Jinny Beauty Supply
September 7, 2026
•[ ransomware, retail, technology ]
Jinny Beauty Supply was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: United States of America. Website: Jinny Beauty Supply. [distributors] Jinny Beauty Supply is one of the largest Korean-American wholesale beauty distributors in the US, operating 9 distribution centers from Doraville, Georgia to Commerce, California. They serve 7,400+ beauty supply stores and 2,800+ international distributors.
The exposed material includes:
A complete password vault export 50+ plaintext credentials for PayPal, Braintree, Amazon Seller Central, eBay, Acumatica ERP (production), 12 state tax portals, FedEx, UPS, ShipStation, Microsoft 365, Google Analytics, and internal email.
VMware hypervisor root credentials vCenter and ESXi root passwords giving complete control over the entire virtual infrastructure.
911 scanned credit card authorization forms full card numbers, CVV, expiry dates, and cardholder signatures for beauty supply store customers across 26 US states.
Complete employee compensation database ~260 employees with Korean and English names, departments, salaries, bonuses, and 1099 contractor data spanning 20152018.
A 340 MB Shopify database backup full customer table (names, emails, phones, addresses), product catalog, pricing, and warehouse assignments.
Active Directory domain enumeration all 239+ user accounts including 17 admin accounts, the complete server topology across 7 geographic sites (50+ servers), and DPAPI-encrypted RDP passwords.
Employee tax documents W-4 forms (SSN), I-9 forms (SSN + DOB + citizenship), direct deposit forms (bank account and routing numbers).
3.6 GB of SQL Server database backups e-commerce customer/order/product data spanning November 2019 to March 2020.
Rug & Home
September 7, 2026
•[ ransomware, retail, financial ]
Rug & Home was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: United States of America. Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customersfull names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scanssigned delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More
United Group
September 7, 2026
•[ ransomware, manufacturing, retail ]
United Group was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: India. Website: united-group.in. United Group is a diversified Indian business group delivering innovative products and services across multiple industries. Founded in 2003, the company began as a food and beverage consultancy and has since expanded into food ingredients, nutraceuticals, industrial machinery, infrastructure, fashion, digital branding, packaging, and automotive accessories. With a strong focus on quality, innovation, and customer satisfaction, United Group operates through a network of specialized businesses, serving clients across India and international markets. Backed by certified manufacturing facilities and experienced professionals, the group is committed to providing reliable, sustainable, and value-driven solutions that support business growth and long-term success.
Superstore
September 7, 2026
•[ ransomware, leak, retail ]
Superstore was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Georgia. Website: superstore.ge. superstore.ge zoominfo.com/c/super-toys/430496236 We have Emails,passwords,passports,driving licenses,dates/places of birth,client bank names,tax IDs,client cards,phones, addresses Superstore Georgia's first zero-waste supermarket, founded in 2020 in Tbilisi by a couple inspired by European bulk shops. Its model: ~500 SKUs sold loose, without packaging grains, nuts, spices, coffee, tea, honey, dried fruit, oils, pasta, detergents, cosmetics with customers bringing their own containers, weighing goods and paying by weight ("Shop without packaging"). Categories span food (grains & baking, nuts & dried fruit, spices & tea) and refill liquids (oils, vinegar, honey, detergents, shampoo) plus compostable eco-goods. A small, low-profile pioneer eco-retailer with a minimal digital footprint public data on owners and revenue is scarce, so verify current status. Bottom line: a niche manifesto-store that made package-free shopping a lifestyle in Georgia.
