Moonlight Basin
October 5, 2025
•[ ransomware, retail, financial ]
Moonlight Basin was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2025-10-05. Sector: Hospitality. Country: United States of America. Website: moonlightbasin.com. Moonlight Basin offers the best snow conditions in Montana, first
class rental lodging and vacation homes, fine dining, spa servic
es, and easy access to attractions such as Yellowstone National P
ark and seasonal activities such as fishing, horseback riding, hi
king, and rafting, Moonlight Basin is also known for providing an
extraordinary level of guest service.
We will upload 17gb of corporate documents soon. A bit of client
and employee data, lots of internal reports, contracts and agreem
ents, accounting and financial documents, NDA, etc.
Mango's Tropical Cafe
November 4, 2025
•[ ransomware, retail ]
Mango's Tropical Cafe was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-04. Sector: Hospitality. Country: United States of America. Website: www.mangos.com.
José Guma S.A.
October 16, 2025
•[ ransomware, manufacturing, retail ]
Jos Guma S.A. was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2025-10-16. Sector: Agriculture and Food Production. Country: Spain. Website: joseguma.com. Jos Guma S.A.
Occupation: production of household chemicals and hygiene products (soap, cleaning products) + contract manufacturing for third-party brands.
Location: Colonia Caroya, Cordoba Province, Argentina.
Legal address / factory / site: Lot 1, Malabrigo (Lot 1, Barrio Malabrigo, Cordoba) part of the company's infrastructure.
Structure: one of the heads/President is Jorge Alfredo Gleria.
Membership in sustainable initiatives: for example, they are a member of the RSPO (Organization for Sustainable Palm Oil Production).
Thalheimer Brothers
November 6, 2025
•[ ransomware, retail ]
Thalheimer Brothers was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Retail & E-Commerce. Country: United States of America. Website: www.thalheimerbrothers.com.
sf.walltopia.com
November 6, 2025
•[ ransomware, retail ]
sf.walltopia.com was listed as a victim on the leak site of the warlock ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Retail & E-Commerce. Country: United States of America. Website: sf.walltopia.com.
metro.local
November 1, 2025
•[ ransomware, retail ]
metro.local was listed as a victim on the leak site of the warlock ransomware group; the attack is estimated to have taken place on 2025-11-01. Website: metro.local.
UScraft
November 6, 2025
•[ ransomware, retail ]
UScraft was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Retail & E-Commerce. Country: United States of America. Website: www.uscraft.com.
PCB Uitvaartzorg
November 6, 2025
•[ ransomware, retail ]
PCB Uitvaartzorg was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Retail & E-Commerce. Country: Belgium. Website: www.pcbuitvaartzorg.nl.
www.marjane.ma
November 6, 2025
•[ ransomware, retail, hack ]
www.marjane.ma was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2025-11-06. Sector: Retail & E-Commerce. Country: Morocco. Website: www.marjane.ma. Marjane Group is a Moroccan retail group that owns the Marjane hypermarkets and Marjane Market supermarkets. Founded in 1990, Marjane has gradually become the largest retail company in Morocco
Oscars Group
November 5, 2025
•[ ransomware, retail ]
Oscars Group was listed as a victim on the leak site of the medusa ransomware group; the attack is estimated to have taken place on 2025-11-05. Sector: Hospitality. Country: Australia. Website: oscarsgroup.com.au. Ransom demand: 100000. Oscars Group is a prominent hospitality collective in New South Wales, founded in 1986 by the Gravanis brothers. The group manages an extensive portfolio of over 35 venues, including pubs, hotels, accommodation, and events centers, catering to a diverse clientele. Their offerings span various segments such as gaming, retail liquor, and residential developments. With a focus on creativity and entertainment, Oscars Group aims to deliver exceptional experiences to guests across its venues.
company is headquartered in Level 6, Bayside Tower, 376 Bay Street, Brighton-Le-Sands NSW 2216, Australia.
<25 Employees
Simon Property Group
October 28, 2025
•[ ransomware, finance, retail ]
Simon Property Group was listed as a victim on the leak site of the medusa ransomware group; the attack is estimated to have taken place on 2025-10-28. Sector: Financial Services. Country: United States of America. Website: simon.com. Ransom demand: 1200000. Simon Property Group is a leading real estate investment trust (REIT) based in Indianapolis, Indiana. Founded in 1993, it owns, develops, and manages premier shopping malls, outlets, and lifestyle centers across the United States and internationally. The companys well-known properties include Premium Outlets and The Mills centers. Led by CEO David E. Simon, it focuses on creating high-quality retail and entertainment destinations that attract millions of visitors each year. Despite challenges from online retail, Simon Property Group continues to innovate by combining shopping, dining, and mixed-use spaces, maintaining its position as a global leader in retail real estate.
company is headquartered in 225 West Washington Street, Indianapolis, Indiana 46204, USA.
