expresspros.com
September 17, 2026
•[ ransomware, technology ]
expresspros.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-09-17. Sector: Professional Services. Country: United States of America. Website: expresspros.com. Express Employment Professionals Data Breach Notification & Public Disclosure
We have officially initiated the public release phase regarding expresspros.com.
Despite our direct attempts to establish communication, company leadership and their representatives have chosen a strategy of silence
Invincible GG
September 17, 2026
•[ ransomware, technology ]
Invincible GG was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-17. Sector: Technology. Website: www.invinciblegg.com.
Vigatec
September 17, 2026
•[ ransomware, technology ]
Vigatec was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-17. Sector: Technology. Country: Germany. Website: www.vigatec.com.
Stim
September 18, 2026
•[ ransomware, technology ]
Stim was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: France. Website: stim.fr. Stim France specializes in video surveillance solutions within the security industry. The company offers a range of video recorders, video receivers, storage expansion, and integration services for surveillance cameras, as well as software for video surveillance management.
Inovapy
September 18, 2026
•[ ransomware, technology ]
Inovapy was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Paraguay. Website: inovapy.com. INOVAPY is a technology company specializing in software development and digital transformation solutions for small and medium-sized businesses, offering reliable and scalable technological services across Latin America and beyond.
ANYTHINGIT
September 18, 2026
•[ ransomware, technology, government ]
ANYTHINGIT was listed as a victim on the leak site of the Spirals ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Website: www.anythingit.com. Certified IT Asset Disposition (ITAD) and e-waste management for federal agencies, defense contractors, and enterprise organizations demanding the highest chain-of-custody standards.
AT&T
September 18, 2026
•[ ransomware, technology ]
AT&T was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: United States of America. Website: att.com. Revenue: $125.6 billion
Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!
Accela.com
September 18, 2026
•[ ransomware, government, technology ]
Accela.com was listed as a victim on the leak site of the EndZone ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Government & Defense. Country: United States of America. Website: Accela.com. Revenue: $144.4 million
Accela is a comprehensive cloud based software platform used by state and local governments to manage internal agency operations. We have successfully extracted over 50 GB of data from Accela. Data includes over 2 million lines of user data with PII, and 6 million user requests (from their citizen engagement portal where citizens report everyday non-emergencies in/around their neighbourhoods) also with PII. There is a lot of government data, from FBI agents to cops to regular government workers. Speak soon or Leak soon!
American Casting Company
September 18, 2026
•[ ransomware, manufacturing, technology ]
American Casting Company was listed as a victim on the leak site of the Storm ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Manufacturing. Country: United States of America. Website: americancastingco.com. American Casting Company is an ISO 9001 and AS9100 certified investment casting foundry located in Hollister, California, specializing in premier quality investment castings for the aerospace and medical industries. The company offers a variety of castings made from super alloys and other high-performance materials, ensuring the industry's shortest lead times through advanced manufacturing processes, including 3D printing and vacuum melting. Their services include design for manufacturability, NADCAP heat treating, and non-destructive testing, catering to clients in sectors such as medical, aerospace, defense, and industrial applications. With a focus on innovation and quality, American Casting Company commits to delivering precise, durable, and strong investment castings perfect for complex geometries.
The company headquarters is located in 205 Apollo Way, Suite A, Hollister, CA 95023, United States. 51-200 Employees
Ascend Com
September 18, 2026
•[ ransomware, technology ]
Ascend Com was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: Singapore. Website: www.ascendcom.com.sg.
