GlobalNet LCL (port agency operations)
October 12, 2026
•[ ransomware, leak ]
GlobalNet LCL (port agency operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Indonesia. Port agency / logistics Indonesia | Container gate movement and damage management records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
DFK Group
October 13, 2026
•[ ransomware, finance ]
DFK Group was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Professional Services. Country: Germany. Website: www.dfkgroup.de. Germany
The Buckner Company, Inc.
October 13, 2026
•[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
PG Group (Pure Options)
October 13, 2026
•[ ransomware, finance, retail ]
PG Group (Pure Options) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Financial Services. cannabis operator (US) Lansing, Michigan, USA | Complete directory database of a Michigan cannabis operator: password data for all 577 accounts; Working password corpus for dozens of staff and administrator accounts; Financial and contract backups: payroll reports, general ledgers, signed operating and lease agreements; Complete inventory of the shared data volume | [NOT PAID EXPOSED]
Wolf & Sofsky GmbH
December 10, 2025
•[ ransomware, manufacturing ]
Wolf & Sofsky GmbH was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-12-10. Sector: Manufacturing. Country: Germany. Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrcken, Germany. The company operates on highly complex projects and maintains a significant financial position.
Critical Information We Possess
Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company.
Commercial Information: Contracts with clients, commercial offers, contract terms these form the foundation of Wolf & Sofsky's competitive advantage.
Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation.
Technical Assets: Technical plans, project drawings, architectural solutions the company's unique intellectual property.
Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects.
Excess Baggage
October 5, 2026
•[ ransomware, leak ]
Excess Baggage was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.excess-baggage.com. Baggage Express is a dynamic national and international excess baggage shipping company with a heritage stretching back some 25 years. We're dedicated to the task of moving the holdalls, cartons, computers, bikes, luggage and material lives of students, backpackers, expats and anyone else who has found themselves in the UK needing their belongings sent elsewhere. Flexibility is the key to the company's success, tailoring the company's baggage shipping services to the specific individual needs of the company's customers.
Watermark Retirement Communities
August 24, 2026
•[ ransomware, healthcare, leak ]
Watermark Retirement Communities was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-24. Sector: Healthcare. Country: United States of America. Website: watermarkcommunities.com. [AI generated] Watermark Retirement Communities is a U.S.-based senior living company that develops, manages, and operates retirement communities offering independent living, assisted living, memory care, and skilled nursing services. Headquartered in Tucson, Arizona, it operates numerous communities across the United States. The company belongs to the senior care and hospitality-adjacent real estate industry, focusing on resident-centered lifestyle programming and care.
Merrill Iron & Steel
August 13, 2026
•[ ransomware, manufacturing ]
Merrill Iron & Steel was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-08-13. Sector: Manufacturing. Country: United States of America. Website: merrillsteel.com.
Palma
October 6, 2026
•[ ransomware, manufacturing, leak ]
Palma was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: palmainc.com. palmainc.com zoominfo.com/c/palma-inc/344828237 Palma, Inc. is a private, family-owned epoxy flooring manufacturer and installer founded in 1927 in Whippany, New Jersey now in its third generation (CEO Fred Palma III). It generates estimated annual revenue of $2542M with only ~1015 direct employees (heavy use of subcontractors), completing millions of square feet of industrial flooring over 99 years. The company is a rare single-source formulator/applicator it develops its own products (PalmaLite, PaliKrete, PaliFlake) and installs them, with every square meter personally approved by a family member. Its average project size is $15.3M (Procore data: 122 projects, 76 active simultaneously), serving auto dealerships, jails, hospitals, chemical plants, and government facilities across the U.S. and Canada. Key differentiators: 5-year industry-leading warranty, no membrane required (3040% cost savings), and full ASTM C722-89 compliance. The company's name "A Palma, Manton, Palma Co
The Law Office of James R Walsh
October 6, 2026
•[ ransomware, leak ]
The Law Office of James R Walsh was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Country: United States of America. Website: jrwalshlaw.com. jrwalshlaw.com The Law Office of James R. Walsh is a small plaintiff-side law firm in Lynnwood, WA (north of Seattle), specializing in workers' compensation (L&I claims), personal injury, maritime, and Social Security cases. Founder James R. Walsh (admitted 1981) has practiced for 44+ years and was named to "Top Attorneys of North America 2015-16." The firm fights for injured workers against Washington's Dept. of Labor & Industries and self-insured employers, with published precedents including Elliott v. L&I (2009) and ITT Rayonier v. Dalman (1992). It acts as a talent incubator attorney Joshua L. Hughes (UW Law, JD with honors) rose from paralegal (2017) to attorney (2022), following the path of earlier associates.