3,000 employees
Gadge USA
November 8, 2025
•[ ransomware, retail ]
Gadge USA was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2025-11-08. Sector: Retail & E-Commerce. Country: United States of America. Website: www.gadgeusa.com.
[EVIDENCE PACK 2]ASKUL
October 19, 2025
•[ ransomware, retail, technology ]
[EVIDENCE PACK 2]ASKUL was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2025-10-19. Sector: Retail & E-Commerce. Country: Japan. Website: www.askul.co.jp. ASKUL Corporation, founded in 1963 and headquartered in Tokyo, is a leading Japanese e-commerce company serving both businesses (B2B) and consumers (B2C). It offers office supplies, daily goods, medical products, and logistics services through platforms such as ASKUL, SOLOEL ARENA, and LOHACO. The company operates its own distribution centers, ensuring fast delivery and efficient supply chain management. ASKUL also provides additional services like printing, office design, and digital business solutions. The company emphasizes sustainability, digital transformation, and recycling initiatives.
Vascara, Vietnam
November 11, 2025
•[ ransomware, retail ]
Vascara, Vietnam was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2025-11-11. Sector: Retail & E-Commerce. Country: Vietnam. Website: vascara.com. Data size claimed by the group: 30 GB. Vascara, Vietnam
Vennerhus Weine AG
October 20, 2025
•[ ransomware, retail ]
Vennerhus Weine AG was listed as a victim on the leak site of the ransomhouse ransomware group; the attack is estimated to have taken place on 2025-10-20. Sector: Retail & E-Commerce. Country: Switzerland. Website: www.vennerhus.ch. Vennerhus Weine AG is a Swiss wine company based in Grosshchstetten, Canton of Bern. Founded in 1994, the company specializes in the import, trade, and distribution of high-quality wines. In addition to wine sales, Vennerhus offers professional wine tastings, courses, and events designed for both private clients and corporate customers.
KohaFoods Hawaii
November 12, 2025
•[ ransomware, retail ]
KohaFoods Hawaii was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2025-11-12. Sector: Agriculture and Food Production. Country: United States of America. Website: kohaspecialtyfoods.com. Koha Foods is a Honolulu-based distributor and wholesaler specializing in Asian food products. The company boasts a diverse selection of over 2,500 items including seafood, condiments, and Korean dishes, catering primarily to local Oahu businesses such as restaurants and supermarkets. Having served Hawaii since 1970, Koha Foods emphasizes quality and connection with the community through its offerings. In addition to distribution, they manufacture their own signature Korean food items using authentic recipes and high-quality ingredients.
libertyshoes, Inc
November 13, 2025
•[ ransomware, retail, hack ]
libertyshoes, Inc was listed as a victim on the leak site of the blackshrantac ransomware group; the attack is estimated to have taken place on 2025-11-13. Sector: Retail & E-Commerce. Country: India. Website: libertyfootfashion.com.
Coral
November 13, 2025
•[ ransomware, retail ]
Coral was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2025-11-13. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: coral.co.uk. [AI generated] Coral is a renowned UK-based betting and gaming company offering a wide range of services including sports betting, casino games, bingo, poker, and more. The company operates both online and via an extensive network of betting shops. Coral is part of the Entain Group, one of the largest sports betting and gaming groups in the world.
FullBeauty Brands
November 13, 2025
•[ ransomware, leak, retail ]
FullBeauty Brands was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2025-11-13. Sector: Retail & E-Commerce. Country: United States of America. Website: fbbrands.com. [AI generated] FullBeauty Brands is a US-based plus-size women's and men's apparel and home goods company. The company operates multiple brands such as Woman Within, Roaman's, Jessica London, Ellos, Swimsuits For All, KingSize, and BrylaneHome. It is committed to providing stylish, high-quality products in sizes that are traditionally hard to find.
GARDENOFLIFE.COM
November 13, 2025
•[ ransomware, retail ]
GARDENOFLIFE.COM was listed as a victim on the leak site of the clop ransomware group; the attack is estimated to have taken place on 2025-11-13. Sector: Retail & E-Commerce. Country: United States of America. Website: GARDENOFLIFE.COM. [AI generated] Garden of Life is a health and wellness company that produces a wide variety of nutritional supplements. The company's product line includes vitamins, probiotics, protein powders and bars, and more, all made using responsibly sourced, non-GMO, and organic ingredients. They focus on offering products that are traceable, pure, and high quality for a healthy lifestyle.
