Kennametal
October 6, 2026
•[ ransomware, manufacturing, technology ]
Kennametal was listed as a victim on the leak site of the everest ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. Country: United States of America. [AI generated] Kennametal Inc. is an American industrial technology company headquartered in Pittsburgh, Pennsylvania. It specializes in manufacturing cutting tools, tooling systems, and wear-resistant materials used in metalworking, mining, energy, aerospace, and transportation industries. Kennametal designs products made from tungsten carbide and other advanced materials, serving industrial and infrastructure sectors worldwide, with operations across the Americas, Europe, and Asia.
Andersen Group
October 6, 2026
•[ ransomware, technology ]
Andersen Group was listed as a victim on the leak site of the SilentRansomGroup ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Professional Services.
AmplifAI (GoDaddy instance)
November 1, 2026
•[ ransomware, leak, technology ]
AmplifAI (GoDaddy instance) was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Technology. Country: United States of America. GoDaddy AmplifAI Instance Complete Data Dump
================================================
URL: https://godaddy.ampbi.net
Okta SSO: https://godaddy.okta.com
Okta App ID: exksdlj2ty3Pfq9En0x7 (AmplifAI)
Office 365 Federation: godaddy.okta.com/app/office365/exk3q5qqbpJoB61dF0x7
============================================================
USER DATABASE 13,565 unique employees
============================================================
File: all_users.json
Fields per user:
"name": "",
"email": "",
"userseq": ,
"firstname": "",
"lastname": "",
"ad_id": "",
"password": "",
"aduser": "true/false",
"usertype": "1/2/3/4",
"employeenumber": ""
User Type Key:
1 = Admin
2 = Manager
4 = Agent
Breakdown:
Total users: 13,565
AD users (Okta/SSO): 6,184
Non-AD users (local): 16
Admins (type=1): 459
Managers (type=2): 502
Agents (type=4): 5,239
Default password: 13,510
Non-default passwords: 9
============================================================
ORGANIZATIONS 34 total
============================================================
1. Agent Dashboard Organizations
1. DEM Sales_Support - ALL
2. DEM Sales_Support - GDDY
3. DEM Sales_Support - TP
4. GD International Independents
5. GD US Independents
6. Commerce - GDDY
7. Commerce - TP
8. DEM Sales_Support - SGS
9. EMEA Brands - ALL
10. EMEA Brands - GDDY
11. EMEA Brands - TP
12. GAO - GDDY
13. GD Teleperformance
14. Global Messaging Ops - GDDY
15. Global Messaging Ops - Genpact
16. Global Messaging Ops - SGS
17. Global Messaging Ops - TP
2. Performance Dashboard Organizations
18. ROW Sales_Support - ALL
19. ROW Sales_Support - Genpact
20. ROW Sales_Support - SGS
21. Services - SGS
22. US Sales_Support - SGS
3. Analytics Organizations
23. Global Messaging Ops - ALL
24. ROW Sales_Support - TP
25. Services - ALL
26. Services - GDDY
27. Services - TP
28. US Sales_Support - ALL
29. US Sales_Support - GDDY
4. Non Core Care Organizations
30. US Sales_Support - TP
31. Non Core Care - GDDY
32. Non Core Care - Genpact
33. Non Core Care - SGS
34. Non Core Care - TP
============================================================
LOGIN LOGS 4,451 records
============================================================
File: login_logs.json
Fields per record:
"Name": "",
"Title": "",
"Module": "",
"Access Date": "",
"Access Time": "",
"Time Zone": "",
"Access Device": "",
"Primary Program": "",
"Organization": "",
"Location": "",
"Manager Name": "",
"OpsManager Name": ""
Sample locations: India - Teleperformance, Peru - Teleperformance, USA - GoDaddy
Sample devices: Desktop, Mobile
============================================================
ROSTER DATA 1,201 records (1,193 with @godaddy.com emails)
============================================================
File: roster.json
Fields per record:
"RosterExportID": "",
"companyguid": "51841AF1-EA61-4091-9106-C461ED5293A8",
"employeeid": "",
"email": "",
"fname": "",
