Gress Clark Young & Schoepper
October 10, 2026
•[ ransomware, technology, healthcare ]
Gress Clark Young & Schoepper was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Professional Services. Country: United States of America. Website: gressandclarklaw.com. Gress Clark Young & Schoepper 167,804 files / ~166.4 GBBanking details - of the firm and its clients.SSNs + signatures of clients/witnesses; W-9, I-9 forms with DL/SSN card copies; W-4 forms.BIIA case-management procedures (Board of Industrial Insurance Appeals): default orders (Order of Default), internal 'Conference Questions', consulting-fee payments to experts.Firm finances: the firm's QuickBooks company file, VOID checks bearing signatures, expert-payment records, SaaS invoices.Medical photos and imaging; hundreds of pages of PHI/APF (Activity Prescription Forms) - X-rays, complete medical records.'Coaching' letters to doctors - including a letter to the physician in the Jachacy matter with wording indicative of steering a medical opinion ('coaching letter') - a potential ethics violation regarding witness handling.Credentials/access to the SPC e-file system (court e-filing).Disciplinary action against partner Daniel W. Gress. More
TERRACOM & MONTCAU
August 29, 2026
•[ ransomware, technology ]
TERRACOM & MONTCAU was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-08-29. Sector: Other. Montcau ERP SaaS is a Spanish cloud-based ERP and POS solution developed by Terrassenca de Telecomunicacions, SLU (Terracom), designed for the management of production, sales, retail operations, in...
Confluent
October 10, 2026
•[ ransomware, technology ]
Confluent was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Technology. Country: United States of America. Website: confluent.io. confluent.io Revenue $1.16 Billion Confluent is the enterprise data streaming platform built on Apache Kafka that lets companies process live events like payments, orders and sensor data in real time, and it is now owned by IBM which bought it for about $11 billion in March 2026. It ended 2025 with 6,690 customers including roughly 40% of the Fortune 500 and grew revenue 21% with its cloud segment alone growing 27%. Customers include BMW, L'Oreal, Michelin and Ticketmaster and the platform runs across 60+ cloud regions on AWS, Azure and Google Cloud. Money comes from cloud usage and software subscriptions, about 96% of revenue, paid for compute and data transfer rather than per-seat fees. Around 3,241 employees worked at Confluent across 27 countries before the IBM deal and it owns no factories or stores because its product is pure software and cloud. Confluent was still unprofitable with a $295 million loss in 2025 though it earned positive operating income excluding stock pay.
Placer AI
October 10, 2026
•[ ransomware, technology, retail ]
Placer AI was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Technology. Country: United States of America. Website: placer.ai. placer.ai Revenue $136.5 Million private US company valued at $1.5 billion that sells foot traffic analytics for physical locations, estimating visits to stores, malls and offices from anonymized data on tens of millions of mobile phones with 92%+ claimed accuracy. It hit $100 million annual recurring revenue in 2024 after growing 80% in a year and serves 4,000+ customers including Sony, Wegmans, BJ's Wholesale, SeaWorld and Bloomberg, which puts Placer data into its Terminal so investors can track company performance before earnings. Money comes from SaaS subscriptions starting around $12,000 a year, API data feeds and add-on datasets, and it has raised $268 million in total funding. Around 630 employees work at Placer.ai after 150 layoffs in January 2025 aimed at reaching profitability, and it owns no factories or stores because its product is pure software and data.
Louis Fusco
October 12, 2026
•[ ransomware, leak, technology ]
Louis Fusco was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-12. Louis Fusco Landscape Architects is a full-service landscape architectural design firm led by p
rincipal Louis Fusco. The firm is recognized for its site-sensitive creative designs and meticu
lous attention to detail, resulting in award-winning projects featured in landscape journals.
We will upload 465gb of corporate data soon. Employee information (passport and DLs scans and s
o on), projects (drawings, specifications), clients and partners info, lots of agreements and s
o on.
CULines (container shipping)
October 12, 2026
•[ ransomware, technology, manufacturing ]
CULines (container shipping) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: China. Container shipping China | Operational EDI message archives (booking and container manifest records) | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
The Buckner Company, Inc.
