Hirschinjurylaw
November 4, 2026
•[ ransomware, healthcare ]
Hirschinjurylaw was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Professional Services. Country: United States of America. Town Center Pharmacy is a retail pharmacy selling prescription and over-the-counter medicines. The company also handles medical billing and insurance payouts, including litigation/insurance documents.
Ulaval
November 4, 2026
•[ ransomware, healthcare, education ]
Ulaval was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Education. Country: Canada. The company is engaged in radiology and medical services, as confirmed by its name and mentions of a radiologists' association in the archive documents.
baeaqab
November 4, 2026
•[ ransomware ]
baeaqab was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04.
Jobmongers
November 4, 2026
•[ ransomware, technology ]
Jobmongers was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: jobmongers.com. Organization with 2 emails extracted. Domain: jobmongers.com
Kde
November 4, 2026
•[ ransomware, technology, manufacturing ]
Kde was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Moroccan industrial/automotive company (icn.ma) with a full in-house accounting office: general-ledger and cash-desk files, client balances, bank transfer orders (BMCE), purchase orders, staff lists, and trade documents including an overseas distribution agreement and proforma invoices for FAS Automotive (encap_maroc).
Ruixiang Jidian
November 4, 2026
•[ ransomware, manufacturing ]
Ruixiang Jidian was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Elevator manufacturer, brand Yinhai. Produces machine-room-less (MRL) passenger elevators and OEMs elevator components (car top/bottom, car wall panels, COP, doors) for OTIS, KONE, Hitachi, Toshiba, TKS. Export business (project DUBROVSKIY-2, customer Saibo). Infrastructure: Synology NAS (admin), IT dept with Epson L1118. | China, Jiangsu Province (Limin North Road)
Geetees
November 4, 2026
•[ ransomware, retail, leak ]
Geetees was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. G.Twist (Wholesale) Ltd. wholesales goods, including licensed merchandise such as Harry Potter and Christmas items. The company also tracks orders, inventory, and online sales through payment systems.
Jatl
November 4, 2026
•[ ransomware, technology, manufacturing ]
Jatl was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Jay Ace Technologies Ltd. manufactures lead-acid/storage batteries and related technology modules, including battery forming equipment, lead feeding, and hydraulic casting.
Vinitgloves
November 4, 2026
•[ ransomware, manufacturing ]
Vinitgloves was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Manufacturing. Country: India. Website: vinitgloves.com. Organization with 1029 emails extracted. Domain: vinitgloves.com
baiapai
November 4, 2026
•[ ransomware, technology ]
baiapai was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Bziers, Occitanie, France
Dian
November 4, 2026
•[ ransomware, government, finance ]
Dian was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Country: Colombia. Website: dian.gov.co. Organization with 339 emails extracted. Domain: dian.gov.co
Msn
November 4, 2026
•[ ransomware, technology ]
Msn was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Technology. Country: United States of America. Website: msn.com. Organization with 61167 emails extracted. Domain: msn.com
TFG London
October 10, 2026
•[ ransomware, retail ]
TFG London was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.tfglondon.com. BTFG London is a fashion retail group that includes several premium brands such as Hobbs, Phase Eight, Whistles, White Stuff, and Inside Story. Established in the UK market in 2015, the company has expanded its portfolio and opened its first TFG London store in December 2019. The group focuses on fashion, lifestyle, and homeware, catering to clients seeking high-quality designer products.
centratamagroup.com
November 4, 2026
•[ ransomware, technology ]
centratamagroup.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-11-04. Sector: Other. Country: Brazil. Website: centratamagroup.com. PT Centratama Telekomunikasi Indonesia, Tbk (CTI) is a leading telecommunications infrastructure pro...
J.C. Cannistraro, LLC
October 4, 2020
•[ ransomware, leak, manufacturing ]
J.C. Cannistraro discovered unusual activity in its computer network on October 4, 2020 and determined that the network had been encrypted by ransomware. The company notified personnel on October 7 and later learned that personal information had been disclosed to an unauthorized party; regulatory reporting lists 1,660 affected individuals, and a former employee later received an alert that his Social Security number was on the dark web. Avaddon listed J.C. Cannistraro on its leak site in November 2020, supporting group attribution, although the company did not publicly confirm the actor. The technical source of the stolen data is not established, so the exploitive subtype remains undetermined.
Undisclosed French business-software hosting company (Software; pseudonym)
June 24, 2021
•[ ransomware, financial, technology ]
During June 24-25, 2021, attackers encrypted files held by a French enterprise-software hosting provider and demanded ransom for decryption. The company restored hosted applications but could not recover certain data belonging to 14 customers because adequate off-site backups were absent. The case became public through reporting of a 2026 insurance judgment. Criminal/Financial is supported by the explicit ransomware demand; theft of files was not established. Software is a litigation pseudonym rather than the company's verified legal name.
Order Express, Inc.
July 29, 2022
•[ ransomware, finance, leak ]
An unauthorized actor accessed portions of Order Express's network between July 29 and September 7, 2022. Order Express discovered server connectivity problems on September 7 and shut down its network; investigators later determined that ransomware had encrypted just over half of its servers and that customer data had been accessed and exfiltrated. State breach filings identify 63,220 affected individuals. Contemporaneous public reporting attributed the incident to Cl0p, although Order Express itself described the attacker as unknown.
University of Health Sciences and Pharmacy in St. Louis
April 1, 2023
•[ ransomware, education, healthcare ]
The university's CIO/CISO dates LockBit's entry to April 1, 2023, using compromised employee credentials. About 13 days later, attackers encrypted servers and destroyed an onsite backup. They demanded US$1.25 million; the university did not pay. Stolen files were published around June 12. Cached server credentials were compromised. April 1 dates initial access, not encryption or confirmed extraction; the August 2026 interview describes a 2023 incident.
Brightly Software, Inc.
August 1, 2023
•[ insider, ransomware, technology ]
Cameron Curry, a contract data analyst, used his access to Brightly Software's payroll information and corporate data to remove sensitive files between August and December 2023. Beginning in December, he used the alias Loot to demand $2.5 million in cryptocurrency and threatened to publish the stolen information.
Southern Water
January 22, 2024
•[ ransomware, leak, technology ]
Black Basta ransomware group attacked UK water supplier Southern Water in January 2024, encrypting several IT systems and stealing customer and corporate data. The company later reported approximately 45 million in total expenses related to recovery, legal fees, and customer notification. The breach exposed nearly half a million customer records, and operations were temporarily disrupted though water services continued. Southern Water confirmed data exfiltration via its internal investigation and regulator notifications.