"lname": "",
"managerid": "",
"pbxid": null,
"location": "",
"primaryprogram": "",
"title": "",
"recorddate": "",
"hiredate": null,
"termdate": null,
"loginuserid": "",
"customfield1": null,
"customfield2": null,
"customfield3": null,
"customfield4": null,
"customfield5": null,
"customfield6": null,
"customfield7": null,
"customfield8": null,
"customfield9": null,
"customfield10": null,
"otherprogram1": null,
"otherprogram2": null,
"otherprogram3": null,
"otherprogram4": null,
"otherprogram5": null,
"otherprogram6": null,
"otherprogram7": null,
"otherprogram8": null,
"otherprogram9": null,
"otherprogram10": null,
"varcharemployeeid": "",
"varcharmanagerid": "",
"organization": "",
"movedToCosmos": "False",
"glidepathtitle": null,
"gltitleid": null,
"coach": null,
"programstartdate": null,
"RequestID": ""
Roster by Organization:
US Sales_Support - GDDY: 405 records
Global Messaging Ops - Genpact: 191 records
EMEA Brands - GDDY: 176 records
Commerce - GDDY: 135 records
DEM Sales_Support - GDDY: 103 records
ROW Sales_Support - SGS: 101 records
Commerce - TP: 41 records
Non Core Care - Genpact: 37 records
Services - TP: 12 records
----------------------------------------
TOTAL: 1,201 records
25 organizations have no roster data available.
============================================================
PROGRAMS 227 unique GoDaddy call center programs
============================================================
File: programs.json
Categories include:
Sales: Inbound Sales I/II/III, Email Sales, Outbound Sales, Specialty Sales
Support: C3 Support (English/German/Spanish/Arabic/Turkish/Cantonese/Mandarin)
Messaging: General, Hosting, Email, Sales, Arabic, Cantonese, Mandarin, Spanish, India, RoW
Commerce: Commerce Inbound, Commerce Outbound, Commerce Sls PS
Geographic: UK & IE, CA & AU, LATAM, EMEA, International English
Security: Website Security Sales I/II, Website Security Support
Hosting: Hosting Support Web Pro, Server Admin Support, Tech Services
============================================================
OKTA / ACTIVE DIRECTORY INTEGRATION
============================================================
Okta Tenant: https://godaddy.okta.com
AmplifAI App: godaddy_amplifai_1 (exksdlj2ty3Pfq9En0x7)
Office 365 App: exk3q5qqbpJoB61dF0x7 (federated via same Okta)
SAML SSO: SAML 2.0
OIDC Discovery: https://godaddy.okta.com/.well-known/openid-configuration
Authn API: POST https://godaddy.okta.com/api/v1/authn
(accepts JSON {username, password}, returns sessionToken on success)
Password Grant: Supported (grant_type=password in OIDC config)
AD User Identity Format:
"Login/AD/NT Id" field = Windows domain login (e.g., dfolz, axbrown, mgoldstin)
Okta accepts: username, username@godaddy.com, EMAIL format
Reach out on session or be the next headline
https://getsession.org
ID: 05aef1af8fa855545d00fb4feb9dbef83b658313f06d97ad57736191120a7bf23c
fzmb GmbH, Forschungszentrum für Medizintechnik und Biotechnologie
November 1, 2026
•[ ransomware, healthcare, technology ]
fzmb GmbH, Forschungszentrum fr Medizintechnik und Biotechnologie was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Healthcare. Country: Germany. Website: www.fzmb.de.
Dynamic Office Solutions
October 1, 2026
•[ ransomware, technology ]
Dynamic Office Solutions was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Professional Services. Country: United Kingdom of Great Britain and Northern Ireland. Website: www.dynamicos.co.uk.
VPNE
September 24, 2026
•[ ransomware, technology, leak ]
VPNE was listed as a victim on the leak site of the genesis ransomware group; the attack is estimated to have taken place on 2026-09-24. Sector: Technology. Website: .. A company that specializes in managing people, transportation and other services for its clients in various industries
Inova Semiconductors GmbH
October 2, 2026
•[ ransomware, manufacturing, technology ]
Inova Semiconductors GmbH was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Manufacturing. Country: Germany. Website: inova-semiconductors.de.