El Carriel
September 7, 2026
•[ ransomware, retail, manufacturing ]
El Carriel was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Agriculture and Food Production. Country: Colombia. Website: elcarriel.com.co. elcarriel.com.co Productos Alimenticios El Carriel S.A.S. Colombian family food company and dominant leader of Bogot's arepa market (~70% share) founded Aug 17, 1992 by two brothers from Sonson, Antioquia (Luis Alberto & Luis Alfonso Valencia) and their wives, who started selling handmade arepas from bicycles via a consignment model. Today: 9 plants in Bogot & Medelln, 1M+ arepas/day, full vertical integration 2,000 ha of own corn (Pioneer seeds), own mill, 400+ employees, ~$8M revenue (31.3B COP, 2023), no external investors. Exporter to the US (since 1999), Australia and England; state-recognized ESG model: 578 solar panels, 30% electric fleet. Tragedy: Nov 2024 co-founder Luis Alfonso was murdered at his ranch by an insider who had spent 2 months profiling the property; both killers got 36 years in 2025, and the business never stopped. Bottom line: two uneducated brothers on bicycles became a vertically integrated agro-industrial champion that survived even its founder's
AbacoViaggi
September 7, 2026
•[ ransomware, leak, retail ]
AbacoViaggi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Hospitality. Country: Italy. Website: abacoviaggi.it. abacoviaggi.it zoominfo.com/c/abacoviaggi-srl/467818111 We have downloaded abacoviaggi company's data: Confidential personal data and customer information, Financial Documents and Accounting, Business correspondence and legal documents, e-mails, IT infrastructure information, Accesses and credentials. Abaco Viaggi family-run travel agency and tour operator founded in 1997 in Bologna by Alberto Scipione (P.IVA 02686751203), part of the Gruppo Abaco ecosystem (Viaggi + Meeting & Incentive + Servizi). Its signature niche: senior/third-age group travel packages for 60+ travelers (slow pace, medical support, no-surprise pricing), plus the trademark move of chartering entire trains for group excursions across Emilia-Romagna.
Biotipo Jeans
September 7, 2026
•[ ransomware, retail, manufacturing ]
Biotipo Jeans was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Brazil. Website: biotipo.com.br. biotipo.com.br zoominfo.com/c/biotipo-jeans/431018059 Biotipo Brazil's largest ready-stock ("pronta-entrega") jeans manufacturers an Akkari-family company (Confeces Alta Moda Ltda, CNPJ 04.273.385/0001-11) founded in 2001, with the brand active in jeanswear since 1980, HQ'd in the legendary Brs wholesale district of So Paulo plus an industrial plant in Itapevi. Its model: B2B wholesale at fashion-week speed weekly collections, minimum orders of just one "grade" (1012 pieces), 15,000+ m of production/logistics space (70% outsourced), and distribution to 15,000+ retail points across Brazil (women's, men's, teen and plus-size lines). 10+ consecutive years in Top of Mind as one of Brazil's most-remembered jeans brands; R$30M+ share capital, 1,0015,000 employees by registry classification. Bottom line: the quiet volume king of Brazilian denim no D2C glamour, just industrial speed, perfect fit and a brand that "sells itself" in more stores than almost any local competitor.
Metro
September 7, 2026
•[ ransomware, retail ]
Metro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Germany. Website: metro.net. metro.net zoominfo.com/c/metro/351518795 LA Metro is the Los Angeles County Metropolitan Transportation Authority (LACMTA) the second-busiest transit system in the US, serving 9.6M residents across 1,433 sq miles (nearly a third of California's population), founded in 1993 by merging SCRTD and LACTC. Its network: 125+ miles of rail (2 subway + 4 light-rail lines, 110 stations), 117 bus lines, 2 BRT corridors, 2,000+ low-emission buses and the Metro Micro on-demand service moving ~925,000 weekday boardings and 305.7M riders in 2025 (9 straight months of growth, +9% YoY, 87% satisfaction). It's run by a 13-member board (5 county supervisors + the LA mayor's bloc, chaired politically by Mayor Karen Bass) and led by CEO Stephanie Wiggins the first woman and first African American to head the agency with a $9.7B FY2026-27 budget and a $26B capital program, the largest rail construction program in the US.
Domis
September 7, 2026
•[ ransomware, retail ]
Domis was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Denmark. Website: domis.dk. domis.dk zoominfo.com/c/domis/456416204 DOMIS is a Danish cleaning company with a social mission, founded in 2003 by John Mller Rasmussen, HQ'd in Odense with a branch in Copenhagen. Its signature: combining professional cleaning services with actively hiring people outside the labour market the long-term unemployed, those on sickness benefits and early retirees under the slogan "Rengring med mennesker" ("Cleaning with people"). Legally lean setup (CVR 17 69 44 19), with the staffing agency Flex Job Randers under the same group umbrella, enabling emergency cleaning on short notice for clients. Bottom line: a small, quietly principled Danish services firm that turned social inclusion into its business model a rare "cleaning with a conscience" operator.
