- Victims · 7d6+2 vs prior week
- Victims · 30d16
- Victims · 90d32
- All-time (tracked)57since 2026-04-29
- Last post10-30 16:26UTC
- Estimated earnings—public reporting
Profile · grok-4.7 · updated Summaries by Vani AI
Aurora is a ransomware and data-extortion operation tracked through leak-site victim posts starting 29 July 2026. Activity tracked for this dashboard shows 22 listed victims in total through 5 October 2026, including 22 in 90 days, 4 in 30 days, and 2 in 7 days, so the operation is treated as active. Public 2026 headlines report that operators used the Cursor AI coding agent in attacks against about 10 targets; no exploit detail is included here. Listed victims span pharmaceuticals, legal, aviation services, logistics, industrial supply, retail, and other businesses, which looks opportunistic rather than single-sector. Suspected origin, payment wallets, and any reliably attributed CVEs are unknown.
Tactics & tooling
- Named-victim posts on a data-leak site consistent with data extortion
- Ransomware branding; encryption in every incident is not confirmed from the sources used here
- Public 2026 reporting of Cursor AI coding-agent abuse during intrusions
- Initial access method unknown
- Privilege-escalation and lateral-movement tooling unknown
- No publicly attributed CVE set
Targeted sectors
pharmaceuticalslegalaviation serviceslogisticsindustrial equipmentretailmedia and information services
Notable public victims
Laboratorios Roemmers SAICF, Thomas Y. Pickett & Co., Inc., Metrea LLC/Commuter Air Technology, Inc., Ishbia & Gagleard, P.C., SCA Logistik & Fulfillment GmbH, Benshaw, Inc., Jinny Beauty Supply, Infomedia A/S
Estimated earnings
No public figure.
Leak-site victims
57 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| Rapid Manufacturing | · 2d ago | Rapid Manufacturing — a 50-year-old electronics contract manufacturer in Anaheim, California with operations in Ensenada, Mexico. Rapid Manufacturing is not a household name. But it is a critical Tier-1 supplier to SpaceX (Falcon & Starship programs), Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace (RTX), and Millennium Space (Boeing). It builds the wire harnesses, electro-mechanical assemblies, and box builds that go inside rockets, missiles, and satellites. The exposed material includes: > ITAR-controlled engineering drawings and manufacturing processes for Falcon 9/Heavy, Starship, and Draco propulsion systems — RTD soldering acceptance criteria, visual inspection standards, cable thermocouple assemblies, and production master plans. 26 ITAR customer quoting accounts including SpaceX, Anduril, Northrop Grumman, Rocket Lab, L3Harris, Collins Aerospace, and Millennium Space — the complete defense/space revenue architecture. 600–1,200 employee records spanning US (SSN, bank accounts, payroll, I-9/immigration) and Mexico (RFC, CURP, IMSS, bank accounts, nóminas) with data from 2019 through August 2026. Attorney-client privileged materials — settlement agreements, severance terms, internal investigation files, and a recorded termination meeting (audio). |
| CP Manufacturing, Inc. | · 2d ago | CP Manufacturing, Inc. — a San Diego-based industrial manufacturer of waste sorting and recycling equipment (MRF systems) operating since the 1970s under the CP Group / CPG Sorting Technologies brand, with subsidiaries MSS Inc. (Nashville, TN), IMS Electronics Recycling, IMS Logistics, IMS Recycling Services, Material Sales, HMM, and UK partner Recycleye. The dataset includes complete server mirrors from HR, finance, engineering, legal, operations, and sales infrastructure, capturing the company's entire digital footprint: Sage/Epicor ERP accounting system for 8 entities (CPM, MSS, HMM, IMSR, IMSRE, MSIRE, CPGH, CP Global) with consolidated P&L showing $109.1M revenue, $10.2M net income, and $12.1M EBITDA for FY2024, plus multi-year budgets (2021–2024), daily cash reports, and AR/AP data ~340 Social Security Numbers with full identity packages (name, DOB, health coverage status, premium amounts, tax withholdings) across 4 entities via ACA 1095-C filings (2016–2022), biweekly payroll registers, 401(k) participant records, 10-year salary histories (2013–2023), and benefits administration across 5 carriers (Anthem, Blue Shield, SIMNSA, UNUM, Western Dental) Truist bank account details — routing number 053101121 and account number 1180009812409 for CP Manufacturing LLC, plus ACH payment batch files spanning August 2025 through August 2026 277+ GB of proprietary engineering IP — 22G of AutoCAD Electrical MRF designs with proprietary component catalogs (1.2G), 195G of Artec 3D scanner data for manufactured equipment, 38G of CNC laser fabrication data (Amada LCG3015 AJ / FabriWin), PCB board designs (5 boards), SolidWorks Electrical templates, and Epicor ERP Bill of Materials with proprietary part numbers 60+ customer contracts and 30+ NDAs with Republic Services, Waste Management, Recycleye/Nestlé, Cal-Waste, Balcones, Wasatch, and international partners, plus Declaration Partners acquisition due diligence documents, competitor proposals (BHS, Machinex, MISTRAL), and a… |
| EWM Group | · 4d ago | EWM Group — the parent group behind Bonmarché, Edinburgh Woollen Mill, and Peacocks, three of the UK's best-known value fashion chains. The exposed material includes: 503,878 loyalty programme member records — full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000–2026. ~21,000 employee records — salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity/paternity data, sickness absence, accident reports with injury details. 100+ GB of Outlook PST email archives — complete email histories for named staff members spanning years of business operations. 313+ SQL Server database backups across 122 unique databases — the entire digital brain of the retail operation. 83 GB of e-commerce transaction data — every online order from January 2021 to August 2026. |
| Meleghy Automotive & Cie. GmbH | · 4d ago | The exposed material includes: Passport/visa/student-admission dossiers Tesla Model Y/Opal tooling, CAD and DFM tree Employee contract and HR folders MEB/BMW NCAR metrology and plant-layout trees PLC/SPS/robot backups and cross-reference DBs TISAX/IATF audit and corrective-action records Restricted management meeting/WLAN record Browser profile SQLite databases |
