SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

Neueste Einträge

leakeddataM... C...—
kein Firmenname im Eintrag

Beschreibung der Täter

To be announced...

Herkunft

silent ransomM... C...—
kein Firmenname im Eintrag

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

qilinUnited Restaurant SupplyUS

Beschreibung der Täter

N/A

Herkunft

silent ransomM...r—

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

silent ransomKirkland & Ellis LLPUS

Beschreibung der Täter

[AI generated] Kirkland & Ellis LLP is a global law firm headquartered in Chicago, Illinois, United States. It operates in the legal services industry, providing counsel in private equity, mergers and acquisitions, restructuring, litigation, intellectual property, and tax law. One of the world's largest law firms by revenue, it serves corporate clients, investment funds, and financial institutions through offices across the United States, Europe, and Asia.

Herkunft

leakeddataM...r—

Beschreibung der Täter

To be announced...

Herkunft

bravoxAMSAM 🇫🇷FR

Beschreibung der Täter

Social, Healthcare and Home Care Services.

Herkunft

akiraBethany Press International—

Beschreibung der Täter

Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib ute millions of life-changing Christian books each year. They offer industry-leading publishing services for both short-run and long-run printing and distribution. We will upload 40gb of corporate data soon. Employee personal information (financials and so on ), customer information, financials, contracts and agreements, and so on.

Herkunft

akiraMedienwerkstattDE

Beschreibung der Täter

Medienwerkstatt stands for digital and printed communication of the highest quality and disting uishes itself through an exceptional customer service. With more than 50 passionate talents for various offline and online disciplines, medienwerkstatt ag is one of the largest media service providers in the canton of Thurgau. We will upload 130gb of corporate data soon. Employee personal information (names, addresses, p hones, contacts and so on), customer information, contracts and agreements, and so on.

Herkunft

akiraAnnapathUS

Beschreibung der Täter

Annapath, Inc. is a privately owned surgical and cytopathology laboratory that primarily focuse s on dermatopathology, serving clients in Maryland, Delaware, Pennsylvania, Washington D.C., Vi rginia, and West Virginia. The company offers a full range of anatomic and clinical pathology s ervices, emphasizing prompt and accurate diagnoses with a commitment to exceptional customer se rvice. We will upload 110gb of corporate data soon. Employee personal information (passports and other s personal files), customer information, contracts and agreements, and so on.

Herkunft

rhysidaDR.SCHNELL GmbH & Co. KGaADE

Beschreibung der Täter

DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA � full network dump. 175,151 files / 2.52 TB.1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement).Complete HR & payroll for Germany, Switzerland, Austria: home addresses, personal emails, payslips with social-security and tax IDs, long-term sick lists (GDPR Art. 9 data).Family-office accounting: signed annual statements of dozens of related entities, bank statements, a EUR 35M credit-line agreement.CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns.Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists. More

Herkunft

qilinAirtificial—

Beschreibung der Täter

Architecture, Engineering & Design

Herkunft

leakeddataKirkland & Ellis LLP—

Beschreibung der Täter

To be announced...

Herkunft

everestPWC—

Beschreibung der Täter

2 posts - 1h

Herkunft

bravoxBarrow & Grimm 🇺🇸US

Beschreibung der Täter

Legal Services, Business Litigation and Corporate Law.

Herkunft

everestPWCGB

Beschreibung der Täter

[AI generated] PwC (PricewaterhouseCoopers) is a multinational professional services network headquartered in London, United Kingdom. It is one of the "Big Four" accounting firms, offering audit and assurance, tax, consulting, and advisory services to businesses, governments, and organizations worldwide. PwC operates across numerous industries including finance, technology, healthcare, and energy, serving clients in over 150 countries globally.

Herkunft

qilinBathurst RSLAU

Beschreibung der Täter

Hospitality

Herkunft

qilinCreative UniverseAU

Beschreibung der Täter

Business Services

Herkunft

lockbit5istanbultrading.com—

Beschreibung der Täter

Istanbul Foodstuff Trading Co LLC is a company that operates in the Computer Equipment & Peripherals...

