Undisclosed ransomware-as-a-service group
January 1, 2025
•[ ransomware, healthcare, transportation ]
CSE identified an undisclosed ransomware-as-a-service group responsible for more than 25 incidents affecting Canadian transportation, healthcare, pharmaceutical, and business organizations. Working with Five Eyes partners and law enforcement, CSE rendered the group's infrastructure inoperable and deleted a large amount of stolen data advertised for sale. CSE separately reported disruptions against parts of the infrastructure of 10 ransomware groups but did not state whether this group was included among them.
Santos Brasil (port operations)
October 12, 2026
•[ ransomware, transportation ]
Santos Brasil (port operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Brazil. Port terminal operations Brazil | Terminal operating system database scripts and operational records | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Premier Alliance (shipping network operations)
October 12, 2026
•[ ransomware, leak, transportation ]
Premier Alliance (shipping network operations) was listed as a victim on the leak site of the N0n ransomware group; the attack is estimated to have taken place on 2026-10-12. Sector: Transportation. Country: Netherlands. Shipping / terminal services Netherlands | Terminal network documentation and operational EDI archives | [NOT PAID EXPOSED: files publish 2026-10-19 13:27 UTC]
Aerotop
October 23, 2026
•[ ransomware, transportation ]
Aerotop was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-10-23. Sector: Transportation. Country: Chile. Website: aerotop.cl.
Ryder
October 27, 2026
•[ ransomware, transportation, leak ]
Ryder was listed as a victim on the leak site of the Whitearmor ransomware group; the attack is estimated to have taken place on 2026-10-27. Sector: Transportation. Country: United States of America. Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions.
What we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver/associate PII, cleartext API keys, LMS credentials, FTP/telematics configs from RyderView, RLM, EFT.
Our demand is only $20M in BTC... i swear.
Samples can be found below.
Emails with instructions will be sent to Ryder shortly, and no we did not buy access from 'shadowbyte' or whatever the niggas name is on pwnforums.
Contact if you do not receive the instructions:
Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67
Email: whitearmorrxd@proton.me
Alicotrans
September 14, 2026
•[ ransomware, transportation ]
Alicotrans was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-09-14. Sector: Transportation. Country: Brazil. Website: www.alicotrans.com.
goriteway.com
September 29, 2026
•[ ransomware, leak, transportation ]
goriteway.com was listed as a victim on the leak site of the BrainCipher ransomware group; the attack is estimated to have taken place on 2026-09-29. Country: United States of America. Website: goriteway.com.
CONTINENTAL.AERO
August 7, 2026
•[ ransomware, transportation, leak ]
CONTINENTAL.AERO was listed as a victim on the leak site of the clop ransomware group; the attack is estimated to have taken place on 2026-08-07. Sector: Transportation. Country: United States of America. Website: CONTINENTAL.AERO.
aircreebec.ca
July 6, 2026
•[ ransomware, transportation ]
aircreebec.ca was listed as a victim on the leak site of the chaos ransomware group; the attack is estimated to have taken place on 2026-07-06. Sector: Transportation. Country: Canada. Website: aircreebec.ca. Air Creebec, founded in 1982, is a regional airline company based Waskaganish, Quebec. The company provides regular flights, air charter, medical transportation, and cargo services.
Metro Mondego
July 16, 2026
•[ ransomware, transportation ]
Metro Mondego was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-07-16. Sector: Transportation. Country: Portugal. Website: metromondego.pt. ***.pt zoominfo.com/c/metro-mondego-sa/430685182 public transport company responsible for sustainable mobility in the Coimbra, Miranda do Corvo, and Lous region of Portugal. Originally conceived as a light rail network, the project has been restructured into a fully electric, high-capacity Bus Rapid Transit system known as Metrobus. The network spans 42 kilometers with 42 dedicated stations and 35 electric buses, designed to provide efficient, eco-friendly, and integrated urban transportation for an estimated 13 million passengers annually
Van Eijck International Car Rescue
July 30, 2026
•[ ransomware, transportation ]
Van Eijck International Car Rescue was listed as a victim on the leak site of the aurora ransomware group; the attack is estimated to have taken place on 2026-07-30. Sector: Transportation. Country: Netherlands. [recovery, rescue] Van Eijck International Car Rescue B.V. a family-owned Dutch towing and recovery company with 225+ vehicles, 180+ employees, and 20 branch offices across the Netherlands and Spain.
