montechiaro-store.com
June 24, 2026
•[ ransomware, leak, retail ]
montechiaro-store.com was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Retail & E-Commerce. Country: Italy. Website: montechiaro-store.com. Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/
lorenzoni-store.com
June 24, 2026
•[ ransomware, retail ]
lorenzoni-store.com was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Retail & E-Commerce. Country: Italy. Website: lorenzoni-store.com. Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/
maglificioliliana.com
June 24, 2026
•[ ransomware, leak, manufacturing ]
maglificioliliana.com was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-24. Website: maglificioliliana.com. Over 400 GB of data has been accessed and exfiltrated. This includes product designs, historical fashion lines, and technical specifications for garments. Furthermore, we have obtained customer databases from various parts of the world, financial records, commercial contracts, employee data, personal files for all staff members within the network, daily operational documents, and more.
roofdepot.com
June 25, 2026
•[ ransomware, retail, manufacturing ]
roofdepot.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-06-25. Sector: Retail & E-Commerce. Country: United States of America. Website: roofdepot.com. Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a roofing manufacturer that specializes in roof installation, repairs & replacement
Grupo Riquelme
June 13, 2026
•[ ransomware, leak, finance ]
Grupo Riquelme was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-06-13. Sector: Agriculture and Food Production. Country: Paraguay. Website: www.gruporiquelme.com. - Full Database Backup- Banking & Financial Data- Accounting & Ledger Records- Customer Databases- HR / Workforce Data- User, Role & Permission data- ERP & Critical Business Application Data
J&J Gaming
June 27, 2026
•[ ransomware, retail ]
J&J Gaming was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-06-27. Sector: Retail & E-Commerce. Country: United States of America. Website: www.jjgaming.com. United States
lifevantage.com
June 4, 2026
•[ ransomware, retail, leak ]
lifevantage.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-04. Sector: Retail & E-Commerce. Country: United States of America. Website: lifevantage.com. THE NEUTRALIZING FACTOR: How LifeVantage Corporation Profits from Hope and Buries the Truth PROLOGUE...
canopybrands.us
June 2, 2026
•[ ransomware, retail, manufacturing ]
canopybrands.us was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Retail & E-Commerce. Country: Canada. Website: canopybrands.us. Limit of Travel A holding company that sells people safety at height failed to keep its own data saf...
1-800-dentist
June 28, 2026
•[ ransomware, retail, healthcare ]
1-800-dentist was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Retail & E-Commerce. Country: United States of America. Website: www.1800dentist.com.
monoprix.tn
June 28, 2026
•[ ransomware, retail ]
monoprix.tn was listed as a victim on the leak site of the stormous ransomware group; the attack is estimated to have taken place on 2026-06-28. Sector: Retail & E-Commerce. Country: Tunisia. Website: monoprix.tn. Data description: Pending update
GDN AR(Dorinka)
June 29, 2026
•[ ransomware, retail ]
GDN AR(Dorinka) was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-06-29. Sector: Other. Country: Argentina. Dorinka S.R.L. is based in Argentina, with the head office in Cidade Autonoma De Buenos Aires. The enterprise operates in the Grocery Stores industry. Dorinka S.R.L. was incorporated on June 29, 2026. There are currently 8,000 (2024) people employed by Dorinka S.R.L..
