SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

aurora

24 Einträge insgesamt

Zeitraum: 11.08.2026 – 21.10.2026

Veröffentlichungskanäle

  • Chat · Negotiation Chat · zuletzt nicht erreichbar
  • Dateiablage · 504 Gateway Time-out · zuletzt nicht erreichbar
  • Dateiablage · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Meldungen, die den Gruppennamen neben einem Fachbegriff nennen. Kein Maß für die Schwere eines Vorfalls und kein Beleg, dass ein bestimmtes Opfer in der Presse stand.

Neueste Einträge

Filter zurücksetzen
auroraAllmand-Smith LimitedGB
finanzen

Beschreibung der Täter

[distributor, manufacturer] Allmand-Smith Limited (trading as Stormguard) — a UK manufacturer and distributor of building products headquartered in Stoke-on-Trent. Domain admin credentials in plaintext and a full DC dump — STORMGUARD\MichaelAdmin / 5t0rmGuard Complete NatWest banking infrastructure — blfw.db (21.3 MB live Bankline database with account numbers, sort codes, payee details, and transaction logs), plus WorldPay payment gateway credentials (WorldPay Account Details.xlsx), plus Sage 200 AR/AP containing bank details for every customer and supplier across all 15 entities. NatWest has 3 outstanding registered charges (Jun 2026). Full payroll for every employee, current and former — Payroll.zip (6.1 GB, 1,185 files) from Sage Payroll: NI numbers (lifetime identifiers), tax codes, PAYE history, gross/net pay per period, bank account details for BACS salary payments, pension contributions, P45/P60 records. Complete financial records for 15 entities — Sage 200 databases for Allmand-Smith Ltd, Stormguard Fabrications, Stormguard Sills, Rainwater Systems, Floodplan, Bridgemill, Chelford, Paradise, MJ Associates, SAS Partners, Specialised Aluminium Supplies, two pension funds

Herkunft

auroraDuarte Nursery, Inc.US

Beschreibung der Täter

Duarte Nursery, Inc. is a wholesale deciduous fruit and nut tree nursery in Hughson, California — an S Corporation run by brothers John and Jeff Duarte. The dataset is the company's complete digital footprint: 300–500 full Social Security numbers from California DE9 quarterly employment tax filings (2024 Q1 through 2026 Q2). The owners' complete identity packages — John Duarte: SSN 545-67-5279, DOB 9/9/1966, DL C3261756, BofA account 325107115395. Jeff Duarte: SSN 545675712, DOB 7/19/1969. Bank account and routing numbers for ~100 employees via NACHA ACH direct deposit files — plus the company's own BofA commercial account credentials and wire transfer instructions. Two years of reviewed financial statements showing the company is <redacted> Privileged litigation documents from active lawsuits including P2G class certification strategy and settlement documents. Proprietary rootstock and grafting data — the IP that differentiates Duarte from competing Central Valley nurseries. Complete salary and compensation data for 23 salaried employees, insurance coverage details, tax returns, and 401(k) census information.

Herkunft

auroraPOWERsonic Industries Inc.US

Beschreibung der Täter

[manufacturer] POWERsonic Industries Inc. — a privately held wire harness and cable assembly contract manufacturer founded in 1998 with ~100-150 employees across 7 locations. The exposed material spans every entity in the POWERsonic corporate structure: <redacted> <redacted> Employee PII for 93-150 employees — SIN documents, passports, I-20 visas, LMIA immigration approvals, W-2 tax forms, pay stubs, banking information. Plus 8 complete email archives totaling 13.2 GB. Customer proprietary designs — 7.5 GB of Demers Ambulance wiring harness data, 15 GB of CIRRIS cable test results, Mold Masters drawings, and a bilateral NDA with Husky Injection Molding. Full financial records — Dec 2025 balance sheet ($285K cash, $5.1M AP), trial balance, revenue data ($17.7M US), loan agreements, order margins (~45%), insurance policies. <redacted>

Herkunft

auroraAdams Warehouse & Delivery, Inc.US
transport

Beschreibung der Täter

Adams Warehouse & Delivery, Inc. — a family-owned freight and logistics company operating 11 warehouse facilities in the Houston metro area since 1976. The dataset includes complete server backup mirrors from multiple drives (D:, E:, Data, Network Shares), capturing the company's entire digital footprint: Sage/Peachtree accounting system for 8 entities spanning FY2007–FY2025+, containing payroll, AR, AP, general ledger, and W-2 filing histories 52–72 Social Security Numbers with full identity packages (name, DOB, address, phone, emergency contacts, health insurance IDs) across 4 entities Domain administrator passwords saved in 4 RDP files, plus plaintext VPN credentials, WiFi passwords, and 18 database connections with blank passwords WDS source code — the company's custom warehouse distribution management system (VB6/.NET, multiple versions) 20+ years of customer data — rate cards, operations logs, and contact lists for 100+ warehouse customers including Honeywell, Hospira, Amway, and Kaiser Medical clinic employee data — South Main Medical Clinic's bookkeeping within the Sage system, including physician SSN 11 Outlook PST email archives (largest: 1.5 GB)