Herkunft

  • istanbultrading.com
  • Pfad auf der Leak-Seite: /post/cc721543382c0d008c07a3d34d109662
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 22.10.2026
n0nCompany #108CA
kein Firmenname im Eintrag

Beschreibung der Täter

media production (audio description and accessibility media) · Montreal, Quebec, Canada

Herkunft

n0nCompany #109US
kein Firmenname im Eintrag

Beschreibung der Täter

plumbing and kitchen products distribution · Cincinnati, Ohio, United States

Herkunft

n0nCompany #107BG
kein Firmenname im Eintrag

Beschreibung der Täter

fuel trading and construction materials · Bulgaria

Herkunft

n0nCompany #106US
kein Firmenname im Eintrag

Beschreibung der Täter

Financial Advisory & Restructuring (US) · Chicago, Illinois, USA

Herkunft

n0nCompany #105US
kein Firmenname im Eintrag

Beschreibung der Täter

diamond and lab grown diamond trading · New York, New York, United States

Herkunft

n0nCompany #104US
kein Firmenname im Eintrag

Beschreibung der Täter

Legal Services - Family Law (US) · California, USA

Herkunft

n0nPerformance Ford IncUS

Beschreibung der Täter

automotive retail · United States

Herkunft

space bearsSGLA (Schwartz, Giannini, Lantsberger & Adamson)US

Beschreibung der Täter

Schwartz, Giannini, Lantsberger & Adamson (SGLA) Accountancy Corporation is a full-service certified public accounting firm based in Stockton, California, founded in 1988. The firm provides tax planning and compliance, audits, reviews and compilations, bookkeeping, payroll, outsourced CFO support, and business consulting for individuals and companies. It has particular experience with real estate, healthcare, nonprofits, affordable housing, common-interest realty associations, and local government clients. SGLA positions itself as a hands-on local CPA practice that combines traditional accounting work with practical advice to help clients stay compliant and grow.*After the timer expires, you will be able to freely download several fragments of the full archive for review. To purchase the complete archive, please contact our manager. [Link entfernt]

Herkunft

lamashtuHecker HolzsystembauDE

Beschreibung der Täter

German construction company specializing in custom timber houses, sustainable wood construction, and prefabricated buildings. It offers complete project planning, roofing, extensions, renovations, and turnkey solutions for residential, commercial.

Herkunft

everestLinebarger Goggan Blair & SampsonUS
behoerden

Beschreibung der Täter

[AI generated] Linebarger Goggan Blair & Sampson LLP is a United States law firm specializing in government receivables, particularly delinquent tax collection and debt recovery for municipalities, counties, school districts, and other public entities. Headquartered in Texas, it operates across multiple states, representing public sector clients in collection litigation and related legal services. It is a prominent player in the government collections legal industry.

Herkunft

payoutskingMerical LLC—

Herkunft

silent ransomK.r.a. ...s—

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

lamashtuGräfliches Hofbrauhaus FreisingDE

Beschreibung der Täter

German brewery specializing in the production and distribution of traditional Bavarian beers. The company uses traditional brewing methods and supplies beer products to local and regional markets.

Herkunft

lamashtuVERGI MuensterDE
energie

Beschreibung der Täter

German tax advisory and business consulting firm providing tax return preparation, bookkeeping, annual financial statements, auditing, fiduciary services, and consulting for start-ups and established businesses.

Herkunft

n0nHeritage Senior LivingUS
healthcare

Beschreibung der Täter

healthcare support services · United States | Network security configuration of a healthcare support provider; Internal network segmentation maps; Remote access account structures | [NOT PAID — EXPOSED]

Herkunft

inc ransombereskinparr.com smartbiggar.caCA

Herkunft

lamashtuFuG-GruppeDE

Beschreibung der Täter

A German IT systems integrator and general contractor (Systemhaus) based in Halver, North Rhine-Westphalia (NRW), founded in 1950. The company specializes in IT/EDP integration and ERP solutions for industrial businesses, steel trading companies

Herkunft

lamashtuMECA-PRECISFR

Beschreibung der Täter

Méca-Précis is a French industrial manufacturer specializing in precision stamping dies, sheet metal stamping, and metal component production. It serves the automotive, construction, and home appliance industries, offering custom tooling

Herkunft

lamashtuWEPOS ChemieDE

Beschreibung der Täter

WEPOS Chemie is a German company founded in 2007 that develops, manufactures, and sells specialized cleaning and care products for homes, gardens, floors, tiles, and hygiene, including mold removers. Its products are made in Germany.

Herkunft

leakeddataK.r.a. ...s—

Beschreibung der Täter

To be announced...