Abans Finserv
June 29, 2026
•[ ransomware, finance, technology ]
Abans Finserv was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-29. Sector: Retail & E-Commerce. Country: India. Website: abansfinserv.com. The Abans Group is a globally diversified organization engaged in Investment Management, Trading, Broking, Gold Refining, Non-Banking Financial Services, Agricultural Trading, Software Development, and Real Estate Development.We are globally diversified organisation engaged in Financial Services, Gold Refining, Jewellery, Commodities Trading, Agricultural Trading and Warehousing, Pharmaceuticals Distribution, Software Development and Real Estate. The group is founded by young entrepreneur - Mr. Abhishek Bansal who leads a global team of over 300 people operating growing businesses from multiple locations including India, United Kingdom, Dubai, Shanghai, Hong kong, Mauritius and Singapore.Our Company represents the financial services arm of the Abans Group. We operate a diversified global financial services business, headquartered in India, providing NBFC services, multi-asset global institutional trading in equities,Since the inception of our Company in 2009-10, we have grown from being a commodities trading company into a diversified multi-asset and multi-national financial services company having varied financial services businesses which are mainly organised under:NBFC Business: We are a Non Banking Financial Company registered with RBI and having a Total Loan Book of 35,263 lakhs as on March 31, 2021.Our NBFC business is primarily focused on lending to private traders and other small and medium businesses involved in the commodities trading market.Agency Business: We are SEBI registered Stock and Commodity Exchange Brokers with memberships across all the major stock exchanges in India, including BSE, NSE, MSEI, MCX, NCDEX, ICEX and IIEL and further we have memberships in various international exchanges like DGCX (Dubai), LME (London), INE (Shanghai) and DCE (China). We are also a SEBI Registered Portfolio Management company as well as a SEBI Registered Category-I FPI and Category-III AIF. We offer various client-based institutional trading services, wealth management and private client brokerage services, mainly in equity, commodities and foreign exchange.Capital and other Business: Our Capital Business includes our internal treasury operations which manage our excess capital funds. We do so by investing our capital in what we believe to be low / medium risk strategies, maintaining positions in physical as well as exchange traded commodities and other instruments which we can liquidate economically within a specified days based on our strategy of short term or long term holding. We structure our treasury investments to maintain sufficient liquidity in our portfolio to support the capital needs of our other businesses. Further we provide Warehousing Services to commodity market participants.
Arkin Group
June 30, 2026
•[ ransomware, social, retail ]
Arkin Group was listed as a victim on the leak site of the blacknevas ransomware group; the attack is estimated to have taken place on 2026-06-30. Sector: Professional Services. Country: Turkey. Website: arkingroup.com. CYBERSECURITY: ARKIN HOTEL GROUP SUFFERS MASSIVE DATA BREACH OVER 1 TB OF GUEST AND CASINO DATA STOLENCybersecurity experts from Cyclops Threat Intelligence have reported a critical incident affecting the Arkn Group hotel chain (www.arkingroup.com), including its premium properties The Arkn Colony, The Arkn Iskele, and Arkn Palm Beach in Northern Cyprus. According to preliminary assessments, the attackers managed to exfiltrate over one terabyte of internal documents, customer databases, and transaction logs, including confidential information from the Arkn Palm Beach Casino.Attack detailsAnalysts have established that the attackers gained initial access through a compromised employee account in the reservations department. Using legitimate remote administration tools, they gradually expanded their privileges, bypassed network segmentation, and exfiltrated a dataset totalling approximately 1.4 TB. Some of the stolen information has already surfaced on underground forums and darknet marketplaces.The stolen data includes: Full guest profiles (passport details, phone numbers, addresses, stay history); Financial details of bookings and payment credentials; The internal CRM system with staff notes on VIP clients; Casino database: player IDs, deposit amounts, visit frequency, records of chip exchange transactions and fund movements; Scanned passports, compliance check forms (KYC/AML), including source-of-funds questionnaires for high rollers.Objective and likely operatorBased on the intrusion characteristics and tactics used, experts link the incident to the threat group CryptoRex (tracked since 2023), which specialises in attacking hospitality and gambling businesses in the Mediterranean region. A combination of financial extortion and data sale to multiple buyers is considered likely. So far, no official ransom demand