Knit
September 28, 2026
•[ ransomware, technology, financial ]
Knit was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. One of our essential beliefs is that architecture changes lives. This belief guides our path ev
ery day. We seek clients and relationships who are equally interested in improving their city,
their business, their school, their neighborhood or the place they call home.
We will upload 175gb of corporate data soon. Employee information (passports, DLs, credit cards
), projects, financials, client information, NDAs and so on.
Netech (Neeser Technik AG)
September 28, 2026
•[ ransomware, leak, manufacturing ]
Netech (Neeser Technik AG) was listed as a victim on the leak site of the payload ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Manufacturing. Country: Switzerland. Netech (Neeser Technik AG) is a Swiss engineering and industrial services company based in Seuzach. It specializes in comprehensive maintenance, retrofitting, and overhauls of industrial machinery and manufacturing systems. The firm provides end-to-end technical support for production facilities, covering mechanical engineering, pneumatics, and electrical control systems.
Amazon Informatica
September 28, 2026
•[ ransomware, technology, government ]
Amazon Informatica was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. Country: Brazil. Amazon Informtica LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995.
Amazon Informtica's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Braslia/DF (to service the federal government cluster) and Belm/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions.
Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information!
Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data.
TOX ID: 3D6EF83C3C4517FE42B212A934D4B08579A5F20522828C4E4818EA117F53063377C4D769640B
SESSION: 052a5fe97f7b1822c2225ba884b5f719c07ec99da7d838421a20958938f54cb539 [Sector: Government, Technology]
Starr Whitehouse Landscape Architects
September 28, 2026
•[ ransomware, technology ]
Starr Whitehouse Landscape Architects was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Professional Services. Country: United States of America. Website: www.starrwhitehouse.com. United States
apexus.com
September 28, 2026
•[ ransomware, technology ]
apexus.com was listed as a victim on the leak site of the threeam ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Technology. Country: United States of America. Website: apexus.com. Apexus, founded in 2007, is a business services company that manages the 340B Prime Vendor Program supporting the 340B Drug Pricing Program. The company negotiates pricing discounts with pharmaceutical manufacturers, provides educational resources
iccsi.com
September 29, 2026
•[ ransomware, technology, leak ]
iccsi.com was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Professional Services. Website: iccsi.com. +1 (781) 331-9811. Interconnect Computer Cabling Services, Inc. is a full-service telecommunications company that has been operational since 1986, providing services for a diverse range of projects including education, medical facilities, hospitality, and corporate offices. The company specializes in telecommunications solutions and has recently developed touchless wave door opening systems to address safety concerns for clients returning to office spaces. Their clientele includes local schools, national railroad services, country clubs, and various commercial establishments. Interconnect is committed to delivering high-quality services tailored to the needs of their clients. Stolen: 434 GB 341,547 File
Groupe Proxitel
September 29, 2026
•[ ransomware, technology ]
Groupe Proxitel was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Country: Timor-Leste. Website: proxi.tel. French B2B technology provider offering professional Internet connectivity (fiber/DSL, 4G/5G backup), fixed and mobile telephony, cybersecurity, IT backup, collaboration, networking and computer hardware. The group is based in Avignon and serves businesses and public-sector organizations.
spg.co.kr
September 29, 2026
•[ ransomware, manufacturing, technology ]
spg.co.kr was listed as a victim on the leak site of the lockbit5 ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Other. Country: South Korea. Website: spg.co.kr. SPG Co., Ltd specializes in a wide range of products including robot reducers, planetary gearheads,...
advantech.com
September 29, 2026
•[ ransomware, manufacturing, technology ]
advantech.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Manufacturing. Country: Taiwan. Website: advantech.com. We are publishing 5% of the total data because the company's management is ignoring the situation and has not contacted us. The company's management has exactly 48 hours to contact us; otherwise, the entire dataset will be published.
