ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen30▲6153401401activeno public figure
2qilin23▲9117361361activeno public figure
3krybit13▲13479696activeno public figure
4storm4▼36445656activeno public figure
5akira9=438686activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
6direwolf3▼8416262activeno public figure
7coinbase cartel0=375656activeno public figure
8inc ransom8▲336112112activeno public figure
9lockbit54▼4275353activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10audit team11▲2232525activeno public figure
11safepay10=226767activeno public figure
12leakeddata1▼1213939activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15emperador5=182222activeno public figure
16kazu0▼17171717activeno public figure
17vexy4▼5151515activeno public figure
18shinyhunters2▼1143232activeno public figure
19panzer7▲5142525activeno public figure
20black nevas1▼12141414activeno public figure
21chaos3▼1133535activeno public figure
22dragonforce3▲1127171activeno public figure
23everest0▼4123434activeno public figure
24pear1=122323activeno public figure
25rhysida3▲1121414activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents1,035 records · full details

VictimGroup / typeDiscoveredDetails
Northwest Trophy
tracker page ↗
the gentlemenfilter this group · 19d agonwtrophy.com rocketreach.co/northwest-trophy-inc-profile_b59c90e0f9bc4cf5 Northwest Trophy & Awards Inc is a fourth-generation, family-owned awards business operating since 1938, with a showroom in Woodinville, WA (Seattle area). It offers personalized awards and gifts: trophies, medals, plaques, crystal and art-glass awards, acrylics, clocks, drinkware and ceremonial items. All engraving and printing (laser, rotary, full-color) is done in-house, serving sports teams, schools and businesses. It sells both through its showroom and an online Shopify store with standard 5–7 day production; a Seattle location was closed in 2023, leaving Woodinville (and previously Bellevue) to serve customers.
General Gruppo
tracker page ↗
the gentlemenfilter this group · 19d agogeneralgruppo.it rocketreach.co/general-gruppo-profile_b68428f5c6158b62 General Gruppo / General s.r.l. is a family-owned Italian retail chain founded in 1975 by Pietro Paolo Tognetti and Silvana Bonugli, headquartered in Querceta (Seravezza, Lucca, Tuscany). Historically known as IperSoap — one of Italy's first home-care and personal-hygiene retail formats — it reached ~250 stores in 2019 and €150 million in revenue (2018). In 2020 it began rebranding into the unified PiùMe banner (merging IperSoap, Smoll and Shuki), and it also owns the historic Bacci Profumerie perfumeries (Forte dei Marmi) and the piume.it online shop. The founders' sons run the business — Saverio (CEO) and Francesco; the group includes General s.r.l. and General Nord s.r.l.
Ixa Systems
tracker page ↗
the gentlemenfilter this group · 19d agoixasystems.ch rocketreach.co/ixa-systems-sa-profile_b40f7faaffd19ede Ixa Systems SA is a Swiss security systems company founded in 2007, headquartered in Crissier (canton Vaud, near Lausanne). A small family-run firm of ~9–10 staff with revenue of about CHF 3.5 million, it designs and integrates surveillance solutions: video surveillance (IP/CCTV), anti-intrusion systems, intercom, access control, perimeter detection, technical building supervision (GTC) and evacuation PA systems. Since 1 April 2022 it has been majority-owned by the D.E.S Systèmes de sécurité SA group, with Marc Barraud as director. Its clients include police, banks, museums, schools, hospitals, prisons and railways, and it offers 24/7 maintenance contracts.
Tecno Accion
tracker page ↗
the gentlemenfilter this group · 19d agotecnoaccion.com.ar Tecno Accion S.A. is an Argentine IT company (founded 1988) that acts as a technology partner for lotteries — "Modernizing lotteries in a digital world" — with offices in Buenos Aires (Av. Rivadavia 620) and Bariloche. It develops its own hardware and software for lottery automation: 8,000+ terminals in operation, 4+ million daily wagers, serving 12 jurisdictions (half of Argentina's provinces); in Salta province it is the exclusive operator of the lottery license (900+ points of sale). It also delivered horse-racing bet capture for the Hipódromo Argentino de Palermo and completed projects in Peru, Panama, Brazil and Nigeria. Staff of ~80–135; certified under ISO 9001, ISO 27001 and WLA SCS:2020; historically linked to Greece's Intralot and the Capital Markets group.
