Zelham
September 30, 2026
•[ ransomware, retail, leak ]
Zelham was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-30. Website: zelham.com. zelham.com rocketreach.co/zelham-inc-profile_b580fe5ef66e1a3f Zelham, Inc. is a U.S. hospitality renovation general contractor headquartered in Boise, Idaho, founded in 2000 and owned since 2023 by President & CEO Stephen Horel. The company specializes in hotel remodeling, rebranding, and ADA conversions, with 500+ completed projects and licenses in 47 states. It employs approximately 5557 people across 15 states, generating an estimated annual revenue of $9.6M$41.6M (sources vary). Zelham works with 20+ major hotel brands (Marriott, Hilton, IHG, Sonesta, Four Seasons), offering pre-construction planning, free estimates, and turnkey project management.
States Industries
October 2, 2026
•[ ransomware, manufacturing, leak ]
States Industries was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Manufacturing. Country: United States of America. Website: statesind.com. States Industries is a privately held American manufacturer specializing in premium hardwood plywood, custom wood veneer panels, prefinished panels, and specialty components. Founded in Eugene, Oregon, in 1966, the company serves woodworkers, architects, designers, cabinetmakers, furniture manufacturers, and commercial fabricators across North America. Its products include custom hardwood panels, ApplePly, NOVA prefinished panels, wall paneling, and precision-manufactured components. States Industries emphasizes innovation, quality, and environmentally responsible manufacturing, offering customizable veneer species, cores, finishes, sizes, and performance specifications. The company operates its primary manufacturing facility in Eugene and also operates DrawerBox Specialties in Orange, California. States Industries currently employs more than 300 people.
The company headquarters is located in 29545 Enid Road East, Eugene, OR 97402, United States. 201-500 Employees
Skaff Group
October 3, 2026
•[ ransomware, retail, finance ]
Skaff Group was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-03. Sector: Other. Website: skaffgroup.com. Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More
Precon Marine Inc
October 3, 2026
•[ ransomware, manufacturing ]
Precon Marine Inc was listed as a victim on the leak site of the netrunner ransomware group; the attack is estimated to have taken place on 2026-10-03. Sector: Transportation. Website: preconmarine.com. Precon Marine, Inc. is a diversified marine contractor specializing in heavy marine construction and advanced subsea services.
M****C
October 1, 2026
•[ ransomware ]
M****C was listed as a victim on the leak site of the payoutsking ransomware group; the attack is estimated to have taken place on 2026-10-01. Country: United States of America. Website: m****.com.
Mutsumi Group
October 4, 2026
•[ ransomware, manufacturing ]
Mutsumi Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Japan. Website: www.mutsumi-g.co.jp.
Emser
October 4, 2026
•[ ransomware, manufacturing ]
Emser was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Spain. Website: www.emser.es.
Chadwick Switchboards
October 4, 2026
•[ ransomware, manufacturing ]
Chadwick Switchboards was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Australia. Website: www.chadwickswitchboards.com.au.
Unident Group
October 4, 2026
•[ ransomware, leak ]
Unident Group was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Other. Country: United States of America. Website: www.unidentgroup.net.
MorseLife Health System, Inc.
October 2, 2026
•[ ransomware, healthcare ]
MorseLife Health System, Inc. was listed as a victim on the leak site of the Booba Project ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Healthcare. Country: United States of America. Website: www.morselife.org. Hospitals and Health Care Stolen data: 344 GB.
OMUR HIRDAVAT LTD
October 4, 2026
•[ ransomware, manufacturing, leak ]
OMUR HIRDAVAT LTD was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Turkey. A Turkish company engaged in the wholesale and
retail trade of construction and household fittings
The archives contain several thousand documents with
personnel and customer data [Sector: Manufacturing]
TRANS LOGROÑO SOCIEDAD ANONIMA
October 5, 2026
•[ ransomware, manufacturing ]
TRANS LOGROO SOCIEDAD ANONIMA was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: Spain. Website: translo.es. TRANS-LOGROO, S.A. is a Spanish road freight
and logistics company based in Logroo (La Rioja). It provides road haulage
(CNAE 4941), freight forwarding, and warehouse services including storage,
order picking, and tank cleaning.
Royal Selangor
October 4, 2026
•[ ransomware, manufacturing, leak ]
Royal Selangor was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: Malaysia. Website: royalselangor.com. Both, your Registered Users & Customer list have been affected. 300K Lines Total, Includes: Names, Emails, Phone Numbers, Addresses, Purchase Amount, Payment Method, Pretty Juicy stuff you don't want getting out there. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours.
Eteam
September 29, 2026
•[ ransomware, technology ]
Eteam was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Eteam was informed they had been breached, just ignored us, we are not giving any more chances, Enjoy their full BPO list EXTREME PII (some of the most sensitive shit any company has). Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you.
Millensys
October 5, 2026
•[ ransomware, technology ]
Millensys was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Technology. Country: Brazil. Website: millensys.com. Organization with 2 emails extracted. Domain: millensys.com
Cam Group LLC
October 5, 2026
•[ ransomware, leak ]
Cam Group LLC was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Other. Status: upcoming | Deadline: 2026-10-15T00:00:00Z
ENKA Schools
October 5, 2026
•[ ransomware, education ]
ENKA Schools was listed as a victim on the leak site of the Doommageddon ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Education. Country: Turkey. Website: enka.k12.tr. Status: upcoming | Deadline: 2026-10-15T00:00:00Z
ikhasas.com
October 5, 2026
•[ ransomware, manufacturing ]
ikhasas.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-05. Country: Malaysia. Website: ikhasas.com. The group was incorporated as iKHASAS Sdn. Bhd. in 2008 and subsequently expanded beyond construction into property development, hospitality, plantation,
Sheppard, Mullin, Richter & Hampton
October 5, 2026
•[ ransomware, leak, finance ]
Sheppard, Mullin, Richter & Hampton was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. They offered $4.900.000 to keep the data from being published.
Praxis EMR
September 17, 2026
•[ ransomware, healthcare, technology ]
Praxis EMR was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-09-17. Sector: Healthcare. Country: United States of America. Website: www.praxisemr.com. Praxis EMR is a highly rated EHR for physicians and medical providers, using AI to boost efficiency and accuracy. It lets clinicians document in their own words, improving usability, satisfaction, and time spent on patient care.
