Incomelec
October 26, 2026
•[ ransomware, manufacturing, technology ]
Incomelec was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Manufacturing. Country: Colombia. Website: incomelec.com. incomelec.com Incomelec is a Colombian company founded in 2006 in Bogota, the Latin American leader in pedestrian, vehicle and passenger access control including turnstiles and automated barriers. With 52 employees and operations in 14 countries, it has installed equipment in over 20 airports, 90 parking facilities and 250 buildings, handling more than 85 percent of Colombia's toll booth systems. Its flagship product is BIOMIG, an automated migration control system used at El Dorado and Medellin airports with iris scanning and passport verification. It is the exclusive regional partner of Automatic Systems from the Bollore Group and the only distributor worldwide that locally assembles TR-490 and TR-491 turnstile lines. Led by CEO Kris De Sutter Gomez, it serves Metro de Medellin, TransMilenio and BD Bacata, Colombia's tallest building.
Digital Triumph
October 31, 2026
•[ ransomware, leak, technology ]
Digital Triumph was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Technology. Country: Malaysia. telecommunications services Malaysia | Employee payroll records with names, national identity numbers and wages, statutory filings 2016 to 2025; Audited financial statements, tax filings and company bank account numbers; 2,552 customer invoices and delivery orders; The full customer service data room covering 309 organizations including banks, an embassy and government offices; The CRM customer database and the company mail archive, 8,700+ verified business emails with customer correspondence | [NOT PAID EXPOSED]
mars-semi.com.tw
October 31, 2026
•[ ransomware, manufacturing, technology ]
mars-semi.com.tw was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Manufacturing. Country: Taiwan. Website: mars-semi.com.tw. Established in 2001 and headquartered in Hsinchu Science Park, the company develops long-range, high-bandwidth wireless audio and video system-on-chip (SoC)
Echo.com
October 28, 2026
•[ ransomware, technology ]
Echo.com was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Technology. Country: Germany. Website: Echo.com. Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America.
We hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata.
We suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives.
Emails with instructions will be sent to you shortly.
Samples can be found below.
Contact:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
CP Manufacturing, Inc.
October 30, 2026
•[ ransomware, manufacturing, financial ]
CP Manufacturing, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Manufacturing. Country: United States of America. Website: CP Manufacturing, Inc.. [manufacturer] CP Manufacturing, Inc. a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems) operating since the 1970s under
the CP Group / CPG Sorting Technologies brand, with subsidiaries MSS Inc. (Nashville, TN), IMS Electronics Recycling, IMS Logistics, IMS Recycling Services,
Material Sales, HMM, and UK partner Recycleye.
The dataset includes complete server mirrors from HR, finance, engineering, legal, operations, and sales infrastructure, capturing the company's entire digital
footprint:
Sage/Epicor ERP accounting system for 8 entities (CPM, MSS, HMM, IMSR, IMSRE, MSIRE, CPGH, CP Global) with consolidated P&L showing $109.1M revenue, $10.2M net
income, and $12.1M EBITDA for FY2024, plus multi-year budgets (20212024), daily cash reports, and AR/AP data
~340 Social Security Numbers with full identity packages (name, DOB, health coverage status, premium amounts, tax withholdings) across 4 entities via ACA 1095-C
filings (20162022), biweekly payroll registers, 401(k) participant records, 10-year salary histories (20132023), and benefits administration across 5 carriers
(Anthem, Blue Shield, SIMNSA, UNUM, Western Dental)
Truist bank account details routing number 053101121 and account number 1180009812409 for CP Manufacturing LLC, plus ACH payment batch files spanning August 2025
through August 2026
277+ GB of proprietary engineering IP 22G of AutoCAD Electrical MRF designs with proprietary component catalogs (1.2G), 195G of Artec 3D scanner data for
manufactured equipment, 38G of CNC laser fabrication data (Amada LCG3015 AJ / FabriWin), PCB board designs (5 boards), SolidWorks Electrical templates, and Epicor
ERP Bill of Materials with proprietary part numbers
60+ customer contracts and 30+ NDAs with Republic Services, Waste Management, Recycleye/Nestl, Cal-Waste, Balcones, Wasatch, and international partners, plus
Declaration Partners acquisition due diligence documents, competitor proposals (BHS, Machinex, MISTRAL), and a complete project green list
Privileged legal materials active litigation subpoena (Hans Ouellet), Coastal Resources MWS settlement agreement with UCC1 financing statements,
separation/termination documents for named employees, restrictive covenant cease-and-desist letters, PIIAAs (invention assignment agreements), wage garnishment
orders, and corporate equity documents
200+ named job applicant resumes, 51 employee headshot photographs, 400+ vendor records with Tax IDs (including 3+ individual contractors with potential SSNs), and
a 7.8G Microsoft SQL Server backup (IMSROM) of undetermined contents
iFink
October 30, 2026
•[ ransomware, technology ]
iFink was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: Romania. Website: ifink.ro.