Probe Test System
tracker page ↗
the gentlemenfilter this group · 19d agoptse.com.tw Probe Test System Corp. (PTS, 群雅電子) is a Taiwanese semiconductor back-end (OSAT) service provider operating since 2000, with plants in Zhunan and Toufen, Miaoli County (the former Hsinchu site was consolidated into Toufen in Q1 2024). Its services cover System Level Test (SLT), wafer chip probing (CP) on Chroma, ASL1000 and CTA8280 platforms, IC marking/remarking, Tape & Reel packaging (capacity ~150 KK units/month) plus lead/ball scan inspection. Long-term customers include Taiwan's leading chipmakers: Winbond, MediaTek, Novatek, Nuvoton and Macronix. The company is certified under ISO 9001, ISO 14001 and ANSI/ESD S20.20-2021.
SUNSEA
tracker page ↗
the gentlemenfilter this group · 19d agosunsea.co.th Sunsea Plastics P.S. Co., Ltd. is a family-owned Thai polyethylene film manufacturer founded in 1988, operating a purpose-built 13,000 sq.m factory in Bangna, Bangkok (office at Soi Lasalle 24, Sukhumvit Rd). It is Thailand's leading independent PE extruder, producing LDPE shrink film (rolls, hoods, sleeves, bags), LLDPE lamination and printing films, mLLDPE, PP/PE coex films, milk pouches and overwrap films, running 16 mono-layer plus 3-layer lines. It is the sole ExxonMobil-authorized producer of Nexxstar collation shrink film in Thailand and is ISO 9001 certified
Thai Film Industries PCL
tracker page ↗
the gentlemenfilter this group · 19d agothaifilmind.com Thai Film Industries PCL (TFI) is a Thai film maker founded in 1983 (originally Rachadachai O.P.P. Co., Ltd.) by industrialist Prayudh Mahagitsiri — Thailand's first BOPP film producer and Southeast Asia's industry pioneer, today a global top-20 BOPP manufacturer. Its portfolio covers BOPP (Thai-Lene), CPP (Thai-Cast), PET and metallized films for flexible packaging, printing, lamination, labels, adhesive tape, flower wrap and biodegradable uses. It runs two plants — in Samut Prakan (Bang Phli, Bangna-Trad Km.13) and Rayong (Nikhom Pattana) — with ~760 employees and exports across Asia, Europe and the Americas. Listed on the Stock Exchange of Thailand since 29 Dec 1989 (ticker TFI, paid-up capital ~THB 2.05 bn); renamed Thai Future Incorporation PCL in 2023, it is affiliated with Thai Copper Industries and Thai Film Bangladesh; CEO since 2023: Phadetkiat Imdacha.
Adkisson Group
tracker page ↗
the gentlemenfilter this group · 19d agoadkissondevelopment.com Adkisson Group / Adkisson Development Group is a privately held industrial real estate development and investment firm founded in 2012 and based in Houston, Texas (4809 Westway Park Blvd / 1130 Enclave Pkwy, Houston, TX 77041). It specializes in office/warehouse, manufacturing and distribution properties — development sites of 10–250 acres and buildings from 6,000 to 455,000 sq ft (its largest current project is the 604,096 sq ft Willow Creek Business Park). Services span development, general contracting through its in-house Adkisson GC Partners (tilt-wall construction), design-build, build-to-suit and site planning. Managing partners are co-founders Steve Adkisson (35+ years in the industry) and Arturo Creixell, plus Anthony Sarao, who heads the GC division; the lean team of ~7–20 staff generates roughly $5.9M in annual revenue.
ESB Puerto Rico Corp
tracker page ↗
the gentlemenfilter this group · 19d agoesbpr.com ESB Puerto Rico Corp is a distributor of automotive and industrial products that has served Puerto Rico since 1965 ("Energizando a Puerto Rico desde 1965"); it is headquartered in Carolina, PR, is a Hispanic-/minority-owned small business and a federal contractor (CAGE 3DPU1). Its portfolio spans automotive, traction and stationary/backup batteries, tires, lubricants and DEF, AUTEL diagnostics, tools, plus Hyundai and EP forklifts, warehouse equipment, rental, maintenance, OEM parts and e-commerce — a "one-stop source" for material handling, automotive and industrial operations in Puerto Rico and the Virgin Islands, representing ~9 brands (including Eternity Technologies). The president is Omar Aponte; the company stays lean (under ~25 staff, ~$2M revenue) and handles ~150 sea import shipments a year, mostly from Asia.