Eteam
September 29, 2026
•[ ransomware, technology ]
Eteam was listed as a victim on the leak site of the BYOD ransomware group; the attack is estimated to have taken place on 2026-09-29. Sector: Technology. Eteam was informed they had been breached, just ignored us, we are not giving any more chances, Enjoy their full BPO list EXTREME PII (some of the most sensitive shit any company has). Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you.
Millensys
October 5, 2026
•[ ransomware, technology ]
Millensys was listed as a victim on the leak site of the medusalocker ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Technology. Country: Brazil. Website: millensys.com. Organization with 2 emails extracted. Domain: millensys.com
Praxis EMR
September 17, 2026
•[ ransomware, healthcare, technology ]
Praxis EMR was listed as a victim on the leak site of the insomnia ransomware group; the attack is estimated to have taken place on 2026-09-17. Sector: Healthcare. Country: United States of America. Website: www.praxisemr.com. Praxis EMR is a highly rated EHR for physicians and medical providers, using AI to boost efficiency and accuracy. It lets clinicians document in their own words, improving usability, satisfaction, and time spent on patient care.
Medical Data Rx
September 5, 2026
•[ ransomware, healthcare, technology ]
Medical Data Rx was listed as a victim on the leak site of the VYPR ransomware group; the attack is estimated to have taken place on 2026-09-05. Sector: Healthcare. Country: United States of America. Website: www.tsgpc.com. Technical Solutions Group, located in the heart of Mid-Michigan, is dedicated to assisting small businesses with their technology, advertising, and networking requirements. Their mission is to equip offices with top-quality computers, technology services, advertising solutions, and networking solutions to enhance workflow efficiency and cost-effectiveness. They offer PC and hardware sales, IT networking solutions, IT management and technical support, and server hosting services. With a focus on client satisfaction, they have a proven track record of delivering reliable support and solutions to businesses in need.
magnals.com
October 6, 2026
•[ ransomware, leak, legal ]
magnals.com was listed as a victim on the leak site of the incransom ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Other. Country: United States of America. Website: magnals.com. confidential data belonging to all these companies; magnals.com is responsible for the leak.
alunanuova@magnals.com
sraynal@magnals.com
info@ranshelpfi.com
kcawley@kirkland.com
pforan@hueston.com
mtodisco@hueston.com
sschnier@hueston.com
tking@hueston.com
lcohen@omm.com
lhack@motleyrice.com
monica.pedroza@morganlewis.com
thomas.hilton@morganlewis.com
kvose@motleyrice.com
lshaarda@motleyrice.com
mmontoya@skikos.com
tamara.giulianelli@morganlewis.com
karl.stampfl@kirkland.com
lshuler@hueston.com
khermiz@motleyrice.com
zachary.byer@kirkland.com
paul.weeks@kirkland.com
mpendell@motleyrice.com
mrivera@kirkland.com
mrobinson@robinsonfirm.com
zac.ciullo@kirkland.com
kcalcagnie@robinsonfirm.com
mcrawford@skikos.com
pdagostino@robinsonfirm.com
maureen.barber@morganlewis.com
pwilson@occourts.org
judith.hanratty@morganlewis.com
lelliott@motleyrice.com
Paulie.Fabian@da.ocgov.com
kding@hueston.com
mkaba@hueston.com
jhueston@Hueston.com
lstarks@hueston.com
mpurpura@hueston.com
smayer@hueston.com
tbecerra@omm.com
rebecca.zieben@morganlewis.com
kgrossman@omm.com
jschneller@omm.com
rmassing@hueston.com
mkaiser@omm.com
meimark-itc-1290@meimark.com
rwells@meimark.com
kdeighan@calfee.com
jhartman@merchantgould.com
jmiller@merchantgould.com
dylansuggsvideo@gmail.com
mso@levinperconti.com
MMirkovic@levinperconti.com