Betopia Group
October 26, 2026
•[ ransomware, technology, leak ]
Betopia Group was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-26. Sector: Other. Country: Cyprus. Website: betopiagroup.com. betopiagroup.com Betopia Group Betopia Group is a Bangladeshi tech holding based in Dhaka, formally created in July 2025 by consolidating 22 business units including Bdcalling IT, Softvence, Sparktech, JVAI and Zencore, claiming 5,000 employees and 36 million dollars in annual revenue. Founded by Muhammad Monir Hossain, who went from freelancing on oDesk in 2013 to launching Bdcalling IT in 2017 with just 500,000 taka and 7 people, the group now serves clients in over 80 countries with 80 to 90 percent of business from the United States. Its units span software development, AI, cloud infrastructure via ZenexCloud, Odoo ERP implementation, renewable energy through PulseGrid and IT education. In July 2026 the group unveiled Vision 2030, planning to double its workforce and build Betopia City, an AI-powered smart tech hub in Bangladesh. The company is embroiled in a major scandal, with Fiverr suspending around 300 accounts linked to Betopia for coordinated marketplace manipulation.
System Soft
October 31, 2026
•[ ransomware, technology ]
System Soft was listed as a victim on the leak site of the Vexy Ransomware ransomware group; the attack is estimated to have taken place on 2026-10-31. Sector: Technology. Country: Bulgaria. Website: systemsoft.info. systemsoft.info
dmt-group.com
September 1, 2026
•[ ransomware, technology ]
dmt-group.com was listed as a victim on the leak site of the krybit ransomware group; the attack is estimated to have taken place on 2026-09-01. Sector: Technology. Country: Germany. Website: dmt-group.com. DMT Consulting Private Limited is an Indian private limited company incorporated on September 25, 1998, formerly known a...
OR Technology
October 27, 2026
•[ ransomware, technology ]
OR Technology was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Technology.
wagyu.xyz unfairness
October 28, 2026
•[ ransomware, financial, technology ]
wagyu.xyz unfairness was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Other. Website: wagyu.xyz. wagyu.xyz runs two rigged systems, both proven by the evidence:
1. Rigged coinflip. The site advertises "48% win chance, 4% house edge" (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren't tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge "4.00", actualEdge "2.92" against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).
2. Hidden fee overcharging. Across 28,840 swap/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server's internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).
Evidence to support this can be found below:
Noelker and Hull
October 28, 2026
•[ ransomware, financial, healthcare ]
Noelker and Hull was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Professional Services. Country: United States of America. Website: noelkerhull.com. Noelker and Hull NHA-FULL US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College - incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY - raw files from the firm's servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical.'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL - Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation/bank anatomy for payroll-diversion.[3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven.[4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'designerrors, omissions' against NHA internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE'hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140Certificates of Insurance; license keys (Autodesk/Adobe) bonus.[6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI.Rest as-is, unprobed.[+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS - Alive: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail.Brecent: Ajera, pipeline, returns 2022-25, litigation. Carchival (KAPC2009-14): W-2, background - SSN/biometrics don't expire.BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6);PA/MD plaintiff bar (1+4); contractor scams (5).DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. More
MAA Group Consulting Engineers
October 29, 2026
•[ ransomware, technology, manufacturing ]
MAA Group Consulting Engineers was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Professional Services. MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975, with over 1,000 professionals operating across East and Southeast Asia. The group provides comprehensive integrated solutionsranging from conceptual planning and engineering design to project managementacross infrastructure, buildings, land resources, environment, and information technology. Renowned for its industry-leading expertise in Building Information Modeling (BIM), MAA Group has successfully completed major high-speed rail, mass rapid transit (MRT), and tunnel projects throughout Taipei, Hong Kong, Bangkok, and Singapore.
The client data and internal documents youve leaked go well beyond what youve seen here. We have taken several terabytes of filesthis is just a small sample. In fact, we have obtained sensitive documents pertaining to virtually all of your clients.