Nutrypollo
tracker page ↗
the gentlemenfilter this group · 19d agonutrypollo.com.mx zoominfo.com/c/nutrypollo/427100153 Nutrypollo / Agroindustrias Quesada, S. de R.L. de C.V. is a Mexican family-owned poultry company (4th generation) based in Aguascalientes; it began as Bernardo Quesada de Alba's egg-laying farm in 1950 and entered broiler production in 1963 under founder Jorge Quesada Morán. It is fully vertically integrated — genetics and hatching, feed milling, grow-out farms, slaughter and processing (12,000 birds/hour, up to 80,000 birds/day, ~60 million birds a year) and distribution across 30+ Mexican states. Brands include fresh chicken under Nutrypollo, the marinated Nutryfácil and Premium lines, and, since November 2023, its own NutryTienda retail concept. Certified TIF (SENASICA) and international Halal (FSSC 22000 in progress), it built a state-of-the-art plant with Marel/Stork lines in 2012–2015 — Mexico's first Marel demonstration site; the Quesada family still runs the business (CEO Cesar Quesada, Marketing Directo
Brebur
tracker page ↗
the gentlemenfilter this group · 19d agobreburltd.co.uk zoominfo.com/c/brebur-ltd/445718566 Brebur Ltd is a UK specialist subcontractor for steel frame systems (SFS), dry-lining, partitions, plastering and suspended ceilings, founded in 2002 (trading as Ace Fire Solutions Ltd until Dec 2012); it is based at Unit 1 Capitol Close, Dodworth, Barnsley, South Yorkshire. It delivers projects across the North of England for main contractors such as BAM, Kier and Willmott Dixon, and also installs lead-lined radiation-protection partitions for hospitals and acoustic raft/baffle solutions. It holds long-standing manufacturer partnerships (British Gypsum, Siniat/Knauf, and Ecophon's EPIC status since 2016) and has won a Gold National Quality Award plus BAM's Regional Contractor of the Year. With ~20 staff and net assets of ~£2.7m (2025), it sits under the Brebur Holdings / Brebur Group Ltd structure created in 2024 (directors Jamie Brenton and Vincenzo Lilley);
MB Associates
tracker page ↗
the gentlemenfilter this group · 19d agombassociates.org zoominfo.com/c/mb-associates/372858181 MB Associates is a UK social impact consultancy founded in 2005 by Mandy Barnett (London Business School MBA, chair of Social Value UK), based in Holmfirth, West Yorkshire; its legal entity is Mandy Barnett Associates Ltd (incorporated 7 Sep 2005, registered in Welwyn Garden City). It helps people, projects and organisations understand and increase their social impact — impact evaluation, SROI analysis, consultation and research, creative facilitation, training and toolkits — working through a Plan–Do–Review cycle that starts with a "Story of Change". Clients include Arts Council England, the National Lottery, UKRI-AHRC, Natural Resources Wales, Bristol City Council, the National Children's Orchestra, museums and charities; it also runs its own learning platform, Culture3 (culturecubed.org). In February 2026 the founder handed the firm over to colleagues — directors Jael Williams and Emily Wilson — and the brand
Exacta Optech Labcenter
tracker page ↗
the gentlemenfilter this group · 19d agoexactaoptech.com zoominfo.com/c/exactaoptech-labcenter-spa/426158257 Exacta + Optech Labcenter S.p.A. is an Italian one-stop distributor of instruments, consumables and reagents for scientific laboratories, founded in 1974/75 by Gian Amico Alessandrini and headquartered at Via Bosco 21, San Prospero (Modena). It supplies lab optics and instruments under its own Optech brand (biological/stereo/inverted microscopes, spectrophotometers, refractometers, polarimeters, micropipettes, cuvettes), chemicals, lab furniture, and designs turnkey laboratories; market segments include pharma, food, petrochemical/Oil&Gas, environment, education and oenology — where it is Hach-Lange's worldwide official partner. Its 1,500-page catalogue and e-shop list ~100,000 items; the team of ~35–45 includes 7 dedicated service technicians, backed by agreements with Avantor, Honeywell and LLG and the acquisitions of Ing. C. Bullio (2006) and Alkimia (2022). In 2024 the company rebranded from EXA
Servicios Aereos Estrella
tracker page ↗
the gentlemenfilter this group · 19d agosae.com.mx zoominfo.com/c/servicios-aéreos-estrella-s-a/457170292 Servicios Aéreos Estrella, S.A. de C.V. (SAE) is a Mexican business-aviation company and pioneer of executive aviation in Mexico with 30+ years of experience, based at Toluca International Airport — the main private-aviation gateway to Mexico City. It claims to be Latin America's largest FBO, with 12,000 m² of apron, 10,000 m² of hangar storage, four VIP lounges, a café/bar, VIP ground transport and an office next to immigration. Services include private jet charter and rental (from piston aircraft to long-range jets, plus discounted "Empty Legs"), aircraft management and administration, full handling/dispatch (permits, catering, documents, flight closures), aircraft storage and pet-friendly flights, operating 24/7 year-round.