Herkunft

whitearmorWhirlpool—

Beschreibung der Täter

Whirlpool is a global home appliance manufacturer (NYSE: WHR) making washers, fridges, and cooking appliances under brands like KitchenAid and Maytag. Its 2025 annual revenue was about $15.52 billion. We hold 4,577 Whirlpool employee records across three plants, names, AD-style usernames, managers, cost centers, shifts, along with 374 corporate emails, ~22,000 SAP invoice records, and the full plant contact infrastructure. Pay, and this stays quiet. Don't, and the data goes public. We want $140,000 in BTC or XMR. You will receive an email containing instructions on how to proceed. Samples: [Link entfernt] Contact: whitearmorrxd@proton.me Session: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67

Herkunft

leakeddataK.r.. ...s—

Beschreibung der Täter

To be announced...

Herkunft

silent ransomK.r.. ...s—

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

leakeddataK.r.. ...—
kein Firmenname im Eintrag

Beschreibung der Täter

To be announced...

Herkunft

auroraAllmand-Smith LimitedGB
finanzen

Beschreibung der Täter

[distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) — a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent. Domain admin credentials in plaintext and a full DC dump — STORMGUARD\MichaelAdmin / 5t0rmGuard Complete NatWest banking infrastructure — blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15 entities. NatWest has 3 outstanding registered charges (Jun 2026). Full payroll for every employee, current and former — Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records. Complete financial records for 15 entities — Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan, Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds

Herkunft

n0nHanjin Information Systems & Telecommunication Co., Ltd.KR
telekommunikation

Beschreibung der Täter

IT services · South Korea | A complete corporate identity directory of an IT services company, 999 personnel accounts with names and corporate email addresses; The client staffing structure showing which personnel are seconded to major client organizations; Third party vendor accounts and their corporate domains | [NOT PAID — EXPOSED]

Herkunft

payoutskingi****g—
kein Firmenname im Eintrag

Herkunft

silent ransomPorter Hedges LLPUS

Beschreibung der Täter

[AI generated] Porter Hedges LLP is a full-service business law firm based in Houston, Texas, United States. It operates in the legal services industry, providing counsel in areas such as energy, corporate transactions, finance, litigation, bankruptcy, real estate, and labor and employment law. The firm primarily serves corporate clients, including businesses in the oil and gas sector, and operates within the United States.

Herkunft

leakeddataPorter Hedges LLP—

Beschreibung der Täter

To be announced...

Herkunft

helixWestrock CoffeeUS

Herkunft

helixWestrock CoffeeUS

Beschreibung der Täter

Westrock Coffee records. Yearly revenue ~$1.2 billion yearly. GoFile links and passwords unlock in 24 hours.

Herkunft

interlockCoastal Alabama Community CollegeUS
finanzen

Beschreibung der Täter

[Link entfernt] Coastal Alabama Community College demonstrates an extreme disregard for its own security and the security of its students and makes no attempt to address these deficiencies. Therefore, we are publishing their sensitive information, such as student education records, protected health information, financial aid and loan information, employee personnel files, Social Security numbers, and payment card data. They are also known for their incidents, and we are making this information publicly available to you. As a result, they violate laws such as HIPAA, FERPA, GLBA, and PCI DSS.

Herkunft

brain ciphernovagroupgbc.comGB

Beschreibung der Täter

Total size - 70GB. Contents: Invoices with numbers and amounts, draw payment schedules, unit costs; reports listing owners' names; property details. If you think you are here by m...

Herkunft

brain cipherclinicaromero.comAR
healthcare

Beschreibung der Täter

16,000 files, include: Patients in the psychiatric service; Patients in the substance abuse treatment service; Staff medical records and internal correspondence. If you think you a...

Herkunft

brain cipheroflaherty-law.comIE

Beschreibung der Täter

32GB - materials related to adoptions, paternity, and DNA tests involving minors, as well as phone records and correspondence. If you think you are here by mistake, please contact ...

Herkunft

brain ciphersodali.comUS

Beschreibung der Täter

13,000 documents include: Annual Shareholders' Meetings—Swiss and German Clients. A complete list of issuer clients, their corporate documents, voting schedules, and voting result...