| GreenbergFarrow | · 5d ago | GreenbergFarrow — a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada. The dataset spans three major divisions: Client Libraries (152 client folders, A–F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW. Corporate Library: The entire institutional memory — 24 years of accounting (invoicing, cleared checks, budgets from 2002–2026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards. Discipline Libraries (283 GB): Complete architecture reference library. The exposed material includes: 300–650+ individuals' personal data — SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs/salaries/home addresses, and an employee's complete termination package including Medicare enrollment and voicemail recording. 7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 2014–2023. Complete active litigation file for GF v. Storm/RFW (1:25-cv-03532) — complaint, amended complaint, answers to interrogatories, discovery requests and responses, settlement negotiations, D&O insurer correspondence, and engagement letters. The entire attorney-client privilege chain. FBI facility clearance documents — SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects. Complete acquisition records for 7 deals (5 completed + 2 in progress) including purchase prices, due diligence materials, certified financial statements, and wire instructions. |
| Ernesto Malvestiti S.p.A. | · 6d ago | Ernesto Malvestiti S.p.A. — a privately-held Italian manufacturer of precision aluminium die-cast and fine-blanked components, supplying BMW, Valeo, BorgWarner, Schneider Electric, Fiat/Stellantis, and 150+ other automotive OEM. The exposed material spans the company's entire operations: PAGHENET payroll database (1.1 GB SQL Server backup ×7 copies) — every employee's salary, IBAN bank account, codice fiscale (Italian tax ID), home address, and tax withholdings. Plus the INAZMST employee master database (181 MB ×5). GDPR Article 9 special-category data — medical fitness records, disability status, union membership lists, workplace injuries, occupational diseases, and stress assessments for the entire workforce. 50+ plaintext OEM portal credentials stored in a single file called accesso web.txt — BMW B2B, Brose SWP, Valeo, BorgWarner SAP, Schneider VFAST, Eaton, Fiat, Peugeot/PSA, and 40+ more. SQL Server administrator password for the payroll database server, stored in a plaintext ODBC registry export. ADP payroll SFTP credentials stored in WinSCP.ini — the channel used to transmit employee salary data to the external payroll processor. 614 MB of financial/controlling data — consolidated balance sheets (2024-2025), revenue by plant, P&L, transfer pricing documents, cash flow, competitor analysis, and banking relationships. 1.5 GB of engineering IP — 300+ fine blanking die designs, technical drawings (483 MB), press parameters, PLC programs, FANUC robot code, and R&D contracts. 160+ client/supplier contracts with pricing, commercial terms, and executed NDAs. 560+ job candidate CVs with full names, addresses, phone numbers, and career histories. |
| ARX Group SA | · 8d ago | ARX Group SA — one of Switzerland's premier engineering consultancies, with 25+ offices in 17+ countries, known for iconic projects including the Ceneri Base Tunnel and dozens of USTRA/SBB federal infrastructure contracts. The exposed material includes: 9,510 project fee structures with internal/external billing rates for every engineer — the complete pricing intelligence for one of Switzerland's largest infrastructure consultancies. 8 GB of Ceneri Base Tunnel documentation — as-built engineering records for Swiss national critical infrastructure. 881,205 time entries spanning years of daily work activity for every employee, with task descriptions and project assignments. |
| Allmand-Smith Limited | · 10d ago | Allmand-Smith Limited (trading as Stormguard) — a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent. Domain admin credentials in plaintext and a full DC dump — STORMGUARD\MichaelAdmin / 5t0rmGuard Complete NatWest banking infrastructure — blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15 entities. NatWest has 3 outstanding registered charges (Jun 2026). Full payroll for every employee, current and former — Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records. Complete financial records for 15 entities — Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan, Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds, plus the consolidated age200_AllmandSmithLtd.bak (2.1 GB). Management accounts (Jan–Jul 2024), nominal trial balances, bank reconciliations (£102,662 cash at year-end). Revenue: £17.66M, profit: £1.01M, financial health: 12/100 (distressed). |
| Duarte Nursery, Inc. | · 12d ago | Duarte Nursery, Inc. is a wholesale deciduous fruit and nut tree nursery in Hughson, California — an S Corporation run by brothers John and Jeff Duarte. The dataset is the company's complete digital footprint: 300–500 full Social Security numbers from California DE9 quarterly employment tax filings (2024 Q1 through 2026 Q2). The owners' complete identity packages — John Duarte: SSN 545-67-5279, DOB 9/9/1966, DL C3261756, BofA account 325107115395. Jeff Duarte: SSN 545675712, DOB 7/19/1969. Bank account and routing numbers for ~100 employees via NACHA ACH direct deposit files — plus the company's own BofA commercial account credentials and wire transfer instructions. Two years of reviewed financial statements showing the company is Privileged litigation documents from active lawsuits including P2G class certification strategy and settlement documents. Proprietary rootstock and grafting data — the IP that differentiates Duarte from competing Central Valley nurseries. Complete salary and compensation data for 23 salaried employees, insurance coverage details, tax returns, and 401(k) census information. |
| POWERsonic Industries Inc. | · 13d ago | POWERsonic Industries Inc. — a privately held wire harness and cable assembly contract manufacturer founded in 1998 with ~100-150 employees across 7 locations. The exposed material spans every entity in the POWERsonic corporate structure: Employee PII for 93-150 employees — SIN documents, passports, I-20 visas, LMIA immigration approvals, W-2 tax forms, pay stubs, banking information. Plus 8 complete email archives totaling 13.2 GB. Customer proprietary designs — 7.5 GB of Demers Ambulance wiring harness data, 15 GB of CIRRIS cable test results, Mold Masters drawings, and a bilateral NDA with Husky Injection Molding. Full financial records — Dec 2025 balance sheet ($285K cash, $5.1M AP), trial balance, revenue data ($17.7M US), loan agreements, order margins (~45%), insurance policies. |