has been received, but portions of the archives have been put up for auction with a starting price of 8 bitcoins.Potential consequences of the leakThe leakage of confidential guest and especially casino client data entails a cascade of risks that go far beyond reputational damage.1. Personal security of high-net-worth guestsThe VIP casino player database, containing passport details, habits, and financial capabilities, serves as a direct directory for kidnappers, extortionists, and organised crime groups. Affected individuals may face real threats to their physical safety, as well as targeted blackmail (e.g., threats to expose gambling activity to business partners or family members in countries where gambling is stigmatised).2. Financial fraudPayment data from hotel guests and credit/debit cards linked to casino accounts will enable unauthorised transactions. Given the high credit limits of casino patrons, the scale of potential phishing and card fraud is assessed as very significant.3. Compliance nightmare and regulatory finesAlthough the international casino operators in Northern Cyprus do not directly fall under GDPR, many guests are citizens of the EU, the UK, and CIS countries. The breach demonstrates a flagrant failure to meet personal data protection standards. Lawsuits by affected individuals in national courts and scrutiny by international payment systems (Visa, Mastercard) are possible, which could suspend acquiring services.4. Risks to the casino itself and the jurisdiction[6/9/2026 1:09 PM] ChatGPT 5 | Deepseek | Claude: The exposure of internal AML records documenting the origin of funds and possible links to politically exposed persons could spark money-laundering investigations. For Northern Cypruss gambling zone, already under close watch by the FATF, this could lead to tighter international financial monitoring and being placed on grey lists.5. Reputational ruinNo wealthy client will entrust their data to a hotel incapable of protecting basic IT infrastructure. Trust in the Arkn brand, which for decades has built an image of secluded luxury, will be undermined for years. Competitors in the elite leisure market, especially in Dubai, Monaco, and the Maldives, will immediately exploit the situation to poach wary clientele.Analysts recommendationsCyclops Threat Intelligence strongly advises all individuals who have ever stayed at Arkn hotels or visited Arkn Palm Beach Casino to: Immediately block and reissue any bank cards used; Monitor credit reports for new applications; Enable additional authentication factors on email and financial services; Be highly critical of any incoming calls or messages demanding identity confirmation or fund transfers these could be targeted attacks using contextual details from the leaked staff notes.The Arkn Group press office has not yet responded to official inquiries. The companys website remains operational, but online booking sections are temporarily unavailable. Northern Cyprus authorities stated that they are aware of the incident and have begun consultations with EU experts under a cyber-resilience programme.Report prepared by the Thomson Reuters cybersecurity desk based on the Cyclops Threat Intelligence analytical brief.
vcnyhome.com
June 2, 2026
•[ ransomware, retail, leak ]
vcnyhome.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Retail & E-Commerce. Website: vcnyhome.com. THE VCNY HOME ARCHIVE The company that sells home comfort failed to protect its own home its inter...
touredge.com
June 2, 2026
•[ ransomware, manufacturing, retail ]
touredge.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-02. Sector: Hospitality. Country: United States of America. Website: touredge.com. The Breaking Point A golf club manufacturer sells precision, durability, and control as a philosophy...
ORA Group Information
June 23, 2026
•[ ransomware, retail ]
ORA Group Information was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-06-23. Sector: Professional Services. Country: France. Website: groupe-ora.com. Specializing in retail and the point-of-sale experience
clc-tn.com
June 26, 2026
•[ ransomware, retail, manufacturing ]
clc-tn.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-06-26. Country: United States of America. Website: clc-tn.com. City Lumber Company: Building Materials in Tennessee What Lies Behind the Small Sign PROLOGUE In o...
eworldme.com
May 1, 2026
•[ ransomware, retail ]
eworldme.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Retail & E-Commerce. Country: United Arab Emirates. Website: eworldme.com.
flbgroup.com
May 1, 2026
•[ ransomware, manufacturing, retail ]
flbgroup.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-05-01. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: flbgroup.com.
Kinsmen TeleMiracle
April 9, 2026
•[ ransomware, retail, leak ]
Kinsmen TeleMiracle was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-04-09. Sector: Retail & E-Commerce. Country: Canada. Website: telemiracle.com. Charitable organization that hosts an annual telethon to raise funds for the Kinsmen Foundation