Neumaticos Corral S.A.
tracker page ↗
qilinfilter this group · 19d agoAutomotive Parts
AUM Construction
tracker page ↗
qilinfilter this group · 19d agoElectricity, Oil & Gas
The Frame Group
tracker page ↗
qilinfilter this group · 19d agoBusiness Services
La Maison Des Travaux
tracker page ↗
qilinfilter this group · 19d agoBusiness Services
BLISS 1041
tracker page ↗
qilinfilter this group · 19d agoAccounting Services
CareClinics
tracker page ↗
qilinfilter this group · 19d ago0
lindner-group.com
tracker page ↗
m3rxfilter this group · 19d agoLindner Group is Europe's leading manufacturer and service provider specializing in interior fit-out, building envelope, and insulation technology. With over 60 years of experience, the company offers tailored project solutions and products, ranging from ceilings, floors, and partitions to clean rooms and HVAC systems. Their diverse client base includes industries requiring renovation, refurbishments, and turnkey projects, with a commitment to digitalization and sustainability. Operating in more than 40 countries with approximately 8,000 employees, Lindner Group places emphasis on innovation, quality, and customer-centric service Stolen: 4.6TB 2,638,995 Files
wittmann
tracker page ↗
inc ransomfilter this group · 19d agoNo details on the leak post beyond the victim name.
Integrated Health Systems
tracker page ↗
coinbase cartelfilter this group · 19d agoBusiness Services - $9.3 Million
RXPE Group
tracker page ↗
coinbase cartelfilter this group · 19d agoElectronics - $319 Million
Tower Insurance
tracker page ↗
coinbase cartelfilter this group · 19d agoInsurance - $283.7 Million
Flecha Bus
tracker page ↗
coinbase cartelfilter this group · 19d agoTransportation, Freight & Logistics Services - $366.3 Million
OTEIS Conseil & Ingénierie
tracker page ↗
coinbase cartelfilter this group · 19d agoArchitecture, Engineering & Design - $69.8 Million
Longhorn Investments
tracker page ↗
coinbase cartelfilter this group · 19d agoFinance - $15.5 Million
Kessler Creative
tracker page ↗
coinbase cartelfilter this group · 19d agoAdvertising Networks - $17.1 Million
Klasko Immigration Law Partners
tracker page ↗
coinbase cartelfilter this group · 19d agoLaw Firms & Legal Services - $19.7 Million
Patel
tracker page ↗
coinbase cartelfilter this group · 19d agoAccounting For Legal Practices - $5 Million
Abacus Advisors
tracker page ↗
coinbase cartelfilter this group · 19d agoAccounting For Legal Practices - $5 Million
LifeBank Microfinance Foundation
tracker page ↗
coinbase cartelfilter this group · 19d agoFinance - $5 Million
PT Perusahaan Jamu Air Mancur
tracker page ↗
coinbase cartelfilter this group · 19d agoPharmaceuticals & Healthcare - $100 Million
PT. Bank Perekonomian Rakyat Bintan
tracker page ↗
coinbase cartelfilter this group · 19d agoBanking & Financial Services - $5 Million
Uniguacu
tracker page ↗
emperadorfilter this group · 19d agofull commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! Publication scheduled: 2026-09-13 02:22:46 UTC Size: 151.0 MB Sectors: Education
TERRA*** & MON****
tracker page ↗
majinahanashifilter this group · 19d agoPUBLICATION SCHEDULED. Publication scheduled: 2026-09-05T08:08:00Z Package: 896 MiB / 6341 files
Oilquip Inc
tracker page ↗
inc ransomfilter this group · 19d agoNo details on the leak post beyond the victim name.