| Adams Warehouse & Delivery, Inc. | · 16d ago | Adams Warehouse & Delivery, Inc. — a family-owned freight and logistics company operating 11 warehouse facilities in the Houston metro area since 1976. The dataset includes complete server backup mirrors from multiple drives (D:, E:, Data, Network Shares), capturing the company's entire digital footprint: Sage/Peachtree accounting system for 8 entities spanning FY2007–FY2025+, containing payroll, AR, AP, general ledger, and W-2 filing histories 52–72 Social Security Numbers with full identity packages (name, DOB, address, phone, emergency contacts, health insurance IDs) across 4 entities Domain administrator passwords saved in 4 RDP files, plus plaintext VPN credentials, WiFi passwords, and 18 database connections with blank passwords WDS source code — the company's custom warehouse distribution management system (VB6/.NET, multiple versions) 20+ years of customer data — rate cards, operations logs, and contact lists for 100+ warehouse customers including Honeywell, Hospira, Amway, and Kaiser Medical clinic employee data — South Main Medical Clinic's bookkeeping within the Sage system, including physician SSN 11 Outlook PST email archives (largest: 1.5 GB) |
| Estrategias BigMat S.L.U. | · 18d ago | Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's largest building materials distribution networks. 624 SEPA payroll XML files (2022–2025) — every monthly salary payment for 300–500 employees across 15+ entities, with full names, DNI/NIE numbers, IBANs, and exact euro amounts. 20 SILTRA Social Security databases — the complete filing history for every subsidiary's workforce, containing números de afiliación, contribution bases, and employment records. 2,690 customer loyalty cards with DNI/NIF identifiers — the entire customer-identity database. 888 Modelo 347 tax notifications — annual declarations to the Agencia Tributaria naming customers and suppliers with their DNI and transaction amounts. Complete financial records — 5 years of accounting journals, bank reconciliations, insurance policies, loan agreements, and invoices. Occupational health data (PRL) for 12+ subsidiaries — workplace injury reports, medical certificates, and risk assessments. |
| The Buckner Company, Inc. | · 19d ago | The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado. The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts. Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports. 316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare. A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents). 128 Outlook PST email archives spanning years of business correspondence. Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolidated Agencies (2022–2023). 7 named individuals’ driver license scans and the Applied Epic insurance management database (Epic.mdf). |
| Rechtsanwaltskanzlei Dr. Bien | · 20d ago | Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen. The exposed material includes: 2,387 WinSolvenz case databases — each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details. 492+ forced administration (Zwangsverwaltung) case files — property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports. 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures. 1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court. 35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements. DATEV tax/accounting archives — 33 directories of income tax backups, insolvency accounting, third-party mandates. |
| Infomedia A/S | · 27d ago | Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two largest media conglomerates (JP/Politikens Hus and Berlingske Media). Infomedia sits at the heart of Nordic media. It monitors newspapers, broadcasts, and digital sources for hundreds of corporate and government clients — including the EU Parliament, A.P. Møller-Mærsk, and major Nordic media groups (Schibsted, Polaris, NRK, Amedia). The exposed material spans: SQL Server sysadmin credentials — sa / ballmer for the Opoint CRM database at crmdb.opoint.com. An RSA private key — the TLS key for the Infomedia Export Data API service. Named salary specifications for 100+ employees across Denmark (2010–2018) and Estonia (2009–2024). 30 GB of Finance data — income statements, balance sheets, insurance policies, Danske Bank payment records, vendor contracts, tax certificates. |
| Thomas Y. Pickett & Co., Inc. | · 27d ago | Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation. Inventory: 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials Complete HR records for all 40+ employees — Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 2025 A developer's password exposed in a directory name visible to anyone who looks at the file listing A PKCS#12 digital signing certificate (private key) for an HR manager — enabling document forgery |
| Laboratorios Roemmers SAICF | · Oct 1, 2026 | Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) — Argentina's equivalent of a Social Security Number — combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records — employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms — individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers. 82 GB of drug formulations — the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification dossiers for 30+ international suppliers including CERBIOS (Switzerland), revealing the entire supply chain. 14 GB of internal drug pricing strategy and competitive intelligence |
| Buford-Thompson Company, LTD | · Sep 30, 2026 | Buford-Thompson Company, LTD, a Texas construction general contractor with 30+ years of history building schools for K-12 districts across the state. The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption. 9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications. Complete Frost Bank infrastructure — four account numbers, ACH routing credentials, line-of-credit agreements (renewed April 2026), signature cards, and monthly bank statements spanning 2022–2026. 36+ active school construction projects — blueprints, bid estimates, cost structures, subcontractor pricing, and change orders for ISD projects across Texas. A competitor's dream dataset. 2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts. QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accounting, donor, and likely payroll data. Thompson family personal records — owner personal insurance, loans, ranch property (Jack County), airplane ownership, bond dividends, and personal tax documents. |
| Benshaw, Inc. | · Sep 7, 2026 | Benshaw, Inc. (Pittsburgh) and affiliated UTG entities (Unico, Benshaw Canada, AuCom, Excel, Noble Victoria). ~100+ corporate Visa/PCard records with full PAN + SSN + DOB + home address 637 former employees with full SSN/DOB/address on one spreadsheet 88 active employee folders plus multi-year Canada payroll Global bank account numbers (PNC, BMO, BNZ, St George, Commerzbank, JPM London, BBVA, GNB…) ACH NACHA files with vendor routing/account numbers UEdit source with hardcoded XOR key 4148865678 and date-based CalcBackDoor() Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC…) |