intense.pl
September 29, 2026
•[ ransomware, technology ]
intense.pl was listed as a victim on the leak site of the m3rx ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Country: Poland. Website: intense.pl. +48 124200150 , NTENSE Group is a Polish software development and IT consulting company founded in 2006. The company specializes in delivering highly customizable digital transformation enterprise software designed to optimize operational efficiency, automate workflows, and reduce corporate expenditures. Stolen: --
Stockham Construction
September 28, 2026
•[ ransomware, manufacturing, technology ]
Stockham Construction was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-28. Sector: Manufacturing. Country: United States of America. Website: stockhamconstruction.com. Stockham Construction, Inc. is a commercial union subcontractor with over 30 years of experience specializing in interior and exterior metal stud framing, drywall, finish taping, acoustical ceilings, and commercial door installation. The company is dedicated to quality, integrity, and client satisfaction, aiming to build lasting partnerships that contribute to the success of their clients' ventures. They serve a diverse range of commercial construction projects, including advanced technology, health services, and education sectors, ensuring high standards of quality and precision. Their collaborative approach integrates multiple trades to streamline the construction process, delivering exceptional results while minimizing disruptions.
The company headquarters is located in 475 Portal Street, Cotati, CA 94931, United States. 201-500 Employees
Josee Bendaaa-Guerrero Asociados
September 29, 2026
•[ ransomware, finance, technology ]
Josee Bendaaa-Guerrero Asociados was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Professional Services. Country: Belize. Website: guybendana.com. guybendana.com Guy Jos Bendaa-Guerrero & Asociados (roots to 1907, Managua, Nicaragua) is the leading intellectual-property boutique in Nicaragua, specializing in trademarks, patents, industrial designs, copyright, plant varieties and anti-counterfeiting, plus corporate law, regulatory (sanitary registrations) and litigation. It traces its lineage over 100 years through three legal dynasties founders Henry Caldera & Henry Caldera-Pallais (who secured Nicaragua's first Trademark Law in 1907 and co-founded ASIPI in 1964), then the Caldera generation, and since 1985 Dr. Guy Jos Bendaa-Guerrero (a former judge, law professor, author and ex-president of ANIPI) alongside his wife Blanca Aragn de Bendaa and their son Julin. Recognized as Nicaragua's top IP firm by Chambers and Partners, Legal 500 and World Trademark Review 1000, it serves global pharmaceutical, technology, fashion and consumer-goods clients from its Bolonia district office in Managua. With 510 lawyers
Tommy Garner Air Conditioning Heating
September 29, 2026
•[ ransomware, leak, technology ]
Tommy Garner Air Conditioning Heating was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Professional Services. Country: United States of America. Website: tommygarner.com. tommygarner.com zoominfo.com/c/tommy-garner-air-conditioning--heating/140230813 Tommy Garner Air Conditioning & Heating (Tommy Garner, Inc., founded 1986 by Tommy and Chrissy Garner in Newport News, Virginia) is a family-owned Class A HVAC contractor serving the Hampton Roads region for 40 years. It provides commercial and residential air conditioning, heating, generators (authorized Honeywell dealer), water heaters, commercial refrigeration and indoor air-quality solutions with 24-hour emergency service, 30-day service guarantees and 1-year installation warranties. Led today by founder Tommy Garner alongside his son Zach and daughter Lauren Jett, the company employs 3539 people and was named Virginia Peninsula Chamber Small Business of the Year 2024 and a 2025 Best Places to Work in Virginia (the only HVAC firm on the list). Its reputation is exceptional an A BBB rating and 5-star reviews from clients including the Virginia Living Museum
Groupe APROSEP
September 29, 2026
•[ ransomware, leak, technology ]