The exposed material includes:
227 employee home directories (156 GB) containing personal documents, tax forms (loonheffingen), salary records, photos, and financial data.
12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations.
10 years of customer claims data (20102019) 500+ individual claims with damage assessments, insurance details, and customer PII.
Complete Google Workspace backup (CubeBackup) Gmail, Drive, and Calendar for 18 user accounts and 206 groups.
Kriete Truck Centers
June 5, 2026
•[ ransomware, transportation ]
Kriete Truck Centers was listed as a victim on the leak site of the securotrop ransomware group; the attack is estimated to have taken place on 2026-06-05. Sector: Transportation. Country: United States of America. Website: www.krietetrucks.com. Status: AWAITING
Size: 221 GB
GDL Transport
June 9, 2026
•[ ransomware, transportation, hack ]
GDL Transport was listed as a victim on the leak site of the worldleaks ransomware group; the attack is estimated to have taken place on 2026-06-09. Sector: Transportation. Country: Sweden. Website: www.gdl.se.
transvill
June 24, 2026
•[ ransomware, transportation ]
transvill was listed as a victim on the leak site of the nova ransomware group; the attack is estimated to have taken place on 2026-06-24. Sector: Transportation. Transvill SRL offers national and international road transport and logistics services for cargo shipments. Data profile is provided.
Berlinmobil.de
May 18, 2026
•[ ransomware, leak, transportation ]
Berlinmobil.de was listed as a victim on the leak site of the safepay ransomware group; the attack is estimated to have taken place on 2026-05-18. Sector: Transportation. Country: Germany. Website: Berlinmobil.de. Is a German transportation company headquartered in Berlin, specializing in bus charter services, passenger transportation, school transport, and mobility solutions
Pullen Moving
April 13, 2026
•[ ransomware, leak, transportation ]
Pullen Moving was listed as a victim on the leak site of the kairos ransomware group; the attack is estimated to have taken place on 2026-04-13. Sector: Transportation. Country: United States of America. Website: pullenmoving.com. Pullen Moving Company owns and operates two warehouses for storing household goods, office furniture, and industrial equipment in Woodbridge, VA as well as a fleet of vehicles for local, long distance, and international moving. We are proud members of the American Trucking
Bmtp
April 19, 2026
•[ ransomware, transportation ]
Bmtp was listed as a victim on the leak site of the thegentlemen ransomware group; the attack is estimated to have taken place on 2026-04-19. Sector: Transportation. Country: Thailand. Website: bmtp.co.th. bmtp.co.th zoominfo.com/c/bmtp/471078846 BMTP (BMT Pacific Ltd.) is a private container terminal and full-service logistics provider located in Bangkok, Thailand, operating along the Chao Phraya River. The company offers comprehensive import/export cargo handling including FCL/LCL containers, reefer cargo (225 plugs), oversized and dangerous goods as well as warehousing, fumigation, and on-site paperless customs clearance. BMTP is ISO 9001:2015 certified, has over 30 years of experience, operates 24/7, and is connected via barge to Laem Chabang deep-sea port
PLUS Malaysia Berhad
February 6, 2026
•[ ransomware, leak, transportation ]
PLUS Malaysia Berhad was listed as a victim on the leak site of the qilin ransomware group; the attack is estimated to have taken place on 2026-02-06. Sector: Transportation. Country: Malaysia. Website: www.plus.com.my.
CTI & Coordinators
March 2, 2026
•[ ransomware, transportation ]
CTI & Coordinators was listed as a victim on the leak site of the pear ransomware group; the attack is estimated to have taken place on 2026-03-02. Sector: Transportation. Country: United States of America. Website: cticoordinators.com. Freight transportation services throughout the United States and province of Ontario Canada
yurdriversnetwork
March 6, 2026
•[ ransomware, transportation ]
yurdriversnetwork was listed as a victim on the leak site of the killsec ransomware group; the attack is estimated to have taken place on 2026-03-06. Sector: Transportation. Country: United States of America. Website: yurdriversnetwork.com. Price ??? Disclosures 0/1