| Jinny Beauty Supply | · Sep 7, 2026 | Jinny Beauty Supply is one of the largest Korean-American wholesale beauty distributors in the US, operating 9 distribution centers from Doraville, Georgia to Commerce, California. They serve 7,400+ beauty supply stores and 2,800+ international distributors. The exposed material includes: A complete password vault export — 50+ plaintext credentials for PayPal, Braintree, Amazon Seller Central, eBay, Acumatica ERP (production), 12 state tax portals, FedEx, UPS, ShipStation, Microsoft 365, Google Analytics, and internal email. VMware hypervisor root credentials — vCenter and ESXi root passwords giving complete control over the entire virtual infrastructure. 911 scanned credit card authorization forms — full card numbers, CVV, expiry dates, and cardholder signatures for beauty supply store customers across 26 US states. Complete employee compensation database — ~260 employees with Korean and English names, departments, salaries, bonuses, and 1099 contractor data spanning 2015–2018. A 340 MB Shopify database backup — full customer table (names, emails, phones, addresses), product catalog, pricing, and warehouse assignments. Active Directory domain enumeration — all 239+ user accounts including 17 admin accounts, the complete server topology across 7 geographic sites (50+ servers), and DPAPI-encrypted RDP passwords. Employee tax documents — W-4 forms (SSN), I-9 forms (SSN + DOB + citizenship), direct deposit forms (bank account and routing numbers). 3.6 GB of SQL Server database backups — e-commerce customer/order/product data spanning November 2019 to March 2020. |
| Metrea LLC/Commuter Air Technology, Inc. | · Sep 5, 2026 | Metrea LLC (formerly Meta Special Aerospace, LLC) and its subsidiary Commuter Air Technology, Inc. (CAT) are US defense contractors providing Contractor Owned, Contractor Operated (COCO) ISR aircraft services to US Special Operations Command. They operate modified King Air 350 surveillance aircraft in Niger, East Africa, the Philippines, and other theaters. 339 MB of Harris PRC-117G military tactical radio firmware including compiled waveform binaries for SINCGARS, HAVEQUICK II, ROVER, and 10 other ITAR-controlled waveforms (USML Category XI). Named deployment data for 14+ operators at Sable Spear sites in Niger and East Africa, with rotation schedules, SIPRNet access documentation, and divert airfield planning. Complete SOCOM contract pricing portfolios — labor rates, burn rates, TINA-certified cost data, and subcontractor pricing for SOCPAC C3PO, Sable Spear, and Sable Dagger programs. 232 employee personnel files including resumes, W-9 forms (SSN), SERE training certificates, security clearances, expense reports, and deployment records. NSWDG (SEAL Team Six), MARSOC, and 75th Rangers training exercise documentation — 37 separately funded SOCOM training deliveries under the Alpha 28 program. |
| EDIF S.p.A. | · Sep 4, 2026 | EDIF S.p.A. is an Italian wholesale distributor of electrical equipment, plumbing, and lighting systems. The exposed files include passwords for company systems, customer file transfers, certified email and warehouse devices. Copies appear in source code, setup packages and old folders. Customer and employee information is also exposed: invoices, tax numbers, addresses, phone lists, shipment details, computer-profile artifacts and records about CCTV or recorder password resets. The dataset contains internal software, databases, commercial records, legal/tax folders and a detailed 2024 financial report. |
| Chip 1 Exchange | · Sep 2, 2026 | Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. The dataset spans 13 years (2013-2026) of corporate operations and encompasses: 40+ passport photographs, I-9 forms with SSNs, W-4 tax forms, payroll registers. Complete 2026 financial intelligence — P&L through July, executive financial health assessment, AR/AP aging, chart of accounts revealing all bank account numbers. 15+ exclusive franchise manufacturer agreements with pricing terms, territory allocations, and per-customer gross profit margins. ITAR registration and defense customer sales orders to Jabil Defense, Curtis-Wright, GEN3 Defense, and Cobham Remec. 5.7 GB of Outlook PST email archives spanning years of C-suite and employee correspondence. |
| Ishbia & Gagleard, P.C. | · Aug 31, 2026 | Ishbia & Gagleard, P.C. — a boutique law firm in Birmingham, Michigan, founded in 1999 by Jeffrey A. Ishbia and Michael A. Gagleard. The firm practises real estate, corporate, estate planning, personal injury, medical malpractice, and commercial litigation for high-net-worth individuals and closely held entities. The exposed material includes: 360+ client/matter folders — the complete attorney-client privilege corpus: litigation strategy memos, settlement agreements, case assessments, deposition notes, correspondence with opposing counsel. Full Social Security Numbers for 25+ identified individuals — trust beneficiaries, family members, employees of client businesses, and a scanned Social Security card. Protected Health Information — hospital admission records from Oakwood Hospital, University of Michigan Hospital, and William Beaumont Hospital. Also: 55+ employee files from a sexual health clinic client with SSN searches and scanned SS cards. 100+ client tax returns spanning 2003–2024, each containing SSNs, EINs, and income data. 11 email archive files (PST/OST) containing years of unfiltered attorney correspondence. Personal legal matters of Mat Ishbia — CEO of publicly-traded UWM Holdings Corp. (NYSE: UWMC), the largest wholesale mortgage lender in the United States. |
| SCA Logistik & Fulfillment GmbH | · Aug 27, 2026 | SCA is a Bavarian logistics and e-commerce fulfillment provider. The exposed materials includes: Spans customer orders Shipments and returns Employee and applicant files Management, tax and banking records Warehouse automation Source code Customer contracts. |
| ERPIS LLC | · Aug 26, 2026 | ERPIS LLC (doing business as ShipERP) — a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers. The exposed material includes: Complete product source code — all versions (2.0–5.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog) Live QuickBooks financial database (705 MB) — complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger Full customer contract register — exact pricing for all 88 enterprise customers with $20.6M in deferred revenue SAP installation media (245 GB) — full HANA, S/4HANA, and kernel distributions |
| Planungsgruppe M+M AG | · Aug 17, 2026 | Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026. |
| Natco Home Group | · Aug 17, 2026 | Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials. |