Herkunft

brain ciphersrsnodgrass.comUS
finanzen

Beschreibung der Täter

Total size - 100GB, 45,000 documents. Contents: Financial statements and pre-audit working papers; lists of bank employees; insider information on the financial condition of approx...

Herkunft

brain cipherprosomnus.comUS
healthcare

Beschreibung der Täter

Total size - 100GB, 78,000 files. Contents: Patients' PHI; Kaiser Permanente Patient-Partner Tracking Sheet; Non-public FDA regulatory files; .bak; .pst.; If you think you are here...

Herkunft

brain cipherolyortho.comUS
healthcare

Beschreibung der Täter

Total size - 105GB, 146,000 files. Contents: Patients' medical information (PHI under HIPAA); employee HR data; legally privileged materials; email; operational/technical documents...

Herkunft

brain ciphermvjllp.com—

Beschreibung der Täter

Big Data - total size 1.66TB, over 500k files. 413 court cases, internal work documents of the law firm and its clients, including privileged materials and PII/PHI. If you think yo...

Herkunft

akiraFlextron Circuit AssemblySG

Beschreibung der Täter

Flextron Circuit Assembly specializes in quick-turn prototype PCB manufacturing and assembly, o ffering a comprehensive range of services including design, fabrication, and assembly of printe d circuit boards (PCBs). We will upload 34gb of corporate data soon. Employee personal information (passports, DLs, addr esses, emails and so on), financials, NDA, and so on.

Herkunft

akiraCascade Flooring AmericaUS

Beschreibung der Täter

Cascade Flooring America is a flooring store located in Vancouver, WA, offering a wide range of products including flooring, furniture, window coverings, and kitchen and bath services. The c ompany caters to homeowners looking for premium flooring solutions, with options such as carpet , hardwood, luxury vinyl, laminate, and tile. We will upload 50gb of corporate data soon. Employee personal information (passports and other personal information), client information, financials, confidential files, NDA, and so on.

Herkunft

helixHyperthermUS

Herkunft

helixHyperthermUS

Beschreibung der Täter

Hypertherm records. Yearly revenue ~$650.7 million yearly. GoFile links and passwords unlock in 24 hours.

Herkunft

hyflockgabonmeca.com leak incidentGA
kein Firmenname im Eintrag

Beschreibung der Täter

gabonmeca.com is a large, comprehensive office supplies and IT equipment retail and service company in the African country of Gabon, with the corporate slogan 'La Solution Bureau' (Office Solutions). It’s very well-known locally in Gabon, and its main businesses and features include: • Business scope: Offering over 13,000 products, covering student stationery and school supplies, office furniture, office automation equipment (like Canon printers/copiers), computers and IT digital products, premium leather goods, and copying/printing services. • Rich history: The company has been established in Gabon since as early as 1959 (even tracing back to 1957), making it a long-standing local enterprise. • Locations: Headquartered in Libreville, Gabon’s capital, with chain stores, showrooms, and after-sales service centers in major cities and industrial areas like Oloumi, Akanda, Owendo, Port-Gentil, and Moanda. • Digital services: Besides the official website, they also launched the Gabon Meca mobile app, making it easy for local customers to browse products online, check back-to-school stationery lists (Liste Scolaire), and get quotes. If you need office bulk purchases, school stationery, o

Herkunft

hyflockdangvuongcacVN

Beschreibung der Täter

We got their hotel room info and all kinds of chat records.,,dangvuongcac.com (commonly called Teng Wang Ge or Tengwang Pavilion in Chinese) is a very well-known large-scale, male-oriented high-end entertainment club, spa massage, and KTV group in Ho Chi Minh City, Vietnam. In the Chinese 'experienced insider' circles and the local nightlife scene, it’s often referred to as the 'Vietnam Dragon Palace' or as part of the 'Yueyang Tower/Yueyang Tower system' (Hệ Thống Nhạc Dương Lầu). Here’s a brief overview of the company’s background and main business: 1. Business Nature and Positioning It’s not an ordinary massage or wellness shop. It’s a high-end, male-focused comprehensive adult nightlife venue (Empire of Nightlife). Its main offering isn’t purely physical therapy, but more of a ‘pro’ project that emphasizes socializing, partying, and entertainment. 2. Core Services • High-end Spa/Massage: Offers advanced, entertainment-oriented massage packages including Thai, essential oil, Nuru (sliding bed), and some premium rooms include bathing with staff. • Pool Party: This is a signature feature, with large indoor luxury spa pools and special pools with artificial rain, supporting multi-p

