Bethany Press International
October 21, 2026
•[ ransomware, leak, retail ]
Bethany Press International was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-21. Sector: Retail & E-Commerce. Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib
ute millions of life-changing Christian books each year. They offer industry-leading publishing
services for both short-run and long-run printing and distribution.
We will upload 40gb of corporate data soon. Employee personal information (financials and so on
), customer information, financials, contracts and agreements, and so on.
istanbultrading.com
October 22, 2026
•[ ransomware, retail, technology ]
istanbultrading.com was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-10-22. Sector: Retail & E-Commerce. Country: Turkey. Website: istanbultrading.com. Istanbul Foodstuff Trading Co LLC is a company that operates in the Computer Equipment & Peripherals...
Castle Howard Estate
October 24, 2026
•[ ransomware, retail ]
Castle Howard Estate was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-24. Sector: Hospitality. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.castlehoward.co.uk.
AB InBev
October 25, 2026
•[ ransomware, manufacturing, retail ]
AB InBev was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-25. Sector: Agriculture and Food Production. Country: Belgium. Website: ab-inbev.be. AB InBev is the world's largest brewer, headquartered in Belgium, known for Budweiser, Corona, and Stella Artois .
We hold 329,244 AB InBev social-listening alerts, 2,510 corporate emails across all subsidiaries, 19K access logs, GBS portal records, internal PKI certificates, and 3.2GB of Azure blob assets.
Our demand is $1,000,000 in BTC. [Sector: Retail, Manufacturing]
EWM Group
October 28, 2026
•[ ransomware, retail, financial ]
EWM Group was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Country: United Kingdom of Great Britain and Northern Ireland. Website: EWM Group. [fashion] EWM Group the parent group behind Bonmarch, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains.
The exposed material includes:
503,878 loyalty programme member records full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 20002026.
~21,000 employee records salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details.
100+ GB of Outlook PST email archives complete email histories for named staff members spanning years of business operations.
313+ SQL Server database backups across 122 unique databases the entire digital brain of the retail operation.
83 GB of e-commerce transaction data every online order from January 2021 to August 2026.
Lydenburg Toyota
October 26, 2026
•[ ransomware, retail, manufacturing ]
Lydenburg Toyota was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: South Africa. Website: lydenburg.toyota.co.za. lydenburg.toyota.co.za Lydenburg Toyota is a Toyota dealership in Lydenburg (Mashishing), Mpumalanga, South Africa, part of the Toyota South Africa Motors dealer network selling new Toyota and Lexus vehicles, certified used cars, service, parts and financial services. The town is also home to Toyota SA Manufacturing, the largest Toyota plant in Africa, assembling Hilux, Fortuner and Corolla Cross with engines and components exported to over 40 countries including the United States. Toyota SA Motors holds 24.2 percent of the South African vehicle market and exported 187 billion rand in FY2023, with 8500 direct employees across its plants. The company invested 2.43 billion rand in hybrid technology and is developing a 2.2 billion dollar Mbombela megaproject including housing, schools and hospitals around the Lydenburg plant. Corolla Cross production from Lydenburg began exports to the US in April 2024.
Unisa Shoes
October 26, 2026
•[ ransomware, retail ]
Unisa Shoes was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: Spain. Website: unisa.es. unisa.es Unisa Shoes is a Spanish footwear company founded in 1973 in Elche, Alicante, with 52 years of history across three generations of the Prez Parres family. It designs and produces women's, men's and accessories collections sold in 70 plus countries through around 30 own stores, 150 plus Espacio Unisa points of sale and its e-commerce platform. Revenue reached 25.3 million euro in 2024 with 145 employees, and international online sales hit a record 16 percent in 2025. Led by CEO Carlos Prez Parres, the company launched its men's line in 2021 and an eco-friendly recycled suede collection, positioning itself as an accessible Spanish lifestyle brand. It opened a 300 square meter showroom in Madrid and a subsidiary in Italy to expand European distribution. Core strengths are family heritage, global reach across 70 countries and a diversified omnichannel sales model.
Belmont Resorts
October 26, 2026
•[ ransomware, retail ]
Belmont Resorts was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Hospitality. Country: Australia. Website: belmontresorts.com. belmontresorts.com Belmont Resorts is a small boutique hotel in McLeodganj, Dharamshala, Himachal Pradesh, operating as Hotel Satovari Pride on the Strawberry Hills with panoramic views of the snow-capped Dhauladhar mountains. It has just 14 rooms across four categories from Deluxe to Premium Gold corner suites with private balconies, mini-fridges and sunrise-sunset views from both sides. Positioned as a value-for-money alternative next to ITC Hotels and Lemon Tree, it offers a pure vegetarian restaurant with Jain cuisine, 24/7 power backup, fast WiFi and free parking. The hotel caters to relaxation, spiritual tourism, trekking and long-term workation stays with tour packages to Khajjiar and Dalhousie.
grifosespinoza.com
October 31, 2026
•[ ransomware, retail, financial ]
grifosespinoza.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Other. Country: Peru. Website: grifosespinoza.com. Headquartered in Lima, the company manages fuel stations that serve individual motorists, commercial customers and other transportation-related businesses. Its core
Punta Shopping
October 31, 2026
•[ ransomware, retail, finance ]
Punta Shopping was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Retail & E-Commerce. Country: Uruguay. Website: puntashopping.com.uy. Commercial organization in Uruguay, located in the city of Punta del Este
Field of activity: shopping center management, rental of commercial space, retail trade and services.