production@magnals.com
b.scott@magnals.com
samuel.ventresca@blankrome.com
JFeigenbaum@PostSchell.com
dspencer@magnals.com
jfrancis@magnals.com
dbrown@magnals.com
nbernik@magnals.com
mcantu@magnals.com
shorwitz@maganls.com
jtaran@jtaranlaw.com
michael@martinovskylaw.com
lori@costanzo-law.com
lucy.goodnough@costanzo-law.com
lawdesk@lex-omni.com
babbdesignsinc@gmail.com
gt@turitzadr.com
fburke@burkemediation.com
skaplan@Steptoe.com
mail@questvideoservice.com
balindadunlap@yahoo.com
lucy.marrone@costanzo-law.com
smisbah@steptoe.com
standard
shorwitz1@gmail.com
jnuttall@Steptoe.com
ktellez@steptoe.com
casey.griffin@ankura.com
marc.blanch@ankura.com
ECarapella@littler.com
rwangsness@occourts.org
mdjuric@omm.com
vharting@occourts.org
rhickman@magnals.com
revaldez@omm.com
cmonroe@motleyrice.com
csuarez@Steptoe.com
tfu@Steptoe.com
jcooper@steptoe.com
nathan.carpenter@dlapiper.com
sivakumarm@ballardspahr.com
sbylina@ziliak.com
disaacs@morrisoncohen.com
Michelle.Gorman@lewisbrisbois.com
kayla.clark@morganlewis.com
djensen@skikos.com
rklink@motleyrice.com
katherine.vaky@morganlewis.com
madock@rescar.com
aschaffer@rescar.com
mshepard@babstcalland.com
carolwarfield2005@yahoo.com
mlmarais@gmail.com
sean.nicholson@cornell.edu
justin.mccrary@gmail.com
minnie@b-henry.com
BVinci@duanemorris.com
jgoldsmith@magnals.com
mdundervill@motleyrice.com
karen.angelo@lewisbrisbois.com
rbaeza@bsfllp.com
vayala@bsfllp.com
teutafani@quinnemanuel.com
violatrebicka@quinnemanuel.com
joten@hueston.com
ddelgrande@hueston.com
edunbar@magnals.com
bmccafferty@magnals.com
VNestor@magnals.com
MJimenez@ktanda.com
HValgoi@magnals.com
VRice@ktanda.com
HPorter@CHDLawyers.com
eflorian@coplancrane.com
david@yegeresq.com
scaldwell@pmtlawfirm.com
gstrong@gllawgroup.com
mguararra@guararralaw.com
RFUMO@travelers.com
manan74@yahoo.com
johara@fbzlaw.com
dperkins@robinsonfirm.com
sfranklin@magnals.com
sarajenkins@quinnemanuel.com
dstraite@dicellolevitt.com
brichardson@BSFLLP.com
rmcgee@forthepeople.com
jcabezas@forthepeople.com
wsangster@magnals.com
SWood@chuhak.com
cemling@cyp-law.com
chartley@magnals.com
RKrishnapriyan@durietangri.com
enyborg-burch@bsfllp.com
trodriguez@bsfllp.com
jomairecrawford@quinnemanuel.com
carlspilly@quinnemanuel.com
eharding@magnals.com
ABrausa@durietangri.com
VRanieri@durietangri.com
drew@kzllp.com
michael@skipti.com
ttucker@calfee.com
bliu@calfee.com
dlikens@calfee.com
outsider12b@hanmail.net
ProcopioITC1290@procopio.com
youngmin.hwang@lge.com
hojun.suh@lge.com
jaeoak.kho@lge.com
jin.seomoon@lge.com
Nicholas.jackson@dentons.com
Kevin.greenleaf@dentons.com
Tyler.goodwyn@dentons.com
Mark.hogge@dentons.com
Song.jung@dentons.com
alexjo.translator@gmail.com
annpark@pacls.com
kuyoung.son@lge.com
byunghwan.ahn@lge.com
tg.kong@lge.com
ejmichelle@gmail.com
Vivian.sandoval@dentons.com
Matthew.sim@dentons.com
Nah-eun.kim@dentons.com
jhochberger@meimark.com
jzhang@meimark.com
mei@meimark.com
rmyers@prmpclaw.com
kfisch@Steptoe.com
sreid@steptoe.com
willowashlynn@gmail.com
vikashni@vashlegalservices.com
sbowlby@plunkettcooney.com
arodas@magnals.com
rkappers@steptoe.com
tyebernetsky@Steptoe.com
dgelwicks@Steptoe.com
kcappaert@steptoe.com
bholt@steptoe.com
tmurray@magnals.com
amanda@levinzeiger.com
mmiller@steptoe.com
johnsmith@supercoolattorneys.org
AnnieLee@mofo.com
ckwark@steptoe.com
pbirdsall@steptoe.com
johnsmith@magnals.com
VCTeam@magnals.com
EDFelectronics
October 6, 2026
•[ ransomware, manufacturing, technology ]
EDFelectronics was listed as a victim on the leak site of the Panzer ransomware group; the attack is estimated to have taken place on 2026-10-06. Sector: Manufacturing. EDFelectronics.com is a Polish engineering company that develops specialized electronics and plasma technology for industrial and research applications.