Herkunft

pearAdobe Insurance Brokers, LLCUS
finanzen

Beschreibung der Täter

Independent insurance agency located in Morgan Hill, California

Herkunft

the gentlemenWeld Re 8 School DistrictUS

Beschreibung der Täter

weld8.org Weld Re-8 School District public school district founded in 1914 in Fort Lupton, Colorado, serving about 2500 students across 7 schools with a 43.5 million dollar budget. The student body is 76 percent minority with over half on free lunch, and academics are weak, math proficiency 16 to 19 percent, reading 22 to 26 percent, far below state averages. The core problem is teacher pay, starting salaries 47500 dollars versus 53000 to 64500 nearby, driving 23 percent yearly turnover. Voters rejected four tax requests since 2023, and on November 3 2026 they vote Issue 5C, a 4.9 million dollar tax hike, or face 1.3 million in mid-year cuts. New superintendent Dr. Justin Ralston launched a 2026 to 2029 plan reviving agriculture and adding IT and cybersecurity tracks. Oil and gas covers over half the local tax base.

Herkunft

n0nCompany #103PT
kein Firmenname im Eintrag

Beschreibung der Täter

engineering design and installations · Portugal | [PENDING EXPOSURE]

Herkunft

n0nCompany #102US
kein Firmenname im Eintrag

Beschreibung der Täter

network and IT services · New York, United States | [PENDING EXPOSURE]

Herkunft

n0nCompany #101US
kein Firmenname im Eintrag

Beschreibung der Täter

wholesale distribution · Dallas, Texas, United States | [PENDING EXPOSURE]

Herkunft

n0nCompany #100US
kein Firmenname im Eintrag

Beschreibung der Täter

rheumatology medical practice · Riverside, California, United States | [PENDING EXPOSURE]

Herkunft

n0nCompany #99EC
kein Firmenname im Eintrag

Beschreibung der Täter

health insurance administration · Guayaquil, Ecuador | [PENDING EXPOSURE]

Herkunft

whitearmorW.A—

Beschreibung der Täter

Hello, We are WhiteArmor, an organization focused on data-theft extortion, with further motive to expand in to ransomware operations when considered big enough. We are currently seeking the following people of roles and experiences: Penetration testers Web-exploitation Zero-day research A word due; if you are unfamiliar with the experiences slash roles listed above, do not consider attempting to join. Should you attempt to contact us and join, you will be blocked. Our fee if you hit a successful ransom payout is 5%. The rest is yours. ​​​​​​​ Our contacts are available on our DLS below; [Link entfernt] entfernt]

Herkunft

whitearmorUpdates.—

Beschreibung der Täter

Hi all; spots within the group are still open. If you're looking to join, you can find our contact information at the top right. Our ransomware is nearly complete, and we have multiple companies lined up to list, including Fortune 500 companies and multi-billion-dollar revenue firms. To be clear, we're not just some random skid group. We are releasing Disney's Staff Directory as a little start to our group, though more to come. Anyways, enjoy. This data is unrelated to the NullBulge leak; it was exfiltrated via a JWT authentication bypass vulnerability in the gateway.

Herkunft

everestPLD Group—

Beschreibung der Täter

2 posts - 8h

Herkunft

everestLindauer DornierDE

Beschreibung der Täter

2 posts - 7h

Herkunft

everestLanham Associates—

Beschreibung der Täter

2 posts - 7h

Herkunft

n0nTheHomeMag NorCalUS

Beschreibung der Täter

home services advertising · US | Internal network configuration and access credentials of a US home-services advertising franchise; Staff contact and infrastructure records | [NOT PAID — EXPOSED]

Herkunft

everestHaier—

Beschreibung der Täter

2 posts - 6h

Herkunft

clopLEGAL-RECORDS.USUS

Herkunft

sovcaliThe Complete Engineering Data Chain in ADAS and Automotive Structural Projects: What Usual—
kein Firmenname im Eintragautomotive

Beschreibung der Täter

Companies prefer to keep the behind the scenes aspects of their design and analysis processes out of public view. What is usually released consists of final reports and summarized presentations not the actual chain through which the data is produced.