Herkunft

auroraEstrategias BigMat S.L.U.ES

Beschreibung der Täter

[distribution] Estrategias BigMat S.L.U. — the Spanish master franchisee of BigMat International, a French cooperative and one of Europe's largest building materials distribution networks. 624 SEPA payroll XML files (2022–2025) — every monthly salary payment for 300–500 employees across 15+ entities, with full names, DNI/NIE numbers, IBANs, and exact euro amounts. 20 SILTRA Social Security databases — the complete filing history for every subsidiary's workforce, containing números de afiliación, contribution bases, and employment records. <redacted> 2,690 customer loyalty cards with DNI/NIF identifiers — the entire customer-identity database. 888 Modelo 347 tax notifications — annual declarations to the Agencia Tributaria naming customers and suppliers with their DNI and transaction amounts. Complete financial records — 5 years of accounting journals, bank reconciliations, insurance policies, loan agreements, and invoices. Occupational health data (PRL) for 12+ subsidiaries — workplace injury reports, medical certificates, and risk assessments.

Herkunft

auroraThe Buckner Company, Inc.US

Beschreibung der Täter

[insurance] The Buckner Company, Inc. is a commercial property & casualty insurance brokerage headquartered in Salt Lake City, Utah, with a second office in Denver, Colorado. The exfiltrated dataset includes: 1,500+ plaintext credentials — Chrome, Edge, and Google password exports from 8+ employees, plus 20+ password spreadsheets. Verified: kbennett’s file alone contains 503 entries covering Hartford, Travelers, Chubb, Progressive, Sedgwick, mortgage portals, banking, and personal accounts. Employee SSNs for 150–250 individuals — W-2 reports across three entities (TBC, TBI, COL) spanning four tax years (2019–2022), plus 2023 W-2 and 1099-NEC reports. 316 individual Total Compensation PDFs and 3+ years of Paycom payroll rate history — every employee’s salary, bonus, and benefits laid bare. A complete M&A acquisition pipeline — 60+ prospect folders with due diligence, LOIs, valuations, and the full BroadStreet Partners closing package (52 exhibits including Disclosure Schedules, MIPA, corporate structure documents). 128 Outlook PST email archives spanning years of business correspondence. Corporate tax returns for Buckner (2004–2024), Citrus Insurance LLC (2021–2023), and Consolida

Herkunft

auroraRechtsanwaltskanzlei Dr. BienDE

Beschreibung der Täter

[law] Rechtsanwaltskanzlei Dr. Bien — a specialist insolvency law firm in Hamm, NRW, appointed as insolvency administrator by 12 Amtsgerichte across Westfalen. The exposed material includes: 2,387 WinSolvenz case databases — each a Microsoft Access MDB containing the complete financial dossier of an insolvency debtor: creditor lists, claim amounts, distribution plans, asset inventories, court appointments, and bank account details. 492+ forced administration (Zwangsverwaltung) case files — property addresses, tenant data, rent records, utility accounts, insurance details, court-directed property management reports. <redacted> 80 GB MailStore email archive — the firm's complete email history in MailStoreContainer-v1 format: attorney-client communications, court correspondence, creditor negotiations, debtor disclosures. 1.7 GB beA backup (besonderes elektronisches Anwaltspostfach) — three MSSQL database backups containing every electronic communication between the firm and every German court. 35 employee records — 25 former + ~10 current staff: contracts, salary, overtime, vacation, pension, disability status, termination agreements. DATEV tax/accounting archives — 33 directories

Herkunft

auroraInfomedia A/SDK

Beschreibung der Täter

[monitoring] Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two largest media conglomerates (JP/Politikens Hus and Berlingske Media). Infomedia sits at the heart of Nordic media. It monitors newspapers, broadcasts, and digital sources for hundreds of corporate and government clients — including the EU Parliament, A.P. Møller-Mærsk, and major Nordic media groups (Schibsted, Polaris, NRK, Amedia). The exposed material spans: <redacted> <redacted> SQL Server sysadmin credentials — sa / ballmer for the Opoint CRM database at crmdb.opoint.com. An RSA private key — the TLS key for the Infomedia Export Data API service. Named salary specifications for 100+ employees across Denmark (2010–2018) and Estonia (2009–2024). 30 GB of Finance data — income statements, balance sheets, insurance policies, Danske Bank payment records, vendor contracts, tax certificates. <redacted> <redacted>