Potomac Animal Hospital
October 6, 2026
•[ ransomware, healthcare ]
Potomac Animal Hospital was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Healthcare. Country: United States of America. Website: potomacanimalhospital.com. potomacanimalhospital.com zoominfo.com/c/potomac-animal-hospital/183255483 Potomac Animal Hospital is a family-owned, full-service small animal medical and surgical facility at 10020 River Road in Potomac, Maryland, an affluent Washington, DC suburb, founded in 1973 and led since 1983 by Air Force veteran Dr. Michael Scott (CSU DVM 1969; former officer in charge of the Europe Military Working Dog Referral Center in Ramstein). His son Dr. Jason Scott joined in 1999 hooded at graduation by his father exactly 30 years to the day after his own and now leads a team including Dr. Sarah Orloff (2021) and Dr. Kimber Wagner (2025); Dr. Michael retired in 2018 but remains owner. Beyond medicine (wellness exams, international health certificates, laser surgery, dentistry with digital oral radiography, in-house lab), the hospital runs a separate boarding kennel ($42.50$72.50/night, dogs exercised every 23 hours, VIP suites) and a grooming salon all powered through outages by an industria
Machine sro
October 6, 2026
•[ ransomware, manufacturing, automotive ]
Machine sro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Czechia. Website: k2machine.cz. k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~2550 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~4M), though 2024 saw a sharp 18.7% revenue decline (operating revenue 27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtn campus (since 2020).
University of Buraimi
October 6, 2026
•[ ransomware, education ]
University of Buraimi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Education. Country: Oman. Website: uob.edu.om. uob.edu.om zoominfo.com/c/university-of-buraimi/464061196 University of Buraimi (UOB) is a private higher education institution founded in 2016 (originally College of Banking & Financial Studies, upgraded to university status in 2024) in Buraimi, Oman, just 5 minutes from the UAE border (Al Ain). Licensed by Oman's Ministry of Higher Education (MOHERI), it operates 4 faculties (Computing & IT, Engineering, Business, Health Sciences) with 11 departments offering programs in AI, cybersecurity, civil/electrical/mechanical engineering, nursing, architecture, business, and MBA. It serves ~5001,500 students from 40+ countries (3040% international) with ~5082 staff (PhD-holders from UK, USA, Canada, Malaysia). Tuition runs ~$6,00012,000/year with extensive scholarships. The university follows a US academic model, earned a spot in UI GreenMetric World Rankings 2025 (289th for sustainability), and is currently undergoing OAAA accreditation. Led by Chancellor HE Sheikh Saif Al-Mamari
Refako Autodele
October 6, 2026
•[ ransomware, manufacturing, retail ]
Refako Autodele was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Denmark. Website: refako.dk. refako.dk REFAKO ApS (Refako Autodele) is a Danish family-owned truck and trailer parts retailer founded in 1975 in Odense, Denmark, celebrating its 50th anniversary in 2025. It operates 13 stores nationwide with 200,000+ SKUs (290,000 for B2B) and employs 5970+ people. Annual gross profit is ~2627M DKK (~$3.7M), but the company has been loss-making for 6 consecutive years (20202025), with equity saved by owner injections (16.3M DKK in 2025) after hitting a crisis low of 2.7M in 2022. It turned operationally profitable in 2024 (+0.46M DKK) under new sole owner Klaus Allan Jrgensen (KJ Holding took 100% in May 2024), but slipped back into losses in 2025. Refako is Denmark's only authorized SAF-Holland partner (global leader in trailer axles/suspension) and carries premium brands like WABCO, Knorr-Bremse, JOST, Dinex, and Exide. Customer reputation is excellent Trustpilot 4.8/5 from 2,695 reviews with same-day shipping and 30-minute Click & Collect across its store network.
