrow Meadows Corporation was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-09-23. Sector: Other. Country: United States of America. Website: morrow-meadows.com. [AI generated] Morrow Meadows Corporation is a United States-based electrical contracting company. It provides electrical construction, design-build, and engineering services for commercial, industrial, institutional, and data center projects. Operating primarily in California, the company serves sectors such as technology, healthcare, education, and manufacturing, offering services including power distribution, lighting, fire alarm systems, and electrical infrastructure installation.
Arthritis Center of Riverside
October 24, 2026
•[ ransomware, healthcare, leak ]
Arthritis Center of Riverside was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Healthcare. Country: United States of America. Website: thearthritiscenter.com. rheumatology medical practice Riverside, California, United States | Scanned laboratory requisitions of named patients with dates of birth, home addresses and Medicare subscriber details, April through October 2026; Accounts receivable aging with patient names, account numbers, insurers and balances; Patient billing files and records correspondence of the practice | [NOT PAID EXPOSED]
www.optika.ca
October 24, 2026
•[ ransomware, healthcare, technology ]
www.optika.ca was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Technology. Country: Canada. Website: www.optika.ca. Optika Eye Care Center (Centre Visuel Optika Optomtristes) is a Canadian optometry and optical care clinic located in ...
www.zhservices.com
October 24, 2026
•[ ransomware, technology, healthcare ]
www.zhservices.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Professional Services. Website: www.zhservices.com. ZH Healthcare (Z & H Consultancy Services Private Limited) is an Indian health-tech platform and EMR/EHR solutions provi...
