World Cup 2034
October 3, 2026
•[ ransomware, leak, manufacturing ]
World Cup 2034 was listed as a victim on the leak site of the Wallstreet ransomware group; the attack is estimated to have taken place on 2026-10-03. Sector: Other. Country: Saudi Arabia. We compromised the network of the China Railway Construction Corporation
Saudi Branch / Sama Construction consortium, the MAIN CONTRACTOR building
the Jeddah Central Stadium for the FIFA World Cup 2034.
17 TB / 1.5M files exfiltrated, including:
- Main contract documents, interim payment certificates, and claims
against the owner (Jeddah Central Development Company, PIF)
- Active dispute and suspension claim records
- Personal data of 150,000+ employees, incl. Saudi employees
- IFC design documentation for the stadium
- Supplier and subcontractor commercial data (bid tabulations)
daralteb.com
October 4, 2026
•[ ransomware, healthcare, leak ]
daralteb.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Healthcare. Country: Iran. Website: daralteb.com. Dar Al-Tib is one of Egypt's and the Middle East's first and leading centers specializing in infertility treatment and a...
euroditel.com
October 4, 2026
•[ ransomware, technology ]
euroditel.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Technology. Country: France. Website: euroditel.com. Groupe Euroditel is a French telecommunications and IT systems integrator founded in 1966, headquartered in Bagneux, l...
Nipigon District Memorial Hospital
October 4, 2026
•[ ransomware, healthcare ]
Nipigon District Memorial Hospital was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Healthcare. Country: Canada. Nipigon District Memorial Hospital offers a range of healthcare services including diagnostic imaging, lab services, physiotherapy, and an assisted living program. The hospital aims to serve patients and residents in the Nipigon district, focusing on community health and well-being. They also provide specialized services such as Ontario Telemedicine Services and Meals on Wheels. The hospital is committed to strategic planning for future healthcare needs, as outlined in their CARE 2030 initiative.
The company headquarters is located in 125 Hogan Road, Nipigon, ON P0T 2J0, Canada. 51-200 Employees
Silicon Valley Glass
October 4, 2026
•[ ransomware, manufacturing ]
Silicon Valley Glass was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-04. Sector: Manufacturing. Country: United States of America. Website: www.siliconvalleyglass.com. United States
Grupo Industrial Tauro
October 5, 2026
•[ ransomware, manufacturing ]
Grupo Industrial Tauro was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Manufacturing. Country: Mexico. Website: grupotauro.com. is a Mexican steel-products manufacturer based in Monterrey (Nuevo Len): perimeter protection and mesh (brands Euroreja, Reja Tauro, Tauro, Serpentina), high-security/anti-glare mesh, razor coil, industrial railings and bollards;
Thomas Y. Pickett & Co., Inc.
October 5, 2026
•[ ransomware, technology, finance ]
Thomas Y. Pickett & Co., Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. Website: typco.com. [consulting] Thomas Y. Pickett & Co., Inc. founded in 1926, headquartered in Addison/Dallas, Texas is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation.
Inventory:
13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials
Complete HR records for all 40+ employees Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices
11 GB Azure DevOps repository the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices
200+ client contracts with pricing for every county appraisal district they serve the competitive intelligence gold mine
Complete financial records bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025
A developer's password exposed in a directory name visible to anyone who looks at the file listing
A PKCS#12 digital signing certificate (private key) for an HR manager enabling document forgery
PANCARIBBEAN LOGISTICS GROUP
October 5, 2026
•[ ransomware, financial ]
PANCARIBBEAN LOGISTICS GROUP was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Transportation. Country: Trinidad & Tobago. Panamanian logistics company operating
in the field of international cargo transportation.
Financial documents, personal and customer data. [Sector: Transportation]
Rueegseggerag
October 5, 2026
•[ ransomware, manufacturing ]
Rueegseggerag was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-10-05. Country: Switzerland. Website: rueegseggerag.ch. Organization with 1 emails extracted. Domain: rueegseggerag.ch
bwi-bau.de
October 5, 2026
•[ ransomware, leak, technology ]
bwi-bau.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: Germany. Website: bwi-bau.de. The organization was established in October 1964 as a subsidiary of the Construction Industry Association of North Rhine-Westphalia. It originally
JPS Health Network
September 5, 2026
•[ ransomware, healthcare ]
JPS Health Network was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Healthcare. Country: United States of America. Website: www.jpshealthnet.org. John Peter Smith Hospital, JPS Surgical Center - Arlington, a network of community-based health centers, school-based health centers and psychiatric services at Trinity Springs Pavilion - a stand-alone facility.
Gen3
September 5, 2026
•[ ransomware, manufacturing ]
Gen3 was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Other. Country: United States of America. Website: www.gen3construction.com. Gen3 CO is a leading subcontractor specializing in the installation of various exterior wall systems, including composite wall panels, foam insulated panels, and metal roofing. With a strong portfolio in the Rocky Mountain and Southwest regions, Gen3 serves owners, architects, and contractors by delivering high-quality installation services. Their product offerings include aluminum composite materials, Centria metal panels, and single skin metal wall panels. Gen3 is recognized for its commitment to quality and professionalism in every construction project.
Global Security Concepts
October 5, 2026
•[ ransomware, technology ]
Global Security Concepts was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Professional Services. Country: United States of America. Website: www.gscsecurity.com.
M** A******* G********** O******* a** P***** S****** A*********
October 5, 2026
•[ ransomware, technology, government ]
M** A******* G********** O******* a** P***** S****** A********* was listed as a victim on the leak site of the netrunner ransomware group; the attack is estimated to have taken place on 2026-10-05. Country: United States of America. Website: w**.m******.c**.
J&D Financial
October 6, 2026
•[ ransomware, finance ]
J&D Financial was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Financial Services. Website: www.jdfinancial.com.
CORBY ROCK MILL
October 6, 2026
•[ ransomware, manufacturing ]
CORBY ROCK MILL was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Ireland. Website: www.corbyrock.ie.
Michael K Shelby, CPA
October 6, 2026
•[ ransomware, finance, leak ]
Michael K Shelby, CPA was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services. Website: mkshelbycpa.com. Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi
ve range of tax and accounting services. They provide individual tax preparation, estate and tr
ust tax services, and business tax services, ensuring clients meet their tax obligations effici
ently.
We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs
, payment information), projects, client internal information and so on.
Kennametal
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
Morcon Developments
October 6, 2026
•[ ransomware, leak ]
Morcon Developments was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. [AI generated] N/A
I don't have reliable, verified information about a specific company called "Morcon Developments." Rather than provide potentially fabricated details about its operations, industry, or country of operation, I'm flagging this as unknown. If you have additional context (location, sector, website, or related entities), I can help you analyze or verify that information.
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi
October 6, 2026
•[ ransomware, manufacturing ]
Ciftay Insaat Taahhut Ve Ticaret Anonim Sirketi was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Turkey. Website: www.ciftay.com.tr.