Herkunft

sovcaliThey Failed. 100GB Drops in 2 DaysIN

Beschreibung der Täter

Despite giving the Lucid Motors company more than enough time to respond and deliberately keeping the pressure relatively low, they have still failed to take any appropriate action.In two days we will release a further update, make our position crystal clear, and also publish 100 GB of data

Herkunft

sovcalileak #1 lucidmotors—
kein Firmenname im Eintrag

Beschreibung der Täter

In line with our previously discussed approach, the proposed strategy to formally demonstrate to Lucid that we are in possession of their data consists of the controlled upload of approximately 35 GB of technical material.This dataset comprises finite element analysis (FEA/CAE) files, specifically .fem model files, .h3d result files, .out and .spcf output files, together with associated summary reports in .pptx and .xlsx formats. The materials focus on stiffness studies, strain-energy evaluations, displacement assessments, and NVH analyses relating to the mid-sized IC display housing and the Pull/Outboard Switch simulations.

Herkunft

sovcaliTHE ENDGAME OF LUCID MOTORS’ PSYCHOLOGICAL GAME—

Beschreibung der Täter

Addressed to Lucid Motors management, deceived investors, and the engineers who have been working unnecessary overtime for months:Lucid Motors executives claimed in the media that our intrusion was superficial and that only the systems of a “secondary supplier” had been compromised. They lied to you in an attempt to protect the company’s stock value. Today, with hard and incontrovertible evidence, we are putting the truth on the table.The package released today, totaling 159 GB, is not a simple file or an email list; it is the heart of the internal design architecture of your upcoming Midsize Vehicle Platform.

Herkunft

sovcaliTHE ANATOMY OF A COMPROMISED ARCHITECTURE: LUCID’S SECRETS ARE UNRAVELED—
kein Firmenname im Eintrag

Beschreibung der Täter

We have observed that you have chosen to hide behind your silence while assuring your shareholders that “everything is under control.” You appear to believe that by remaining silent and buying time, the value of the stolen data will gradually diminish. You have miscalculated. We have no intention of burning all of our leverage at once. We understand how to play chess.

Herkunft

sovcali[SELL] Lucid Motors Data Auction: 5 TB of Engineering Data & Source Code—
kein Firmenname im Eintrag

Beschreibung der Täter

To international automakers, technology-hungry competitors in China and the United States, and misled investors:The exclusive negotiation window with the arrogant corporate suits at Lucid Motors is now permanently closed. They chose to hide behind garbage public-relations statements, deliberately downplay the severity of the crisis, and place their bets on federal law enforcement. Since Lucid's management has proven they don't give a damn about the billions of dollars dumped into their R&D operations or the thousands of engineering hours behind them, we are, in accordance with our manifesto, formally transferring the ownership and exploitation rights of this tech to their direct competitors.

Herkunft

sovcaliHollywoodHair.plPL

Beschreibung der Täter

List of data packages ready for public release If the wallet is not charged by the end of the countdown, this entire database will be put up for public sale: Customer identity table (408 pages): Includes full names, emails, valid European numbers, and Polish national ID numbers (PESEL) of all your customers (along with exact birth dates)

Herkunft

hyflocktdotnetBD

Beschreibung der Täter

T Dot Net is a local broadband internet service provider (ISP) operating in Bangladesh, primarily serving areas in Jhikargacha, Jessore (such as Fatepur and Narangali Bazaar). Service Details Core Services: High-speed home and corporate broadband internet, Wi-Fi setups, and network troubleshooting Popular Packages: Offers budget-friendly tiers like 30 Mbps for ৳500/month and 70 Mbps for ৳525/month, alongside higher speeds up to 100 Mbps. Features: Includes unlimited access to Facebook and YouTube, FTP server access, and a dedicated client mobile app (developed by SoftifyBD) for managing accounts and paying bills via bKash ([Link entfernt]

Herkunft

  • play.google.com
  • Pfad auf der Leak-Seite: /blog/view/1791770344597241094_Gkik1MJ5
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 21.10.2026 · Land aus dem Text abgeleitet
scarlettgroupgenesys.comUS

Beschreibung der Täter

Genesys Cloud Services, Inc. is a Cloud-based customer experience software specializing in contact centers, AI-powered customer support, and business communications.

Herkunft

scarlettgroupnbcuniversal.comUS

Beschreibung der Täter

NBCUniversal is a global entertainment company producing films, television, news, streaming, and world-class theme park experiences worldwide.