| Lloyd Coils Europe | · Aug 17, 2026 | 4 Coils Technology s.r.o. (trading as Lloyd Coils Europe) is a Czech-headquartered manufacturer of custom heat exchangers for the HVAC&R industry, with offices in Germany, France, and the United Kingdom. They serve 200+ OEM customers across 39 countries — names like Carrier, Daikin, Trane, Systemair, Remak, GEA, Swegon, and VTS. Their competitive advantage comes from two things: decades of thermodynamic engineering expertise embodied in their MyCoil selection software (licensed to OEM customers worldwide), and a manufacturing capability for custom heat exchangers. Approximately 200 employees work across four countries. |
| FREYWILLE | · Aug 11, 2026 | FREYWILLE — the Austrian luxury fire-enamel jewelry house with 70+ boutiques across Europe, the Americas, Middle East, Russia/CIS, and Asia-Pacific. 142+ employee files with salary statements (2024–2026), social security numbers (ELDA), employment contracts across 24 countries, COVID vaccination records, passport copies, visa card statements spanning a decade, and personnel files. FREYWILLE's trade secrets — complete 2025 product costing for all lines (18ct gold, plated, textiles), and the crown jewels: enamel colour recipes from the Siebdruck department. FREYWILLE's fire-enamel technique is what makes the brand unique. The formulations for SPHINX, JOYB2, and Entwurf colour systems are in the dataset. Defence files from 40+ lawsuits across Austria, the US, China, France, Canada, Slovakia, Poland, and Belgium — including a criminal proceedings file (Strafsache Grgic, Mrsic & Co). Documentation of the 2018 webshop malware attack — DSB filings, customer notification drafts, incident reports. |
| US Installation Group, Inc. | · Aug 4, 2026 | Founded by Bruce DeLuca in Boca Raton, Florida, USIG operates through 15+ legal entities under MRS Holdings, performing over 100,000 installations annually across 33 markets in 14 states. |
| GILDE Handwerk Macrander GmbH & Co. KG | · Aug 4, 2026 | GILDE Handwerk Macrander GmbH & Co. KG is a family-owned German Mittelstand group headquartered in Bocholt, Nordrhein-Westfalen. The GILDE Gruppe operates across wholesale trade in gifts, home accessories, and furniture through brands including GILDE Handwerk, Fink Living, and HAKU Möbel, with 50+ legal entities spanning Germany, Austria, the Netherlands, France, the UK, and Hong Kong. The exposed material includes: 148+ personal ID document scans — Personalausweise (national ID cards), Reispässe (passports), Führerscheine (driver's licences), and Heiratsurkunden (marriage certificates) for employees, directors, and family members. Names range from warehouse staff to the CEO. ELSTER tax certificates for 50+ entities — the digital keys for filing tax returns with the German Finanzamt, plus personal certificates for directors and family members. Enables fraudulent VAT returns and income tax filings. Full employee payroll records (2006–2025) — tax IDs (Steuer-IDs), social security numbers, bank accounts, salary details, sick notes (Krankmeldungen), and disciplinary records for an estimated 200–400 current and 200–500 former employees across all entities. 20 years of consolidated financial records — balance sheets, P&L statements, bank reconciliations, loan documentation, shareholder agreements, and capital contribution records for the entire group from 2004 to 2025. 1,800+ Access databases — inventory valuations, customer lists, supplier terms, product pricing, and order history spanning the entire commercial operation. |
| Van Eijck International Car Rescue | · Jul 30, 2026 | Van Eijck International Car Rescue B.V. — a family-owned Dutch towing and recovery company with 225+ vehicles, 180+ employees, and 20 branch offices across the Netherlands and Spain. The exposed material includes: 227 employee home directories (156 GB) containing personal documents, tax forms (loonheffingen), salary records, photos, and financial data. 12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations. 10 years of customer claims data (2010–2019) — 500+ individual claims with damage assessments, insurance details, and customer PII. Complete Google Workspace backup (CubeBackup) — Gmail, Drive, and Calendar for 18 user accounts and 206 groups. |
| Evosys Laser GmbH | · Jul 30, 2026 | Evosys Laser GmbH — an Erlangen-based industrial laser welding systems manufacturer with ~130 employees, subsidiaries in the US, China, and a string of Tier 1 automotive customers. The dataset is the complete corporate repository, spanning every business function: 130 employees' complete HR files — employment contracts, salary histories, bank IBANs, tax IDs, social insurance numbers, pension records, medical examinations, disciplinary warnings, and two confirmed minors' health records. Complete server infrastructure map via mRemoteNG XML — 7 servers named, domain admin credentials, internal IPs. The Citrix admin password is Password1. 326 GB of customer project data — laser welding process parameters, CAD files, robot control software, and the award-winning AQW process know-how. Complete financial history — Jahresabschlüsse (2015–2025), P&L forecasts through 2028, cash positions, investor documents, executive compensation. Attorney-client privileged communications (230 MB) and whistleblower reports under HinSchG. Industrial control data — robot SRS source code, PLC programs, nginx private keys for laser system web interfaces, VPN configurations for customer site remote access. |
| Pyramid Analytics B.V. | · Jul 30, 2026 | Pyramid Analytics B.V. — a decision-intelligence platform company headquartered in Amsterdam, acquired by ServiceNow (NYSE: NOW) for hundreds of millions of dollars just four months earlier. We obtained the complete source code of the Pyramid Decision Intelligence Platform along with: 10+ copies of the platform source code with full Git history, revealing every feature, algorithm, security module, and AI integration ever built. 22 GB of SQL Server production database backups likely containing user accounts, credentials, and business data. Customer data from publicly traded companies — Shufersal (TASE: SAE) retail sales data and ABB (NYSE: ABB) OLAP cube backups. |
| Bretford Manufacturing | · Jul 29, 2026 | Bretford Manufacturing, Inc. is a privately held manufacturer of charging solutions for mobile devices, founded in 1948 and headquartered in Franklin Park, Illinois. With ~60 employees and ~$10M annual revenue, it serves education, healthcare, retail, and government sectors. The exposed material includes: Social Security Numbers for the entire workforce (current + 200–400 historical employees + dependents) via ACA Census files, 1099 forms, and payroll records spanning 2010–2026. Corporate and vendor bank accounts — Bretford's own checking account (routing + account number) plus 26+ vendor bank accounts from NACHA ACH batch files. Complete network architecture — VPN gateway IP, internal topology diagram, IP allocation tables, infrastructure inventory, disaster recovery plan, and Active Directory domain name. 20 years of HR records including medical leave, disability accommodations, drug tests, garnishments, pension, 401(k), insurance enrollment, and termination records. Complete product engineering library — SolidWorks CAD files for all products, CNC/laser programs, and manufacturing process documentation. |