Herkunft

auroraInfomedia A/SDK

Beschreibung der Täter

[monitoring] Infomedia A/S — Denmark's premier media monitoring company, co-owned by the country's two largest media conglomerates (JP/Politikens Hus and Berlingske Media). Infomedia sits at the heart of Nordic media. It monitors newspapers, broadcasts, and digital sources for hundreds of corporate and government clients — including the EU Parliament, A.P. Møller-Mærsk, and major Nordic media groups (Schibsted, Polaris, NRK, Amedia). The exposed material spans: <redacted> <redacted> SQL Server sysadmin credentials — sa / ballmer for the Opoint CRM database at crmdb.opoint.com. An RSA private key — the TLS key for the Infomedia Export Data API service. Named salary specifications for 100+ employees across Denmark (2010–2018) and Estonia (2009–2024). 30 GB of Finance data — income statements, balance sheets, insurance policies, Danske Bank payment records, vendor contracts, tax certificates. <redacted> <redacted>

Herkunft

auroraThomas Y. Pickett & Co., Inc.US

Beschreibung der Täter

[consulting] Thomas Y. Pickett & Co., Inc. — founded in 1926, headquartered in Addison/Dallas, Texas — is one of the oldest property tax appraisal consulting firms in the United States. They appraise mineral, industrial, and utility properties for county appraisal districts across Texas, Wyoming, North Dakota, Mississippi, Oklahoma, and beyond. Roughly 40 employees, ~$5.3M annual revenue, nearly a century of reputation. Inventory: 13 SQL Server database backups (127 GB) including the 102 GB TYPortal web portal database containing all property owner records and user credentials Complete HR records for all 40+ employees — Social Security cards, W-4s, direct deposit forms, salary schedules, medical records, termination documents, TWC hearing notices 11 GB Azure DevOps repository — the entire source code history, including a 6,105-line proprietary COBOL program (NOTICE14) that generates tax appraisal notices 200+ client contracts with pricing for every county appraisal district they serve — the competitive intelligence gold mine Complete financial records — bank statements (PNC and Frost), 10-year budget, accounts receivable, payroll, and evidence of a prior fraud incident in May 202

Herkunft

auroraLaboratorios Roemmers SAICFAR
healthcare

Beschreibung der Täter

Laboratorios Roemmers SAICF — Argentina's #1 pharmaceutical company by revenue, with €1.669 billion in consolidated turnover, 6,890 employees, and 69 subsidiaries across 11 countries. The exposed material includes: 4,207 employees' national identity numbers (CUIL) — Argentina's equivalent of a Social Security Number — combined with dates of birth, health insurance affiliations, and employer identifiers. A complete identity-theft package for the entire Argentine workforce. Psychotropic drug dispensing records — employee-by-employee tracking of who receives clonazepam, alprazolam, diazepam, and other psychiatric medications from the company nursing station. The most sensitive category: mental health data. COVID-19 health tracking with clinical symptoms — individual symptom logs, doctor's notes, quarantine dates, and return-to-work clearances for employees who tested positive. Pre-employment medical exam results with full DNI (national identity document) numbers. <redacted> 82 GB of drug formulations — the complete pharmaceutical IP portfolio covering every product Roemmers manufactures, from API synthesis methods to finished-form specifications. 193 MB of API supplier qualification

Herkunft

auroraBuford-Thompson Company, LTDUS

Beschreibung der Täter

Buford-Thompson Company, LTD, a Texas construction general contractor with 30+ years of history building schools for K-12 districts across the state. The exposed dataset totals 1.707 TB and includes: 5 years of W-2 EFW2 files (2021–2025) containing plaintext Social Security numbers, wages, and addresses for 350+ current and former employees — every SSN readable without any decryption. 9.3 GB of attorney-client privileged files from the Stanton ISD v. BTC litigation — legal strategy, discovery responses, and counsel communications. Complete Frost Bank infrastructure — four account numbers, ACH routing credentials, line-of-credit agreements (renewed April 2026), signature cards, and monthly bank statements spanning 2022–2026. 36+ active school construction projects — blueprints, bid estimates, cost structures, subcontractor pricing, and change orders for ISD projects across Texas. A competitor's dream dataset. 2,000+ donor records from Human Services Campus (Phoenix homeless-services nonprofit) with full PII: name, address, phone, email, employer, and donation amounts. QuickBooks company files (.QBW) from Along Side Ministries (Phoenix prison ministry) containing complete accountin