October 13, 2026
•[ ransomware, leak, finance ]
The Buckner Company, Inc. was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-10-13. Sector: Other. Country: United States of America. Website: The Buckner Company, Inc.. [insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado.
The exfiltrated dataset includes:
1,500+ plaintext credentials Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennetts file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts.
Employee SSNs for 150250 individuals W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (20192022), plus 2023 W-2 and 1099-NEC reports.
316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history every employees salary, bonus, and benefits laid bare.
A complete M&A acquisition pipeline 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents).
128 Outlook PST email archives spanning years of business correspondence.
Corporate tax returns for Buckner (20042024), Citrus Insurance LLC (20212023), and Consolidated Agencies (20222023).
7 named individuals driver license scans and the Applied Epic insurance management database (Epic.mdf).
Machine sro
October 6, 2026
•[ ransomware, manufacturing, automotive ]
Machine sro was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: Czechia. Website: k2machine.cz. k2machine.cz zoominfo.com/c/machine-sro/537154777 K2 Machine s.r.o. is a private Czech industrial machinery manufacturer founded in 2011 in Pardubice, Czech Republic, growing from 3 founders in a small office to ~2550 employees and 400+ completed projects over 15 years. Annual turnover is 100+ million CZK (~4M), though 2024 saw a sharp 18.7% revenue decline (operating revenue 27.7%). The company designs and builds special-purpose machines, automated production lines, robotic cells (including 3D Bin Picking), conveyor systems, and performs CNC machining, equipment repowering, and line relocation serving primarily the automotive and consumer industries. Its full-cycle capability spans Solid Edge 3D design, EPLAN electrical engineering, CNC production, assembly, commissioning, and after-sales service under one roof at its own Semtn campus (since 2020).
Kooltronic
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kooltronic was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. Website: kooltronic.com. kooltronic.com Kooltronic, Inc. is a private, family-owned manufacturer of enclosure cooling products (air conditioners, heat exchangers, fans) founded in 1956 in Princeton, NJ, now based in Pennington, NJ on a 170,000 sq ft facility powered by 90% solar energy. Owned by the Freedman family since 1970 (President: Barry Freedman), the company generates estimated annual revenue of $3545M with 5887 employees (~$650K$750K revenue per employee very high for a manufacturer). Kooltronic invented the world's first closed-loop enclosure air conditioner in 1967 and holds a US patent for Hazardous Location AC systems (NEC Class I Div 1&2), giving it a unique market niche. It offers the industry's widest range 2,00030,000 BTU/H units across all NEMA ratings with 100% in-house production, UL-certified testing labs, and ISO 9001:2015 certification. The company is women-owned (WBE) (CEO Anne Freedman), holds $20.5M in 401(k) assets (stable finances), and is expanding into fast-growing BESS
Aquatech
October 6, 2026
•[ ransomware, energy, technology ]
Aquatech was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Energy & Utilities. Country: United States of America. Website: aquatech.com. aquatech.com zoominfo.com/c/aquatech-international-llc/2523742 Aquatech International Corporation is a private water treatment technology company founded in 1981 and headquartered in Canonsburg, Pennsylvania, with operations in 26 countries and 1,000+ projects across 60+ countries. It generates estimated annual revenue of $105165M and employs 9001,368 people globally (growing +31% per year). Aquatech is the world's leading Zero Liquid Discharge (ZLD) provider (160+ installations) and a major desalination player its Corpus Christi, Texas plant (30 MGD) will be the third-largest SWRO facility in the Americas. The company won the prestigious "Water Technology Company of the Year 2025" (Global Water Awards) and acquired three companies in 2025 (Century Water, Koch Li-Pro DLE, FTS H2O) to dominate lithium extraction (PEARL platform) and ultrapure water for semiconductors. Led by CEO Devesh Sharma and President/CTO Ravi Chidambaran, with a private equity investor entering in 2025.
astranahealth.com
October 9, 2026
•[ ransomware, healthcare, technology ]
astranahealth.com was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-10-09. Sector: Healthcare. Country: United States of America. Website: astranahealth.com. The company's management decided to pull out of the deal with us in order to save money. The data and diagnoses of millions of patients have been published in their entirety. The total data volume is 1,500 GB.