| Primed Halberstadt Medizintechnik | · Jun 30, 2026 | Primed Halberstadt Medizintechnik GmbH — a German manufacturer of medical devices founded in 1946 and now part of the PE-backed PP Medtech group (Wiesmann & Co. KG). The exfiltration captured four entire server volumes: Daten (883 GB) — File server: 289 employee home directories (547 GB), Czech subsidiary data (66 GB), production processes (162 GB), machine configurations (81 GB) EE (807 GB) — Enterprise system: Apollo ERP, VBANK banking (8 accounts), complete database backup (100.6 GB, dated June 3), product images WINDVSW1 (344 GB) — Windows server: DATEV accounting (115+ data directories including LODAS payroll), bank transfers, DMS exports dmsscan (12 GB) — Scanned documents from 51+ employee DMS mailboxes A database backup (spiel.zip.001–010, 100.6 GB) was created on 2026-06-03 |
| Corporación Primax S.A. | · Jun 23, 2026 | Corporación Primax S.A. is Peru's largest fuel distribution company, operating 2,185+ stations across Peru, Ecuador, Colombia, and Uruguay with annualised revenue of approximately USD 3.4 billion (Peru alone). The dataset spans every function of the business: Complete financial reporting — Monthly P&L, balance sheet, cash flow, and EBITDA through May 2025. GRIO (Grupo Romero Investment Office) management reporting packages. Budget 2025 vs. actuals. Employee identity data for 15,000–60,000 individuals — DNI national ID numbers, bank accounts, salary amounts, pension fund details, scanned identity documents. Live system credentials — Plaintext SQL database passwords, banking SFTP credentials (Banco Bolivariano Ecuador), AD encryption master key, OSINERGMIN fuel-control system credentials. Complete OT network map — IP addresses and identifiers for 137 fuel stations on the internal 10.55.40.x network, plus JD Edwards ERP production servers. 54 GB of POS transaction data — XML records of consumer fuel purchases across the entire station network. Legal and M&A documentation — Arbitration case files (PUCP/AMCHAM), UNO Corp acquisition materials (Dec 2025), bank covenant waivers. |
| Aerospace & Advanced Composites GmbH | · Jun 22, 2026 | Aerospace & Advanced Composites GmbH (AAC) — an Austrian space-materials R&D company headquartered in Wiener Neustadt, with deep ties to the European Space Agency. Obtained two complete NAS snapshots spanning 30+ years of operations: aacdata (31 December 2022) — 123 GB: the complete Testhouse, R&D, and engineering share, including the ESA thermal vacuum test archive, polymer composites formulations, and 22 Outlook PST email backups. aacdata1 (14 January 2025) — 86 GB: the administrative share, including managing director's full PC backup (browser credentials, passport scans), 15 years of financial statements, shareholder agreements, and the IT credentials master spreadsheet. BMD_DATA — 34 MB: the complete BMD business software accounting database with employee payroll, SEPA payments, and VAT declarations. done/ — Bitlocker recovery keys for 12 endpoints and WMI system dumps. The exposed material includes: 4 passport scans, 1 social security number, 25 employees' complete HR files, 50–100+ job applicant CVs — the full identity-theft toolkit for the workforce plus third-party data subjects. The IT credentials master spreadsheet (AAC CODES.xlsx) containing every system password, plus browser-stored logins for ESA SSO, the company's IT provider, and industrial suppliers. 12 Bitlocker recovery keys enabling full-disk decryption of 6 company laptops. 123 GB of ESA thermal vacuum test data — 30+ years of space-grade materials testing that represents the company's core competitive advantage and cannot be recreated. 137 executed NDAs with partners including Airbus, RUAG, Safran, Thales, ESA, BMW, Tesla, Google, Samsung SDI, CERN, DLR, and 126 others. 15 years of annual financial statements, bank records, insurance policies, and shareholder agreements — the company's entire financial anatomy laid bare. |
| NTP B.V. Civil Engineering Construction | · Jun 22, 2026 | NTP B.V. (trading as NTP Infra / NTP Groep) is a Dutch civil engineering contractor headquartered in Hattem, Gelderland. They build roads, lay cables, install sewers, and perform ground works across the Netherlands. With 150–200 employees, offices in Hattem, Enschede, and Zevenaar, and a 2024/2025 acquisition of Aannemingsbedrijf Dubbink B.V., they are a typical mid-market Dutch “aannemingsbedrijf” — government contracts, municipal works, private developments. Their file server contained everything: 10+ years of operations, every employee's personal files, the complete HR/payroll system exports, every network device configuration, every project bid, and every financial record. |
| Kochs GmbH | · Jun 22, 2026 | Kochs GmbH — a family-owned German manufacturer of windows, doors, and aluminium façade systems headquartered in Herzogenrath, Nordrhein-Westfalen, with ~240 employees across Germany, the Netherlands, and Hungary. The exposed material includes: 22 GB of payroll database backups (7 MSSQL .bak files, 2016–2023) — every employee's salary, bank IBAN, tax class, social insurance number, pension contributions, and wage garnishments. 2.3 GB of DATEV payroll records (through May 2026) — individual named salary documents, garnishment data, company car records for all three entities. 7 Active Directory passwords in plaintext batch scripts — including both Managing Directors, with one MD's credentials spanning three separate AD domains. 28+ proprietary application source code repositories — WinPro ERP, Apertum CRM, MES integrations, production viewers, time-tracking, and rack-management systems. Each one hardcodes its database credentials. SSL/TLS private keys for kochs.de (2021–2026) — enabling domain impersonation and man-in-the-middle attacks. 77 VPN pre-shared keys from the LANCOM gateway configuration — the complete remote-access roster since 2018. Managing Director's MRI and X-ray scans — brain and spine medical imaging, GDPR Art. 9 special category health data. 16 named employee disciplinary records, 11 driver's license scans, attorney-client privileged litigation files from two active employment lawsuits. Complete financial records — 2024 annual accounts, P&L, balance sheets, SFirm banking database, Syska ProFI general ledger, cost accounting through December 2024. |