Herkunft

auroraBenshaw, Inc.CA

Beschreibung der Täter

Benshaw, Inc. (Pittsburgh) and affiliated UTG entities (Unico, Benshaw Canada, AuCom, Excel, Noble Victoria). ~100+ corporate Visa/PCard records with full PAN + SSN + DOB + home address 637 former employees with full SSN/DOB/address on one spreadsheet 88 active employee folders plus multi-year Canada payroll <redacted> <redacted> Global bank account numbers (PNC, BMO, BNZ, St George, Commerzbank, JPM London, BBVA, GNB…) ACH NACHA files with vendor routing/account numbers UEdit source with hardcoded XOR key 4148865678 and date-based CalcBackDoor() Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC…)

Herkunft

auroraJinny Beauty SupplyUS

Beschreibung der Täter

Jinny Beauty Supply is one of the largest Korean-American wholesale beauty distributors in the US, operating 9 distribution centers from Doraville, Georgia to Commerce, California. They serve 7,400+ beauty supply stores and 2,800+ international distributors. The exposed material includes: A complete password vault export — 50+ plaintext credentials for PayPal, Braintree, Amazon Seller Central, eBay, Acumatica ERP (production), 12 state tax portals, FedEx, UPS, ShipStation, Microsoft 365, Google Analytics, and internal email. VMware hypervisor root credentials — vCenter and ESXi root passwords giving complete control over the entire virtual infrastructure. 911 scanned credit card authorization forms — full card numbers, CVV, expiry dates, and cardholder signatures for beauty supply store customers across 26 US states. Complete employee compensation database — ~260 employees with Korean and English names, departments, salaries, bonuses, and 1099 contractor data spanning 2015–2018. A 340 MB Shopify database backup — full customer table (names, emails, phones, addresses), product catalog, pricing, and warehouse assignments. Active Directory domain enumeration — all 239+ user accounts

Herkunft

auroraMetrea LLC/Commuter Air Technology, Inc.PH
transport

Beschreibung der Täter

Metrea LLC (formerly Meta Special Aerospace, LLC) and its subsidiary Commuter Air Technology, Inc. (CAT) are US defense contractors providing Contractor Owned, Contractor Operated (COCO) ISR aircraft services to US Special Operations Command. They operate modified King Air 350 surveillance aircraft in Niger, East Africa, the Philippines, and other theaters. <redacted> 339 MB of Harris PRC-117G military tactical radio firmware including compiled waveform binaries for SINCGARS, HAVEQUICK II, ROVER, and 10 other ITAR-controlled waveforms (USML Category XI). Named deployment data for 14+ operators at Sable Spear sites in Niger and East Africa, with rotation schedules, SIPRNet access documentation, and divert airfield planning. Complete SOCOM contract pricing portfolios — labor rates, burn rates, TINA-certified cost data, and subcontractor pricing for SOCPAC C3PO, Sable Spear, and Sable Dagger programs. 232 employee personnel files including resumes, W-9 forms (SSN), SERE training certificates, security clearances, expense reports, and deployment records. NSWDG (SEAL Team Six), MARSOC, and 75th Rangers training exercise documentation — 37 separately funded SOCOM training deliveries und

Herkunft

auroraEDIF S.p.A.IT

Beschreibung der Täter

EDIF S.p.A. is an Italian wholesale distributor of electrical equipment, plumbing, and lighting systems. The exposed files include passwords for company systems, customer file transfers, certified email and warehouse devices. Copies appear in source code, setup packages and old folders. Customer and employee information is also exposed: invoices, tax numbers, addresses, phone lists, shipment details, computer-profile artifacts and records about CCTV or recorder password resets. The dataset contains internal software, databases, commercial records, legal/tax folders and a detailed 2024 financial report.

Herkunft

auroraChip 1 ExchangeDE

Beschreibung der Täter

Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. The dataset spans 13 years (2013-2026) of corporate operations and encompasses: 40+ passport photographs, I-9 forms with SSNs, W-4 tax forms, payroll registers. <redacted> Complete 2026 financial intelligence — P&L through July, executive financial health assessment, AR/AP aging, chart of accounts revealing all bank account numbers. 15+ exclusive franchise manufacturer agreements with pricing terms, territory allocations, and per-customer gross profit margins. ITAR registration and defense customer sales orders to Jabil Defense, Curtis-Wright, GEN3 Defense, and Cobham Remec. 5.7 GB of Outlook PST email archives spanning years of C-suite and employee correspondence.

Herkunft

auroraIshbia & Gagleard, P.C.US

Beschreibung der Täter

Ishbia & Gagleard, P.C. — a boutique law firm in Birmingham, Michigan, founded in 1999 by Jeffrey A. Ishbia and Michael A. Gagleard. The firm practises real estate, corporate, estate planning, personal injury, medical malpractice, and commercial litigation for high-net-worth individuals and closely held entities. The exposed material includes: 360+ client/matter folders — the complete attorney-client privilege corpus: litigation strategy memos, settlement agreements, case assessments, deposition notes, correspondence with opposing counsel. <redacted> <redacted> Full Social Security Numbers for 25+ identified individuals — trust beneficiaries, family members, employees of client businesses, and a scanned Social Security card. Protected Health Information — hospital admission records from Oakwood Hospital, University of Michigan Hospital, and William Beaumont Hospital. Also: 55+ employee files from a sexual health clinic client with SSN searches and scanned SS cards. 100+ client tax returns spanning 2003–2024, each containing SSNs, EINs, and income data. 11 email archive files (PST/OST) containing years of unfiltered attorney correspondence. Personal legal matters of Mat Ishbia — C

Herkunft

auroraSCA Logistik & Fulfillment GmbHDE
transportfinanzen

Beschreibung der Täter

SCA is a Bavarian logistics and e-commerce fulfillment provider. The exposed materials includes: Spans customer orders Shipments and returns Employee and applicant files Management, tax and banking records Warehouse automation Source code Customer contracts.

Herkunft

  • Pfad auf der Leak-Seite: /blog/sca-logistik-fulfillment-gmbh-7e254e19
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 06.09.2026 · legalform
auroraERPIS LLCUS
finanzen

Beschreibung der Täter

ERPIS LLC (doing business as ShipERP) — a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers. The exposed material includes: Complete product source code — all versions (2.0–5.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog) <redacted> Live QuickBooks financial database (705 MB) — complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger Full customer contract register — exact pricing for all 88 enterprise customers with $20.6M in deferred revenue <redacted> SAP installation media (245 GB) — full HANA, S/4HANA, and kernel distributions <redacted>

Herkunft

  • Pfad auf der Leak-Seite: /blog/erpis-llc-bb485230
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
auroraPlanungsgruppe M+M AGDE

Beschreibung der Täter

Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026.

Herkunft

  • Pfad auf der Leak-Seite: /blog/planungsgruppe-mm-ag-3eb2a03f
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
auroraNatco Home GroupUS

Beschreibung der Täter

Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. <censored> <censored> <censored> <censored> Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials.

Herkunft

  • Pfad auf der Leak-Seite: /blog/natco-home-group-77b27d0d
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 06.09.2026 · Land aus dem Text abgeleitet
auroraLloyd Coils Europe—

Beschreibung der Täter

4 Coils Technology s.r.o. (trading as Lloyd Coils Europe) is a Czech-headquartered manufacturer of custom heat exchangers for the HVAC&R industry, with offices in Germany, France, and the United Kingdom. They serve 200+ OEM customers across 39 countries — names like Carrier, Daikin, Trane, Systemair, Remak, GEA, Swegon, and VTS. Their competitive advantage comes from two things: decades of thermodynamic engineering expertise embodied in their MyCoil selection software (licensed to OEM customers worldwide), and a manufacturing capability for custom heat exchangers. Approximately 200 employees work across four countries.

Herkunft

  • Pfad auf der Leak-Seite: /blog/lloyd-coils-europe-344e7910
  • Gruppe bei RansomLook
  • von SecBoard erfasst: 06.09.2026
auroraFREYWILLE—

Beschreibung der Täter

FREYWILLE — the Austrian luxury fire-enamel jewelry house with 70+ boutiques across Europe, the Americas, Middle East, Russia/CIS, and Asia-Pacific. <censored> <censored> 142+ employee files with salary statements (2024–2026), social security numbers (ELDA), employment contracts across 24 countries, COVID vaccination records, passport copies, visa card statements spanning a decade, and personnel files. FREYWILLE's trade secrets — complete 2025 product costing for all lines (18ct gold, plated, textiles), and the crown jewels: enamel colour recipes from the Siebdruck department. FREYWILLE's fire-enamel technique is what makes the brand unique. The formulations for SPHINX, JOYB2, and Entwurf colour systems are in the dataset. Defence files from 40+ lawsuits across Austria, the US, China, France, Canada, Slovakia, Poland, and Belgium — including a criminal proceedings file (Strafsache Grgic, Mrsic & Co). Documentation of the 2018 webshop malware attack — DSB filings, customer notification drafts, incident reports.

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.