Herkunft

n0nXylanpicksUS

Beschreibung der Täter

online sports betting analytics · United States | The complete database of a sports betting analysis platform, including 108,781 historical game results; Every model-generated betting pick with model probabilities and outcomes; Live paid API keys for sports data providers | [NOT PAID — EXPOSED]

Herkunft

bravoxGSE-M Technology Sdn. Bhd.MY

Beschreibung der Täter

Industrial Engineering, Manufacturing Automation and Custom Machinery Solutions.

Herkunft

emperadorBruin Group LLCUS

Beschreibung der Täter

Bruin Group LLC is a telecom expense management (TEM) and communications auditing firm. Companies hand them carrier invoices, circuit inventories, wire instructions, letters of authorization, and internal ticket correspondence so Bruin can audit and recover overcharges. Bruin sits on a concentrated pile of third-party financial and telecom data for every client they serve. We have your entire ticket repository. Wire instructions, account numbers, W-9s, EINs, signed LOAs, Tenet patient call traces, all of it, for every client you manage. Tenet. Welltower. USDA. MarineMax. Allegis. Lincare. Salvation Army. Realogy. Delek. Quiktrip. CubeSmart. SRS. Baymark. Partial list. $1,000,000 in BTC or XMR. Pay and it ends. Don't and we contact your clients directly with their own documents, then publish one company at a time. emperadorlol@proton.me xdlmfao@morke.ru Session: 05651c732327b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Telecommunications]

Herkunft

leakeddataM... M...—
kein Firmenname im Eintrag

Beschreibung der Täter

To be announced...

Herkunft

silent ransomM... M...—
kein Firmenname im Eintrag

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

silent ransomP... H...—
kein Firmenname im Eintrag

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

leakeddataP... H...—
kein Firmenname im Eintrag

Beschreibung der Täter

To be announced...

Herkunft

global secret groupGraves Fireplaces, Inc.US

Beschreibung der Täter

Country: Cumming, Georgia, US | Website: www.gravesfireplaces.com | Revenue: $5.3 Million | Industry: Hearth Products, Fireplace Sales and Installation | Employees: 20-50 | Properties: 76.1 GB (77,117 Files, 5,170 Folders)

Herkunft

inc ransomcentralrogers.comUS

Herkunft

dark projectAsensus SurgicalUS
healthcare

Beschreibung der Täter

Asensus Surgical fell victim to a cyberattack, resulting in the theft of more than 600 GB of data and over 85,000 files containing confidential information, employees’ personal documents, research findings, and all of the company’s internal information.

Herkunft

dark projectBeach Eye Medical GroupUS
healthcare

Beschreibung der Täter

As a result of the attack on Company Beach Eye Medical Group, more than 200 GB of confidential data was stolen. The data comprises more than 250,000 files containing information about the organization’s employees and their patients, medical records, and doctors reports, as well as other important company information.

Herkunft

dark projectThe Excalibur GroupUS
finanzen

Beschreibung der Täter

Company The Excalibur Group was attacked, resulting in the theft of more than 600 GB of confidential data, such as banking and other financial information, personal data of employees and customers, and information marked “secret”. Currently, more than 400,000 files are not protected by The Excalibur Group

Herkunft

the gentlemenC**** Technologies—
kein Firmenname im Eintrag

Beschreibung der Täter

C**** Technologies c****technologies.com specializes in designing and manufacturing compression seal fittings, temperature sensors, and cable and harness assemblies for a diverse range of industries. Their products cater to applications in power generation, semiconductor, and furnace and autoclave sectors, among others. The company is committed to providing custom-designed solutions to meet specific client needs. With a focus on quality and innovation, C**** Technologies aims to address complex engineering challenges for its clients.

Herkunft

the gentlemenP**** ProductsUS
kein Firmenname im Eintrag

Beschreibung der Täter

P**** Products p****products.com specializes in storage and material handling equipment, offering a wide range of products including lockers, shelving, pallet racks, garment dispensers, and hygiene products. Their offerings cater to various sectors such as schools, healthcare, and government agencies, with a focus on providing durable and efficient storage solutions. The company operates a modern manufacturing facility in North Carolina and utilizes QuickShip distribution centers to ensure timely delivery of products. P**** is committed to quality and innovation, serving clients with tailored solutions for their storage needs.