The archive contains the most important personal data and customer data. [Sector: Finance]
Coast 2 Coast
October 27, 2026
•[ ransomware, retail, finance ]
Coast 2 Coast was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Retail & E-Commerce. Country: United States of America. Website: www.c2cescrow.com. United States
spencers.com
October 30, 2026
•[ ransomware, retail ]
spencers.com was listed as a victim on the leak site of the Scarlettgroup ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Retail & E-Commerce. Country: United States of America. Website: spencers.com. Spencer's is an American specialty retailer known for novelty gifts, pop culture merchandise, clothing, accessories, and adult-themed products.
Pure Perfection
October 26, 2026
•[ ransomware, retail, automotive ]
Pure Perfection was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Retail & E-Commerce. Country: United States of America. Website: pureperfection.com. pureperfection.com Pure Perfection GmbH is a German live communication agency founded in 2008 in Wiesbaden, ranked number one in the 2026 BlachReport German Event Creativity Ranking ahead of insglck and Vok Dams. With 72 to 80 employees across offices in Wiesbaden, Berlin, Dsseldorf and Florida, it delivered 133 events in 2025, with 90 of them abroad including Shanghai, Miami and Singapore. Led by co-founders Jan Rogozinski and Kim Meisinger, the agency works through three units: Pure Live for events, Pure Space for brand spaces and architecture, and Pure Content for storytelling and PR. Major clients include Audi, KODA, L'Oral, Bentley and Nestl, with pharma being its largest vertical at 90 events per year. Revenue peaked at 26.4 million euro in 2023 and the agency won 60 MUSE Creative Awards in 2026 alone.
atljamaica.com
September 30, 2026
•[ ransomware, retail, hospitality ]
atljamaica.com was listed as a victim on the leak site of the settra ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Other. Country: Jamaica. Website: atljamaica.com. Sandals Resorts International (SRI) is a Jamaican luxury resort chain operating under the all-inclusive brand across the Caribbean. Appliance Traders Limited (ATL) is a retail electronics chain operating under the ATL Jamaica brand. Both companies belong to the same corporate structure: "ATL Group of Companies" and "Sandals Group of Companies" are used interchangeably in their internal documents to refer to the same circle of affiliated entities.
reignwoodpark.com
September 1, 2026
•[ ransomware, retail, leak ]
reignwoodpark.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Hospitality. Country: China. Website: reignwoodpark.com. Reignwood Park Thailand is a luxury real estate and integrated lifestyle development project by Reignwood Group a le...
Company #111
October 27, 2026
•[ ransomware, retail ]
Company #111 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-27. Country: United Arab Emirates. retail and facility services United Arab Emirates | [PENDING EXPOSURE: The complete payroll ledger, employee records and identity document archive of a UAE services group are held.]
Five Star Jewelers
October 28, 2026
•[ ransomware, retail ]
Five Star Jewelers was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Retail & E-Commerce. Country: United States of America. Website: fivestarjewelers.com. Premier jewelry store located in Miami, FL
Trade Union Co
October 26, 2026
•[ ransomware, hack, automotive ]
Trade Union Co was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: United States of America. Website: tradeunionco.com. tradeunionco.com tuc-dxb.com Trade Union Co. is a family-owned automotive spare parts wholesaler and retailer founded in 1960 in Beirut, Lebanon, with over 65 years of experience serving customers across the Middle East, Africa, Europe, Asia and the Americas. The group operates through its Beirut headquarters and The Trade Union International LLC in Dubai, a 5000 square meter global re-export hub established in 2007 with offices also in Germany, Russia and Nigeria. With over 150 employees and 20 plus international aftermarket brands including Bosch, Mahle, ZF and Sachs, it supplies parts for European, Japanese and American passenger and commercial vehicles. Led by CEO Walid El Bissani and Head of Strategy Tarek Jamil, the company is a member of NEXUS Automotive International, the world's largest automotive distribution community. It regularly exhibits at Automechanika Dubai and Frankfurt, showcasing its growing brand portfolio and global logistics network.
Farmacias 911
October 26, 2026
•[ ransomware, healthcare, manufacturing ]
Farmacias 911 was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Healthcare. Country: Ecuador. Website: farmacias911.com.ec. farmacias911.com.ec Gettareq S.A., known as Farmacias 911, is a major Ecuadorian pharmaceutical company founded in 2013 in Guayaquil, combining retail pharmacy, wholesale distribution, OEM manufacturing and medical consulting across the whole country. The group operates six brands including Farmacias 911 retail, ACOSAR wholesale distribution, Galenic for private label manufacturing, One Laboratory for quality testing and Conseplus for consulting. It has grown from 11 to 500 employees with a 166 percent increase in headcount, working with global pharmaceutical giants like Abbott, Bayer, Bristol Myers Squibb, Takeda and Roche. Led by founder and CEO Marlon Morillo, the company hosted Ecuador's largest pharmaceutical convention in 2025 alongside APESFA. Its vertical integration from import and production to retail and lab testing is unique in the Ecuadorian market.
layam.com
October 31, 2026
•[ ransomware, retail ]
layam.com was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Country: Israel. Website: layam.com. Its product portfolio includes food and provisions, beverages, tobacco products, perfumes, cosmetics, electronics, confectionery, gifts and other duty-free merchandise. The