Astrana Health, Inc. is a physician-centric, technology-powered healthcare company headqu
Secretaría de Modernización e Innovación del Municipio
October 10, 2026
•[ ransomware, government, technology ]
Secretara de Modernizacin e Innovacin del Municipio was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Government & Defense. Country: Argentina. Website: www.riogrande.gob.ar.
Helwan University (HITU)
October 10, 2026
•[ ransomware, education, technology ]
Helwan University (HITU) was listed as a victim on the leak site of the UmBra ransomware group; the attack is estimated to have taken place on 2026-10-10. Sector: Education. Country: Egypt. Website: helwan.edu.eg. Helwan International Technological University a pioneering Egyptian institution offering cutting-edge programs in Cybersecurity, Data Science, Artificial Intelligence, and Mechatronics, equipped with advanced labs and strong industry partnerships to prepare students for the digital future.
HYSYTECH S.r.l.
October 2, 2026
•[ ransomware, manufacturing, technology ]
HYSYTECH S.r.l. was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Manufacturing. Country: Italy. HYSYTECH S.r.l. is an Italian engineering and technology company that designs and builds industrial processing plants, specifically systems for the production and processing of hydrogen, biomethane...
ETICOD
August 9, 2026
•[ ransomware, manufacturing, technology ]
ETICOD was listed as a victim on the leak site of the Majinahanashi ransomware group; the attack is estimated to have taken place on 2026-08-09. Country: Poland. Website: eticod.pl. Eticod is a family-run, prominent label printing house based in Katowice, Poland, founded in 1994. It specializes in self-adhesive labels, barcodes, thermal transfer ribbons, and advanced packaging...
CNESTEN
October 11, 2026
•[ ransomware, government, technology ]
CNESTEN was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-11. Sector: Government & Defense. Country: Morocco. Website: kerix.net/fr/annuaire-entreprise/cnesten.
Spelman Logistics
October 11, 2026
•[ ransomware, technology, manufacturing ]
Spelman Logistics was listed as a victim on the leak site of the emperador ransomware group; the attack is estimated to have taken place on 2026-10-11. Sector: Transportation. Website: spelmanlogistics.com. Dear Spelman Logistics,
We are now in possession of 1.2M contact records (emails and phone numbers), 245K carrier profiles complete with EIN and SSN, 57K bank accounts including routing numbers, 334K live document URLs, and 4.5M carrier registry entries pulled from your MVMNT TMS.
Your exposure extends well beyond your own walls. We have also reached into the systems of your partners, including:
ALG Canada Inc
Line Transportation Inc
Maverick Acquisition Ventures Inc
Reliable Freight Solutions
Rhode Sense
and more.
If you would rather not have us contact your partners and make life difficult for your employees, we suggest you pay the following: $500,000 in BTC or XMR.
You will shortly receive an email explaining how to reach us. If that fails, contact us at:
Email: emperadorlol@proton.me / xdlmfao@morke.ru
Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Manufacturing, Transportation]
Cognosis Limited
October 11, 2026
•[ ransomware, technology ]
Cognosis Limited was listed as a victim on the leak site of the nightspire ransomware group; the attack is estimated to have taken place on 2026-10-11. Sector: Technology. Country: United Kingdom of Great Britain and Northern Ireland.
TTI Algeciras (container terminal operations)
October 12, 2026
•[ ransomware, leak, technology ]
TTI Algeciras (container terminal operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Spain. Port terminal operations Spain | Operational EDI message archives and internal terminal systems documentation | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
VIATechnik
October 12, 2026
•[ ransomware, technology ]
VIATechnik was listed as a victim on the leak site of the metaencryptor ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Technology. Country: United States of America. Website: www.viatechnik.com. VIATechnik is a digital transformation leader in the AEC industry.
Data size: 12.5 TB