Groupe APROSEP was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Other. Country: Senegal. Website: groupe-aprosep.com. groupe-aprosep.com guyanasso.org Groupe APROSEP (founded 1994, Cayenne, French Guiana) is a solidarity-economy network (groupement d'conomie solidaire) that unites and professionalizes associations across the region, focusing on employment insertion, training and social innovation. It runs several affiliated structures LIANE (job integration), OFA Guyane (training), GEIQ Jeun'ESS and GEPSL (shared employers for sports/youth/childcare jobs) and the Conciergerie Solidaire all housed in "L'Accordeur," a 1,600 m PTCE-labeled cooperative hub in downtown Cayenne supporting about 500 jobs and 240 associations. Led since 1997 by director Jean-David Poquet under president Jos Othily, the group celebrated its 30th anniversary in June 2025 and runs flagship projects like an AVIP integration crche (30 places), the EVA illiteracy-assessment center and the social enterprise Tisanes de Camopi. Its partner network spans France Travail, ANLCI, Orange
Datacomm Services
September 29, 2026
•[ ransomware, technology, government ]
Datacomm Services was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Country: United States of America. Website: dscdatacomm.com. dscdatacomm.com zoominfo.com/c/datacomm-services-corp/347799114 Datacomm Services Corporation (DSC) (operating since 1988, Memphis, Tennessee) is a low-voltage systems contractor serving the Memphis/Mid-South region (TN, MS, AR) for nearly 40 years. It designs and installs structured cabling (Cat 5eCat 6A and fiber optics), outside-plant networks, access control, CCTV, intrusion alarms and paging/AV systems acting as a single point of contact for all low-voltage building systems. Led by President Allen Hendry and EVP/CEO Chuck Jennings, it runs a lean ~22-person team with two certified RCDD designers on staff and revenue around $10 million/year. Clients range from small service tickets to $1M+ projects offices, industrial sites and especially school systems and government buyers (it holds TIPS purchasing contracts through 2028). It carries an A+ BBB rating and clean legal record, with strong reviews for workmanship and service. Main limits: purely regional footprint and dependence
Defencebit
September 29, 2026
•[ ransomware, technology, government ]
Defencebit was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Government & Defense. Country: United Kingdom of Great Britain and Northern Ireland. Website: defencebit.com. defencebit.com zoominfo.com/c/defencebit/532842616 DefenceBit (founded 2018, Lisbon) is a boutique cybersecurity consulting firm self-described "hackers, but the good ones" spun off from Bullray-CIT, an Angolan-government-focused critical-systems integrator. It provides offensive-security services: penetration testing, vulnerability assessments, hardening, source-code and web/API audits, mobile app audits, social-engineering tests and full Red Team engagements, working to PTES/OWASP/OSSTMM standards with manual verification. The team holds top certifications (CEH, CISSP, PMP, Checkpoint CCSE, ISO 27001) and its co-founder later moved to a senior role at the NATO Communications and Information Agency. A notable credential is its contract with Portugal's National Cybersecurity Centre (CNCS) to run the "Cidado Ciberseguro" course for government workers on the state NAU platform. It remains a very small company (110 staff)
clicks digital GmbH Information
September 30, 2026
•[ ransomware, technology ]
clicks digital GmbH Information was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Germany. clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More
Altmannshofer Sicherheits-Videotechnik
September 30, 2026
•[ ransomware, manufacturing, technology ]
Altmannshofer Sicherheits-Videotechnik was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Manufacturing. Country: Germany. Website: altmannshofer.de. Altmannshofer Sicherheits-Videotechnik OHG is a German installer of electronic security systems from Affing near Augsburg, Bavaria. Since 1999 it plans and installs CCTV, burglar alarms (EMA), access control, electronic locks, fingerprint scanners
Virtual Ideas
September 30, 2026
•[ ransomware, technology ]
Virtual Ideas was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Australia. Website: virtualideas.com.au. Virtual Ideas is an Australian 3D visualisation and digital content studio based in
Sydney. It specialises in architectural visualisation (CGI), 3D animation, marketing
films, product visualisation, shadow and visual-impact studies etc.
Titus
September 30, 2026
•[ ransomware, leak, technology ]
Titus was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-30. Sector: Technology. Country: Germany. Website: www.titus.de. Germany