| NationsBuilders Insurance Services | · Jun 22, 2026 | NationsBuilders Insurance Services (NBIS) is the premier US underwriter of crane & rigging, concrete-pumping, heavy-haul, and residential-builder insurance — a specialty managing general underwriter founded in Atlanta in 2001, acquired by Align Financial / DUAL North America (Howden Group) in August 2021. 2,748,845 filetree entries across 24 shares (AIM, IMAGERIGHT, the claims and policy-admin stores, HR, finance, IT, and a decade of M&A diligence rooms). |
| Hagerman & Company | · Jun 19, 2026 | Hagerman & Company — a 40-year-old Autodesk Platinum Partner headquartered in Mt. Zion, Illinois, serving 250+ enterprise customers across manufacturing, energy, defense, healthcare, and education. The exposed dataset includes: Complete proprietary source code for 15+ commercial products including the HNC Licensing System (License Generator, License Server, License Manager) — enabling unlimited piracy of all Hagerman products. 8+ plaintext database credentials in .udl files, including an Oracle SYS (DBA superuser) account with password "Hagerman@1!" reused across multiple systems. Engineering vault databases for 14+ critical infrastructure entities — NYPA (7 power plants including Niagara Falls), Kinder Morgan (Elba Island LNG terminal), HydroOne (Ontario electricity), Phillips 66, Chevron, and 8+ petroleum refineries. Defense/government data — NASA IT Security Requirements, Lockheed Martin configurations, Boeing-SVS vault data, JPL configurations. Azure DevOps transaction logs (1.6 GB) containing complete source code version history and potentially CI/CD deployment secrets. Third-party database credentials for Michigan State University (3 databases), Cal State Long Beach, and Beth Israel Deaconess Medical Center infrastructure. |
| ALS Global | · Jun 19, 2026 | ALS Limited (ASX:ALQ) — a global testing, inspection, and certification company with AUD 3.19B revenue, 20,500+ employees, and operations in 65+ countries — identified unauthorised access to its IT systems. ~400–500 employee home directories — personal documents, cached credentials, email settings, family photos, personal finance files for employees from Australia to Peru to Sweden to Romania. The company's 1Password team vault emergency recovery kit — a single 45 KB PDF that enables total recovery of every shared credential in ALS's enterprise password vault. 291 plaintext password files including administrator credentials, FTP passwords, portal passwords, and the document control system master password. 1,018 passport and identity document scans — Swedish passports, Mexican passports, Australian passports — each one a 10-year identity-theft enabler. 601 bank account detail files including IBAN, SWIFT routing codes, BSB numbers, and sort codes for employees across 15+ countries, plus Russian-language SWIFT salary payment files. 1,986 salary, payroll, and compensation files — named individuals, exact amounts, pay scales, negotiation records across AU, US, EU, UK, CA, BR, SE, RO. 453 medical, drug test, and workplace injury records — GDPR Art. 9 special category data. 57 complete Outlook email archives (PST files) — years of correspondence, attachments, privileged communications. 7,327 client laboratory results — mining assay data, certificates of analysis, and geochemistry results held under NDA. 20 GB of proprietary analytical method development — ALS's core competitive IP: PFAS, dioxin, acrylamide, glyphosate LC-MS/GC-MS method packages representing years and millions of AUD in R&D. For a TIC company, analytical methods are the product. 7.2 GB of Internal Research reports — 68+ formal research reports (IR153–IR287+) spanning 15 years, including IsaMill grinding R&D, GlyLeach joint-venture process IP (with mutual NDA), flotation, mineralogy, and QEMSCAN data. The… |
| Allan Brothers Fruit | · Jun 16, 2026 | Allan Brothers, Inc. — a third-generation, family-owned tree-fruit operation headquartered in Naches, Washington. Allan Brothers packs and ships apples and cherries from a 300,000 sq ft cold-storage facility, employing roughly 45 full-time staff and up to 2,000 seasonal workers during peak harvest. Eight server volumes: 14,228 employee records from ADP Workforce Now — names, dates of birth, phone numbers, gender, employment history, photos — covering every person who has ever worked at Allan Brothers, including seasonal cherry pickers, H-2A visa workers, and office staff. W-2 tax filings with full Social Security Numbers for employees across eight legal entities (ALLAN, ABMEXICO, ABSAGE, ABSAGEMOOR, ABVINEYARD, ABAG, ABSHELTON, ABFROST). Direct deposit forms with bank routing numbers and account numbers for named individuals — the raw ingredients for ACH fraud. H-2A visa worker tracking spreadsheets listing which workers have or are missing Social Security Numbers, plus I-9 employment eligibility audits — exposing immigration status for the most vulnerable members of the workforce. A complete Oracle RMAN database backup of the Famous Software production system — the company's grower settlement, customer pricing, and lot-tracking engine. 1.3 GB of employee badge photos — facial images linked to names and employee IDs for hundreds of workers. COBOL-era accounting databases spanning 8 legal entities — GL, AP, AR, payroll, and W-2 filing data going back years. OSHA incident logs naming workers who sustained injuries, with injury descriptions and treatment details. |
| Diamond Truck Centres | · Jun 16, 2026 | Diamond Truck Centres — Western Canada's largest International Trucks dealership group (9 dealer + 13 sub-dealer locations, ~$63M revenue, 250 employees). The dataset spans 17 years of unbroken operational history (2009–2026) and represents the full shared-drive contents of the entire company: HR, payroll, accounting, military contracts, and individual employee profiles. The exposed material includes: 53 customer Pre-Authorized Debit (PAD) forms — full bank account numbers, transit numbers, institution numbers, and authorized signatures for commercial customers including the City of Saskatoon. 17 years of employee payroll data — wages, SINs (implied), pension contributions, benefits, termination calculations for every employee since 2009. Biometric data — ADP fingerprint timeclock enrollment records for all locations. Immigration documents for 6+ foreign workers — LMIA applications, offers of employment, provincial nominee support docs. System credentials in plaintext — ADP timeclock passwords, manager training logins, safe combination. Military contract documentation — Diamond's Controlled Goods Security Plan (ITAR/CGP), MSVS delivery matrices, military vehicle VINs, CFB Edmonton and RCMP vehicle program data. 289 GB of daily bank deposit scans (2017–2026) — customer cheque images with names, amounts, and account details. A complete Outlook PST archive (166 MB) — years of internal email likely containing credentials and customer data. |