McKesson Corporation
tracker page ↗
shinyhuntersfilter this group · 19d agoHundreds of millions of records/rows of data was compromised containing very sensitive information spanning from PII to PHI. We urge you to reach out. Read our emails. We will provide a substanial discount. Failure to engage with us will result in the full publication of data taken from you and we very much intend to carry that out if you do not engage with us. This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.
cutlercapital
tracker page ↗
lynxfilter this group · 19d agoCutler Capital Management, LLC of Worcester, MA is an investment advisory firm r...
wmdn.net
tracker page ↗
3amfilter this group · 19d agoTwin States News is a media organization that provides comprehensive coverage of local, state, national, and world news. Their services include reporting on various topics such as crime, education, health, politics, and community events. The inten | PUBLISHED 1% | Views: 43
Elekta AB
tracker page ↗
shinyhuntersfilter this group · 19d agoThis is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.
Jack Henry & Associates
tracker page ↗
shinyhuntersfilter this group · 19d agoThis is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.
SITTNAK Lojistik A.Ş.
tracker page ↗
doommageddonfilter this group · 19d agoupcoming | — | 0 files
Akpera Gayrimenkul Yatırım A.Ş.
tracker page ↗
doommageddonfilter this group · 19d agoupcoming | — | 0 files
apatpa.com
tracker page ↗
lockbit5filter this group · 19d agoAmerican Plan Administrators offers smart self-funded healthcare solutions designed to maximize savi...
Alter Consultores Legales
tracker page ↗
qilinfilter this group · 19d agoLaw Firms & Legal Services
H.W. Lochner
tracker page ↗
payoutskingfilter this group · 19d agoNo details on the leak post beyond the victim name.
corematerials.com
tracker page ↗
chaosfilter this group · 19d agoCore Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m…
macallister.com
tracker page ↗
chaosfilter this group · 19d agoMacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo…
Newton County School System
tracker page ↗
qilinfilter this group · 20d agoEducation
Berlin, Germany
tracker page ↗
rhysidafilter this group · 20d agoBerlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: Geb�udeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell � Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 2025�2026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/M�LLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQL dumps 2020�2026, PST archives, leadership private data (IBANs, ID cards, Behrendt's bank card).NDA: 3,226 documentsLegal violation map (GDPR Art. 32/9/33, VSA/StGB upon VS classification confirmation, BSIG/KRITIS) More
Valley Health Team
tracker page ↗
rhysidafilter this group · 20d agoValley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial statements, salaries, taxes.Dear customers, please submit your requests�there are plenty of files here that can be monetized. More
Alumax
tracker page ↗
akirafilter this group · 20d agoAlumax Alumínios specializes in the distribution of aluminum and accessories for the construction industry, focusing on providing tailored solutions for builders and metalworkers. The company prides itself on its partnership with Hydro, a global leader in sustainable aluminum, allowing them to offer high-quality products that meet the market's demanding needs.We will upload 58gb of corporate data soon. Detailed employee personal information (passports, IDs, and another personal docs scans), client information, projects, financials, confidential files, contrast and agreements, NDAs and so on.
ProCare
tracker page ↗
money messagefilter this group · 20d agoNo details on the leak post beyond the victim name.
FE CREDIT
tracker page ↗
black xfilter this group · 20d agoWe have obtained the personal information of your company's millions of customers. If the reverse clock is terminated, customer information will be leaked from our site. Please contact us to prevent customer information leakage.
i-one
tracker page ↗
black xfilter this group · 20d agoWe have obtained all of your company's technical data. If you do not contact us, the data will be leaked.
BEPeterson
tracker page ↗
akirafilter this group · 20d agoBEPeterson is a full-service metal fabricator specializing in custom solutions for vessels, tanks, and heavy-gauge metal parts since 1935. The company serves a diverse range of industries including defense, medical, energy, and industrial sectors, providing high-quality products through advanced manufacturing techniques.We will upload 20gb of corporate data soon. Employee personal information, client information, projects, financials, NDAs and so on.
JRT Mechanical
tracker page ↗
akirafilter this group · 20d agoJRT Mechanical is a full-service mechanical contractor specializing in plumbing, HVAC, hydronics, and mechanical insulation, serving the Pacific Northwest for over 30 years. Founded in 1992,the company has expanded from a small plumbing business to a robust team of over 160 employees, focusing primarily on commercial and industrial projects.We will upload 46gb of corporate data soon. Detailed employee personal information (SSNs, passports, DLs, resumes, and another personal docs scans), medical information, client information, projects, financials, confidential files, contrast and agreements, NDAs and so on.
DigiGround
tracker page ↗
qilinfilter this group · 20d agoBusiness Services

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.