Soni Dwarkadas Virchand
September 7, 2026
•[ ransomware, retail, finance ]
Soni Dwarkadas Virchand was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: India. Website: dwarkadasjewellers.com. dwarkadasjewellers.com zoominfo.com/c/soni-dwarkadas-virchand/562586193 We have downloaded company's data: Confidential personal data and customer information, Financial Documents and Accounting, Business correspondence and legal documents, your databases, IT infrastructure information, Accesses and credentials, Technical documentation Soni Dwarkadas Virchand is a 110-year-old family jewellery house from Bhavnagar, Gujarat founded in 1915 with a shop rented for just 7, carrying a freedom-fighter legacy (founder left the shop to join India's independence movement) and a dramatic heir story (a 16-year-old son with 22 saved the dynasty). Now in its 5th generation, it runs Bhavnagar's biggest jewellery mall (6,100 sq ft) plus a "House of Bangles" and tech-powered "Bridal Studio" with virtual try-on. Product scale: 25,000+ designs, signature collections (Bikaneri Treasure, Sara, Menaments), Trust moat: BIS hallmark, IGI/GIA certified diamonds,4.9/5 from 1,350+ Google reviews.
Yapı Merkezi
September 7, 2026
•[ ransomware, manufacturing, retail ]
Yap Merkezi was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Manufacturing. Country: Turkey. Website: ym.com.tr. ym.com.tr rocketreach.co/yapi-merkezi-profile_b5c7f2fff42e0db7 YM Group is a Turkish family-owned manufacturing and brand house founded in 1986 in Istanbul by Yksel Mehmet Yldrm, built on a flexible-packaging plant in orlu (Halal-certified, exporting to Europe/MENA). Its crown jewel: it owns and operates the legendary American trail-running brand Ultimate Direction (the 1935 inventor of the hydration pack) designing, manufacturing in Turkey and distributing it worldwide plus its own jewelry line Ela by YM and investment arm YM Capital. The group follows the classic ladder: manufacturing own brands capital, with Halal certification as a niche edge for Gulf/Asian markets. Small core team (~110), private, low-profile, no public financials. Bottom line: a quiet Turkish industrial family that turned commodity packaging profits into ownership of an iconic American outdoor brand.
Nile Projects Trading
September 7, 2026
•[ ransomware, retail, automotive ]
Nile Projects Trading was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: Egypt. Website: nileprojects.com. nileprojects.com zoominfo.com/c/nile-projects--trading-co/357370722 Nile Projects & Trading is a private Egyptian holding founded in 1972 by Ossama El-Naggar, HQ'd in Giza/Cairo with 3,000+ employees, 750,000+ customers and 6 offices across Egypt and Jordan. It's Egypt's exclusive Bridgestone importer (since 1990) running 50+ Fit & Fix service centers plus unique mobile tire vans and the country's luxury fashion franchise king: Burberry, Ferragamo, BOSS, Calvin Klein, Polo Ralph Lauren, Sandro, Maje (launched Jordan), Kenzo, plus Matalan for mass market and Amorino/Eichholtz/TIMEVALLE in F&B, furniture and watches. Over 50+ years it has introduced 80+ international brands to Egypt and the Middle East, pioneering retail after the 2004 import opening. Key strengths: fully self-financed (no external debt), its own ERP software, owns the malls it anchors (Katameya Downtown), and a 2bn+ EGP credit line recently winning Bridgestone's global Toolbox award 2025.