Kooltronic
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kooltronic was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: kooltronic.com. kooltronic.com Kooltronic, Inc. is a private, family-owned manufacturer of enclosure cooling products (air conditioners, heat exchangers, fans) founded in 1956 in Princeton, NJ, now based in Pennington, NJ on a 170,000 sq ft facility powered by 90% solar energy. Owned by the Freedman family since 1970 (President: Barry Freedman), the company generates estimated annual revenue of $3545M with 5887 employees (~$650K$750K revenue per employee very high for a manufacturer). Kooltronic invented the world's first closed-loop enclosure air conditioner in 1967 and holds a US patent for Hazardous Location AC systems (NEC Class I Div 1&2), giving it a unique market niche. It offers the industry's widest range 2,00030,000 BTU/H units across all NEMA ratings with 100% in-house production, UL-certified testing labs, and ISO 9001:2015 certification. The company is women-owned (WBE) (CEO Anne Freedman), holds $20.5M in 401(k) assets (stable finances), and is expanding into fast-growing BESS
Smart Value
October 6, 2026
•[ ransomware, retail, leak ]
Smart Value was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Retail & E-Commerce. Country: Belize. Website: smartvalue.biz. smartvalue.biz zoominfo.com/c/smart-value/408286294 Smart Value Limited is an Indian MLM (multi-level marketing) / network marketing company founded in 20032004 in New Delhi by Manoj Kumar Gupta, operating 100+ offices across India with a claimed 2,000,000+ distributors (IBAs). The company sells health supplements, personal care, household products, and educational courses but revenue is not publicly disclosed (private MLM). Its core business model relies on recruiting new distributors rather than actual retail sales, with heavily inflated product pricing (200500% above market) to fund multi-level commissions. The company faces serious and widespread allegations: consumer complaints about pyramid-like structure, inability to recover investments, fake income claims on social media, and reported law enforcement scrutiny in India. ~99% of participants lose money (standard MLM economics), while only top recruitment leaders profit. Despite 20+ years of operation and membership in Indian
TGN
October 6, 2026
•[ ransomware, energy ]
TGN was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Country: Argentina. Website: tgn.com.ar. tgn.com.ar zoominfo.com/c/transportadora-de-gas-del-norte/372392284 Transportadora de Gas del Norte (TGN) is Argentina's largest natural gas transporter, publicly traded on BYMA (TGNO4), founded in 1992 and operating 11,317 km of pipelines and 22 compressor stations across 17 provinces. It moves 40% of all natural gas in Argentina's pipeline system (~20% of the national energy matrix) and is the only operator connecting Argentina to Chile, Brazil, Bolivia, and Uruguay. FY2025 revenue was ~$483M (AR$600.6B, +20%), EBITDA ~$260M (55% margin), and net income surged +351% to ~$176M, driven by tariff reforms and Vaca Muerta export growth. The company has virtually zero debt (Debt/EBITDA 0.2x), $250M cash, and pays record dividends of AR$577/share (~10% yield), with a AA-(arg) credit rating (Fitch, positive outlook). It employs 6001,153 people, is controlled by Gasinvest (56%) a Techint/Tecpetrol + CGC/Eurnekian joint venture and was named a Great Place to Work Top-25 in Argentina 2025
Aquatech
October 6, 2026
•[ ransomware, energy, technology ]
Aquatech was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Energy & Utilities. Country: United States of America. Website: aquatech.com. aquatech.com zoominfo.com/c/aquatech-international-llc/2523742 Aquatech International Corporation is a private water treatment technology company founded in 1981 and headquartered in Canonsburg, Pennsylvania, with operations in 26 countries and 1,000+ projects across 60+ countries. It generates estimated annual revenue of $105165M and employs 9001,368 people globally (growing +31% per year). Aquatech is the world's leading Zero Liquid Discharge (ZLD) provider (160+ installations) and a major desalination player its Corpus Christi, Texas plant (30 MGD) will be the third-largest SWRO facility in the Americas. The company won the prestigious "Water Technology Company of the Year 2025" (Global Water Awards) and acquired three companies in 2025 (Century Water, Koch Li-Pro DLE, FTS H2O) to dominate lithium extraction (PEARL platform) and ultrapure water for semiconductors. Led by CEO Devesh Sharma and President/CTO Ravi Chidambaran, with a private equity investor entering in 2025.
fleetworksinc.com
October 9, 2026
•[ ransomware, manufacturing ]
fleetworksinc.com was listed as a victim on the leak site of the threeam ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Transportation. Country: United States of America. Website: fleetworksinc.com. Fleetworks Inc. offers comprehensive heavy-duty truck repair and fleet services across California, with locations in Oakland, Santa Fe Springs, and Riverside. Their skilled team specializes in a wide range of services including diesel repair, flee
Supreme Energy
October 9, 2026
•[ ransomware, energy ]
Supreme Energy was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Energy & Utilities. Country: Indonesia. Supreme Energy is an Indonesian renewable-energy company that develops geothermal power projects to generate clean electricity.