BeLi Teacher / FSC education centers (AWS)
September 18, 2026
•[ ransomware, education, technology ]
BeLi Teacher / FSC education centers (AWS) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Education. Country: Vietnam. Website: beliteachers.com. Education / edtech Vietnam | The complete CRM lead database: 152,044 contact records names, emails, +84 phone numbers, cities, study interests, engagement history; The CRM file archive (tasks, forums, comments, customer files) migrated from GetFly CRM | Publication proceeds in batches after the deadline. | [ACTIVE: deadline 2026-09-20 02:47 UTC]
AstraZeneca Türkiye
September 18, 2026
•[ ransomware, healthcare, manufacturing ]
AstraZeneca Trkiye was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Healthcare. Country: Turkey. Website: astrazeneca.com.tr. Pharmaceutical manufacturing (GxP) Trkiye | Complete internal network-security configuration of all 3 sites (940 MB): every rule, device definition, remote-access mappings; 1.35M connection records: M365/Intune, SAP Concur, UniFi camera estate, internal applications | All sites are enforcing a total network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Argentem Creek Partners (investment firm)
September 18, 2026
•[ ransomware, finance, technology ]
Argentem Creek Partners (investment firm) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: United States of America. Website: argentemcreek.com. Investment management / private credit United States | Full corporate network evidence: 2.5M+ connection records, complete internal systems map (Active Directory, SharePoint, MSP tooling, office-security integrations); Tax-season document flows of the firm and its investor document delivery platform | Corporate connectivity remains severed until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
PayPal support operations (Transcom WorldWide)
September 18, 2026
•[ ransomware, finance, technology ]
PayPal support operations (Transcom WorldWide) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Financial Services. Country: Sweden. Website: transcom.com. Outsourced customer support / financial services Netherlands / Tunisia | 86.7M connection records: daily support-agent sessions into PayPal corporate Citrix/AAA systems; Complete infrastructure map: internal AD, PKI, Netskope/Zscaler tenants, all 8 sites | All 8 sites are enforcing a network blackout until settlement. | [ACTIVE: deadline 2026-09-21 03:01 UTC]
Barrett Mahony Consulting Engineers
September 18, 2026
•[ ransomware, leak, technology ]
Barrett Mahony Consulting Engineers was listed as a victim on the leak site of the play ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Professional Services. Country: Ireland. Website: www.barrettmahony.com. Ireland
K3G Solutions Brazil
September 18, 2026
•[ ransomware, technology ]
K3G Solutions Brazil was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Other. Country: Brazil. Website: k3gsolutions.com.br. K3G Solutions is a Brazilian telecom/IT consulting company based in Manaus, providing network engineering, ISP support, monitoring, call-center, CDN, and colocation services.
Quest Group
September 18, 2026
•[ ransomware, technology, leak ]
Quest Group was listed as a victim on the leak site of the anubis ransomware group; the attack is estimated to have taken place on 2026-09-18. Sector: Technology. Country: United States of America. Website: questgroupsearch.com. Employee data, internal files, and a few unexpected discoveries.
Electrolux
September 19, 2026
•[ ransomware, manufacturing, technology ]
Electrolux was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-09-19. Sector: Manufacturing. Country: Sweden. Website: electroluxgroup.com. Electrolux Group is a Swedish multinational home-appliance manufacturer, producing refrigerators, washing machines, ovens, dishwashers, vacuum cleaners, and other household appliances under several brands worldwide.
We were able to access your azure database, and export every piece of data which adds up to ~41GB.
You will receive an email shortly containing the instructions you need to proceed.
Electro_backup.7z is currently password locked, but if they do not pay the ransom, the password and the data WILL be leaked
Time is ticking, Pay the ransom.
If you are having issues receiving instructions, contact me at: xdlmfao@morke.ru [Size: 12.7 GB | Sector: Manufacturing]
Schneider’s Computing
September 19, 2026
•[ ransomware, technology ]
Schneiders Computing was listed as a victim on the leak site of the arcusmedia ransomware group; the attack is estimated to have taken place on 2026-09-19. Sector: Technology. Country: Canada. Website: scomputing.ca. www.scomputing.caSchneiders Computing & Websites Ltd. is a Canadian-owned and Deadline: 2026-09-26 15:25:00.000000
Fanatics (global sports commerce platform)
September 20, 2026
•[ ransomware, retail, technology ]
Fanatics (global sports commerce platform) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-09-20. Sector: Retail & E-Commerce. Country: United States of America. Website: fanatics.com. Sports commerce / e-commerce United States | Complete order history: 46,902 order files (108 GB) with customer personal data; Accounts-payable invoices of league and brand partners; Customer balances, bank transaction archive, customer tax exemption certificates; The fraud-prevention data set | Their cloud data estate is under our destructive control; deletion has begun. | [ACTIVE: deadline 2026-09-23 01:01 UTC]