Mutant
September 7, 2026
•[ ransomware, technology, finance ]
Mutant was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Other. Country: Brazil. Website: mutant.com.br. mutant.com.br zoominfo.com/c/mutant/452328184 Mutant is one of Latin America's largest CX & AI companies, founded in 2016 as a spin-off from Genesys Brazil, HQ'd in So Paulo with 4,000+ employees across 14 countries. Backed by Permira, GIC and TCV, its holding "Clash" raised $75M from BlackRock in 2025 for M&A and AI. It runs 3.5 billion AI-driven interactions per year for 100+ enterprise clients including the world's largest corporate WhatsApp operation (Caixa) with clients like Ita, Vivo, Santander, Claro and iFood. Built through 8+ acquisitions (Interaxa, GRB, Intervalor...), it projects ~R$1B revenue in 2026 and pours R$100M+/year into its proprietary generative AI ecosystem (IAM/Xavier/PALI). Bottom line: the quiet AI-giant of Brazilian customer experience "Artificial Intelligence, Human Experiences" now repositioning as the enterprise AI-intelligence layer of LatAm.
Drogueria Saporiti Sacifia
September 7, 2026
•[ ransomware, leak, healthcare ]
Drogueria Saporiti Sacifia was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Argentina. Website: drogueria-saporiti.com.ar. drogueria-saporiti.com.ar zoominfo.com/c/drogueria-saporiti-sacifia/462786110 100GB data stolen! Droguera Saporiti is a century-old Argentine pharmaceutical wholesaler and manufacturer, founded in 1901 in Buenos Aires, now run by the Otero Pose family with ~110 employees and 8,700 m of facilities. It's the silent "backbone" of Argentine pharmacies: 3,500+ products, 7,000+ pharmacy clients, wholesale distribution plus imports/exports of raw materials. Its flagship is the legendary Parafarm brand ("orange line" of galenic essentials vaseline, Pasta Lassar, Agua de Dalibour, hydrogen peroxide) sold nationwide since the 1960s, alongside Sweet Rose, Home Test, Wild Skin and Well Being. It survived a devastating fire in the 1990s and a rough 201415 ANMAT season (interjurisdictional trade ban + Parafarm lot withdrawal). Bottom line: a low-profile family institution with huge brand equity Argentina's reference house for pharmacy-grade essentials.
cannonpuntana.com
September 8, 2026
•[ ransomware, manufacturing, retail ]
cannonpuntana.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-09-08. Country: Argentina. Website: cannonpuntana.com. The company operated in Argentina and was historically connected with the manufacture and distribution of fragrances, toiletries, and personal-care products.
BCSA GEAR
September 9, 2026
•[ ransomware, retail, manufacturing ]
BCSA GEAR was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Retail & E-Commerce. Country: France. Website: www.bcsagear.fr.
Lowerys
September 7, 2026
•[ ransomware, retail, technology ]
Lowerys was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-07. Sector: Retail & E-Commerce. Country: Canada. Lowerys is a provider of office supplies, printing, and photocopying services, catering to businesses and individuals in Thunder Bay and Fort Frances. They offer a wide range of products including office supplies, janitorial supplies, and managed IT services. With a history of 100 years, Lowerys emphasizes local shopping and provides a price match guarantee. Their services also include wide format printing and bottled water solutions.
The company headquarters is located in 540 Central Avenue, Thunder Bay, ON P7B 6B4, Canada. 51-200 Employees
gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local
September 9, 2026
•[ ransomware, leak, retail ]
gardensalive.com, bitsandpieces.com, iselinursery.local, weeksroses.org, esm.local was listed as a victim on the leak site of the embargo ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Agriculture and Food Production. Country: United States of America. Website: gardensalive.com. Gardens Alive, Inc. is a privately held U.S. consumer goods company specializing in direct-to-consumer gardening products, plants, seeds, nursery stock, fertili... - 2tb data
Mitsuwa Trading Co., Ltd
September 9, 2026
•[ ransomware, retail ]
Mitsuwa Trading Co., Ltd was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-09. Sector: Retail & E-Commerce. Country: Japan. Website: e-mitsuwa.com.
John Engel Team
September 10, 2026
•[ ransomware, financial, retail ]
John Engel Team was listed as a victim on the leak site of the ShadowByt3$ ransomware group; the attack is estimated to have taken place on 2026-09-10. Sector: Professional Services. Country: United States of America. Website: johnengelteam.realscout.com. Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leaders personal profile details, including name, primary corporate emails (john.engel@elliman.com, engelteaminfo@elliman.com), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
ShadowByt3S@proton.me