Herkunft

silent ransomP...S...R...—
kein Firmenname im Eintrag

Beschreibung der Täter

Redacted entry - full company name pending disclosure (FULL DATA TIMER active).

Herkunft

leakeddataP...S...R...—
kein Firmenname im Eintrag

Beschreibung der Täter

To be announced...

Herkunft

n0n51Ridge (Newark NJ hosting/IT)US

Beschreibung der Täter

IT services · USA

Herkunft

booba teamChicago Vein InstituteUS
healthcare

Beschreibung der Täter

Medical Practices Website: www.chicagoveininstitute.com Stolen data: 3 GB.

Herkunft

booba teamResearch Foundation of The City University of New YorkUS

Beschreibung der Täter

Education Administration Programs Website: www.rfcuny.org Stolen data: 295 GB.

Herkunft

auroraDuarte Nursery, Inc.US

Beschreibung der Täter

Duarte Nursery, Inc. is a wholesale deciduous fruit and nut tree nursery in Hughson, California — an S Corporation run by brothers John and Jeff Duarte. The dataset is the company's complete digital footprint: 300–500 full Social Security numbers from California DE9 quarterly employment tax filings (2024 Q1 through 2026 Q2). The owners' complete identity packages — John Duarte: SSN 545-67-5279, DOB 9/9/1966, DL C3261756, BofA account 325107115395. Jeff Duarte: SSN 545675712, DOB 7/19/1969. Bank account and routing numbers for ~100 employees via NACHA ACH direct deposit files — plus the company's own BofA commercial account credentials and wire transfer instructions. Two years of reviewed financial statements showing the company is <redacted> Privileged litigation documents from active lawsuits including P2G class certification strategy and settlement documents. Proprietary rootstock and grafting data — the IP that differentiates Duarte from competing Central Valley nurseries. Complete salary and compensation data for 23 salaried employees, insurance coverage details, tax returns, and 401(k) census information.

Herkunft

boobaPearland PediatricsUS
healthcare

Beschreibung der Täter

Hospitals and Health Care Stolen data: 35 GB.

Herkunft

boobaCity of Mt. Angel, OregonUS

Beschreibung der Täter

Government Administration Stolen data: 18 GB.

Herkunft

boobaCity Hall - Everett, MAUS
behoerden

Beschreibung der Täter

Government Administration Stolen data: 15 GB.

Herkunft

mimoriOpenTextCA

Beschreibung der Täter

OpenText Corporation is a Canadian company that develops and sells enterprise information management software. OpenText can help you tackle the most complex digital transformation programs with confidence. With the worlds most complete and integrated information management platform, we empower our customers to organize, integrate, and protect data and content as it flows through business processes inside and outside their organization. Sector: Technology - Files: 94306 - Publication planned: 2026-10-29T19:36:20Z

Herkunft

mimoriAvevaGB

Beschreibung der Täter

AVEVA is a British multinational industrial software company headquartered in Cambridge, England, and operating as an autonomous business unit of Schneider Electric. It provides engineering, design, operations management, data visualization, asset performance, and cloud-based industrial intelligence solutions for sectors including oil and gas, power, chemicals, manufacturing, marine, mining, and infrastructure. AVEVA's technology helps thousands of enterprises worldwide optimize industrial processes, improve operational efficiency, and support digital transformation across complex engineering and asset lifecycle management. Sector: Technology - Files: 177234 - Publication planned: 2026-10-23T19:09:39Z

Herkunft

boobaCOASTAL CAROLINA NEUROPSYCHIATRIC CENTER, PAUS
healthcare

Beschreibung der Täter

Medical Practices Stolen data: 10 GB.

Herkunft

n0nCompany #98ET
kein Firmenname im Eintrag

Beschreibung der Täter

Environmental NGO · Ethiopia | [PENDING EXPOSURE]

Herkunft

n0nCompany #97TN
kein Firmenname im Eintrag

Beschreibung der Täter

textile manufacturing · Tunisia | [PENDING EXPOSURE]

Herkunft

n0nCompany #96TT
kein Firmenname im Eintrag

Beschreibung der Täter

medical laboratory and diagnostics · Trinidad and Tobago | [PENDING EXPOSURE]

Herkunft

n0nCompany #95CH
kein Firmenname im Eintrag

Beschreibung der Täter

solar energy company · Switzerland | [PENDING EXPOSURE]

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.