Raqib
October 7, 2026
•[ ransomware, technology ]
Raqib was listed as a victim on the leak site of the UmBra ransomware group; the attack is estimated to have taken place on 2026-10-07. Sector: Technology. Raqib is a Saudi cybersecurity and digital surveillance company based in Riyadh, providing monitoring and security solutions with a small dedicated team.
SANAtech Global Solutions
October 7, 2026
•[ ransomware, technology ]
SANAtech Global Solutions was listed as a victim on the leak site of the UmBra ransomware group; the attack is estimated to have taken place on 2026-10-07. Sector: Technology. SANAtech Global Solutions is an Egypt-based IT services and software development company located in Cairo, delivering customized technology solutions with a dedicated team of around 25 employees.
My Cloud Grocer
November 1, 2026
•[ ransomware, retail, technology ]
My Cloud Grocer was listed as a victim on the leak site of the direwolf ransomware group; the attack is estimated to have taken place on 2026-11-01. Sector: Retail & E-Commerce. Country: United Kingdom of Great Britain and Northern Ireland. Website: mycloudgrocer.com. Software
Wesmar
October 1, 2026
•[ ransomware, manufacturing, technology ]
Wesmar was listed as a victim on the leak site of the akira ransomware group; the attack is estimated to have taken place on 2026-10-01. Sector: Manufacturing. Country: United States of America. WESMAR specializes in advanced marine technology, offering a range of products including thrust
ers, propulsion systems, and commercial fishing sonar. Their innovative solutions cater to vari
ous clients, from cruise boats and luxury yachts to commercial fishing operations, ensuring enh
anced stability, comfort, and efficiency at sea.
We will upload 66gb of corporate data soon. Employee personal documents (passports, DLs, death
certs), financials, lots of projects, credit cards, payment details, client information, NDAs a
nd so on.
Electro Heat Sweden AB
October 2, 2026
•[ ransomware, manufacturing, energy ]
Electro Heat Sweden AB was listed as a victim on the leak site of the rhysida ransomware group; the attack is estimated to have taken place on 2026-10-02. Sector: Energy & Utilities. Country: Sweden. Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing industries all over the world.Files: 1,723,527Data volume: 2,55 TBAll intellectual property - SolidWorks CAD designs of every product, backups of the PDM drawing vault.All accounting and payroll - Visma databases and SPCS payroll databases of four legal entities.Legally sensitive material - confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, cost-pricing calculations.Employee personal data - passport details, visa applications (passport, address, phone, DOB ), insurance policies.Contracts and acceptances - signed agreements and acceptance certificates with Hitachi, ABB, Scania and other customers. More
Fluge Audiovisuales
October 5, 2026
•[ ransomware, technology ]
Fluge Audiovisuales was listed as a victim on the leak site of the lamashtu ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Other. Country: Spain. Website: fluge.es. Fluge Audiovisuales is a Spanish company and market leader in AV equipment rental (sound, lighting, video, staging) for concerts, festivals, corporate events, TV and film. It operates across Spain (Madrid, Barcelona, Bilbao, Valencia, Ibiza, Galicia)
Company #3
October 5, 2026
•[ ransomware, technology ]
Company #3 was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-05. Sector: Technology. Country: United States of America. IT managed services United States | [PENDING EXPOSURE: data publishes 2026-10-07 00:46 UTC]