Warning: You have 3 days to enter negotiations. Once the deadline passes, the negotiation window will be permanently closed and all exfiltrated data will be published. Additionally, the encrypted data will be rendered completely unrecoverable.
sample files:
https://mega.nz/file/CgxxTKCZ#PzGFlZt67HDF2oLsP4jn_W_QdrquHJpNAfVm-jXGYxo
https://mega.nz/file/2ogzwAyY#r8F31SFQTqyW6bzQA-e8HNzgw-rEW_gn7fhwY5TAByg
https://mega.nz/file/2gIRXQwY#-4IzU70FjqvSYotZoaJuod_H2P5sXoGTvsja9Patte0
https://mega.nz/file/alQU0JaT#2GgaPb1Z-z1xB1FfAd_NohXbfkbfRfhfZ_OwtxPd0cc [Sector: Construction]
corp-smart.com
October 29, 2026
•[ ransomware, technology ]
corp-smart.com was listed as a victim on the leak site of the everstake ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: corp-smart.com. Corporate Compliance
lyserp.com
October 29, 2026
•[ ransomware, technology, leak ]
lyserp.com was listed as a victim on the leak site of the dragonforce ransomware group; the attack is estimated to have taken place on 2026-10-29. Sector: Technology. Website: www.lyserp.com. ERP systems and automation: Inventory management, finance and accounting, logistics, production management and supply chain.
Aliqout Association
October 30, 2026
•[ ransomware, technology ]
Aliqout Association was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Country: United States of America. Website: aliquot.com. A multi-disciplinary civil engineering firm based in Walnut Creek, CA.
Psychometrics Canada
October 30, 2026
•[ ransomware, technology ]
Psychometrics Canada was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Professional Services. Country: Canada. Website: psychometrics.com. A company that works in the science of objective assessments for over 35 years.
NOVADATA
October 30, 2026
•[ ransomware, technology, finance ]
NOVADATA was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: Argentina. Website: novadata.com.ar. novadata.com.ar NOVADATA S.A. is an Argentine IT integration group founded in 1994 in Buenos Aires, comprising Novadata, Net Service and Compaa Global de Servicios with 130 plus certified professionals. It provides IT infrastructure, business continuity, AI, pay-per-use HPE GreenLake, microinformatics and 24/7 Service Desk services to major corporations across Argentina. It holds HPE Platinum, Microsoft Gold, Cisco Silver, VMware Enterprise and Symantec Gold partner certifications, adding Huawei Enterprise Authorized Reseller status in 2026. Major clients include Bayer, Veolia, La Annima, Petrobras, Citibank, Roche and Bimbo, many with over 10 years of partnership. The group completed a financial restructuring agreement from 2014, declared fulfilled by court in March 2026. Recent strategic moves include an AI alliance with AYI Group, Fortinet cybersecurity training and launch of Novadata GREEN IT asset disposition services.
CommTank
October 30, 2026
•[ ransomware, technology ]
CommTank was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-30. Sector: Technology. Country: United States of America. Website: commtank.com. commtank.com CommTank Inc is a US storage tank contractor founded in 1997 in Winchester, Massachusetts, specializing in installation, removal, inspection and maintenance of underground and aboveground storage tanks across New England and the Mid-Atlantic. With 50 to 100 employees and estimated revenue of 10 to 25 million dollars, it serves government facilities, hospitals, schools and industrial clients across 8 states. Its services cover the full tank lifecycle including UST and AST installation, leak testing, cathodic protection, soil remediation and emergency spill response. Led by founder Rick Connolly, it holds EPA, MA DEP, CT DEEP and NFPA certifications and runs its own field crews without subcontracting core work. It also provides Phase I and II environmental site assessments and SPCC compliance planning. The company has built a niche in high-barrier tank services requiring specialized licensing and regulatory expertise.
GIO Dental
October 28, 2026
•[ ransomware, healthcare, technology ]
GIO Dental was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-28. Sector: Healthcare. Country: Sierra Leone. Website: giodentalsl.com. giodentalsl.com GIO Dental SL is a modern dental clinic and laboratory founded by Nigerian dentist Dr. Gift Nwachukwu Obiorah in Freetown, Sierra Leone, with an additional location in Koidu, Kono District. It is Sierra Leone's first fully integrated dental provider offering clinical treatment, a prosthetics laboratory, dental technology education and equipment repair under one brand. Services span general and cosmetic dentistry, orthodontics, oral surgery, custom prosthetics fabrication and community oral health programs. Led by founder Dr. Gio, the company trains local dental technicians and runs outreach campaigns to make premium dental care accessible across the country. Its vertical model combining treatment, manufacturing and education is unique in the Sierra Leonean healthcare market. It also provides equipment repair and supply services to other dental clinics in the region.