| Sumitomo Electric Bordnetze | · Jun 16, 2026 | Sumitomo Electric Bordnetze SE (SEBN) — a Wolfsburg-headquartered subsidiary of Sumitomo Electric Industries (TSE:5802, ~$31B group revenue), employing approximately 40,000 people across 14 countries. Exfiltrated 1.1 terabytes of data from five manufacturing sites. SEBN Moldova (103 GB) — HR, payroll, personal tax records, competition-council litigation files, home directories SEBN Ukraine (115 GB) — HR/salary, Audi B9 project data, process documentation, including displaced-worker records for Ukrainian IDPs SEBN Tunisia — Fejja (191 GB + 493 GB shared) — passport copies, email archives (671 MB PST), quality/FMEA data, finance SEBN Slovakia (268 GB) — the crown jewel: Citibank corporate banking infrastructure including the TESTKEY authentication system, IBAN registries, daily bank statements, SAP salary-payment files, and years of department email archives The dataset contains 173,000 Excel files, 149,000 PDFs, 2,500 CAD engineering drawings, 2,500 Outlook messages, 1,500 FMEA/PPAP quality files, and 9 Outlook PST archives. |
| Avanti Windows & Doors | · May 12, 2026 | Avanti Windows & Doors — a vinyl window manufacturer headquartered in El Mirage, Arizona, with regional offices across Nevada, Texas, California, and Florida. The exposed material includes: Plaintext SQL Server SA (system administrator) credentials — the master key to the FeneVision ERP database containing every customer order, every price, every financial record the company has ever processed. Employee SSNs, W-4s, I-9s, and E-Verify data — the complete identity package for the entire workforce, from new-hire packets through payroll records spanning 2014–2016+. 1099-MISC/INT forms — SSNs/EINs and payment amounts for 50–200+ contractors and vendors across two tax years. Direct deposit authorizations — bank account and routing numbers for employees who enrolled in ACH payroll. 24+ months of Chase bank statements and 28 months of AMEX corporate card statements — full account numbers, transaction details, and spending patterns. The complete proprietary pricing algorithm — source code for the FastAPI backend that determines window pricing for every builder contract, plus 41+ builder Master Service Agreements with exact pricing terms. CPA-reviewed financial statements, partnership returns, K-1s, and budget forecasts — the company’s full financial anatomy, from cost structure to profit allocation. OSHA 300 logs, workers’ compensation audit files, and UHC health insurance invoices — employee medical and injury data, names of injured workers, treatment details. Attorney-client privileged ADOSH settlement correspondence — OSHA settlement negotiations between outside counsel and the CEO. ~80 Windows roaming profiles — employee desktops, documents, AppData, Outlook .ost/.pst files, browser caches, and cached credentials. |
| Startec Group of Companies | · May 12, 2026 | Startec Group of Companies, a privately held Calgary-based industrial OEM founded in 1976 by Joe Cawthorn. Startec designs, fabricates, installs, and services compression, process, and refrigeration systems for oil-and-gas operators and the energy-transition sector (RNG, hydrogen, CO&sub2; sequestration, flare-gas capture). The company employs ~270 people and exports ~80% of its cleantech output to US customers including Pembina, ARC Resources, SemCAMS, Cenovus, and Shell. The exposed material spans the entire corporate knowledge base: 25 years of payroll (2001–2026) including a master SIN VERIFICATION.xlsx register, ADP exports, T4/ROE/T2200 forms, banking/EFT direct-deposit data for ~600+ current and former employees 18+ named passport scans plus a Pakistan resume-and-passport applicant pool (~20+) Wildcard TLS private keys for *.startec.ca (2022–2027 series) and the suspected Active-Directory-integrated internal CA private key The cyber-insurance policy (BZA2151) and the Nov 2025 Statement of Values & Business-Interruption submission to Zurich ~25+ named customer engineering libraries (Pembina, ARC, SemCAMS, Cenovus, Shell Scotford) with process specs, as-built drawings, and sizing calculations Shell Caroline + Shell Saturn dispute-counsel files (~665 MB of privileged litigation material) 12 fiscal years of board packs including “in camera” sessions, the 2020 Valuation Report, family-trust T3 returns, and succession-planning documents Cawthorn family QuickBooks files (live .QBW — full chart of accounts, general ledger, every transaction) 11 Outlook PST mailboxes (several multi-GB — named ex-employees' complete email history) Physical-security access codes (CCTV passwords, Telsco alarm chart, all-doors key record) |
| NorthWest Handling Systems | · May 12, 2026 | NorthWest Handling Systems — a 55-year-old forklift and warehouse equipment company headquartered in Renton, Washington, with branches across WA, OR, and AK. The dump is the entire corporate file share going back to 1988. 337,000+ files spanning every branch, every department, every era of the company. It includes: Plaintext credit card numbers in an Excel spreadsheet literally titled “C.O.D. info (CREDIT CARD INFO).xlsx” — stored at the root of the file server, unencrypted, for years. Social Security numbers and Taxpayer IDs on W-9 forms and certified payroll documents for government-contract work (USPS, Oregon DHS, public schools). 3+ years of plaintext passwords for Target Corporation’s vendor portal (TARS), stored in Word documents titled “TARGET PASSWORD & SECURITY QUESTIONS.” Each password rotation was saved as a new file. Home Depot Maximo DC billing credentials — plaintext, in a Word document, enabling fraudulent invoicing against a Fortune 50 company. Albertsons/Safeway Corrigo facility-management portal credentials — again, plaintext in a .docx file. 33 GB of customer warehouse CAD files — facility layouts, equipment placement, security-zone dimensions, and fire-protection drawings for approximately 50–200 companies including Nike, Google, Costco, and Umpqua Bank. 24,669 rows of fixed-asset data in ExportFile.csv — the complete equipment inventory, revealing the company’s financial structure, depreciation schedules, and capital-investment history. Corporate bank routing and account numbers (ACH authorization forms), employee direct-deposit details, time cards, disciplinary records, accident reports, and decades of invoices. |
In the news
AllVictim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .