SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

emperador

50 Einträge insgesamt

Zeitraum: 10.08.2026 – 21.10.2026

Veröffentlichungskanäle

  • Leak-Seite · EMPERADOR · zuletzt erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
emperadorBruin Group LLCUS

Beschreibung der Täter

Bruin Group LLC is a telecom expense management (TEM) and communications auditing firm. Companies hand them carrier invoices, circuit inventories, wire instructions, letters of authorization, and internal ticket correspondence so Bruin can audit and recover overcharges. Bruin sits on a concentrated pile of third-party financial and telecom data for every client they serve. We have your entire ticket repository. Wire instructions, account numbers, W-9s, EINs, signed LOAs, Tenet patient call traces, all of it, for every client you manage. Tenet. Welltower. USDA. MarineMax. Allegis. Lincare. Salvation Army. Realogy. Delek. Quiktrip. CubeSmart. SRS. Baymark. Partial list. $1,000,000 in BTC or XMR. Pay and it ends. Don't and we contact your clients directly with their own documents, then publish one company at a time. emperadorlol@proton.me xdlmfao@morke.ru Session: 05651c732327b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Telecommunications]

Herkunft

emperadorGTL Concreto e Logística LTDABR

Beschreibung der Täter

Production and preparation of ready-mixed concrete and mortars. Production of cement products for construction. Construction of buildings and other construction works. Rental of vehicles and industrial equipment without an operator. IN THE ARCHIVE FINANCIAL DOCUMENTS, PERSONAL AND CUSTOMER DATA, EMPLOYEE CREDENTIALS. [Sector: Manufacturing, Finance, Transportation]

Herkunft

emperadorLuzco IluminationES
energie

Beschreibung der Täter

Spanish company that specializes in professional lighting for shops and commercial spaces. There are many customer documents and employee data. [Sector: Manufacturing, Finance]

Herkunft

emperadorMPI LTDACO

Beschreibung der Täter

Colombian asphalt company. The company has been operating in the field of asphalt materials since 1974. It produces ordinary bitumen, asphalt with polymer additives and asphalt modified with rubber crumb. The archives contain several thousand documents with personnel and customer data. Publication scheduled: 2026-10-29 08:34:00 UTC Size: 370.0 MB Sectors: Manufacturing

Herkunft

emperadorMyM ODONTOCLINICA S.ABR
healthcare

Beschreibung der Täter

Сompany from Paraguay operating in the field of dentistry. Financial documents, personal and customer data. The archive contains the most important documents [Sector: Medical, Other]

Herkunft

emperadorCMC AUDITORES SRLAR

Beschreibung der Täter

An Argentine auditing and accounting consulting company that works with businesses in the field of accounting, taxes and financial audit. The archives contain several thousand documents with personnel and customer data. [Sector: Finance]

Herkunft

emperadorSpelman LogisticsCA
transport

Beschreibung der Täter

Dear Spelman Logistics, We are now in possession of 1.2M contact records (emails and phone numbers), 245K carrier profiles complete with EIN and SSN, 57K bank accounts including routing numbers, 334K live document URLs, and 4.5M carrier registry entries pulled from your MVMNT TMS. Your exposure extends well beyond your own walls. We have also reached into the systems of your partners, including: ALG Canada Inc Line Transportation Inc Maverick Acquisition Ventures Inc Reliable Freight Solutions Rhode Sense and more. If you would rather not have us contact your partners and make life difficult for your employees, we suggest you pay the following: $500,000 in BTC or XMR. You will shortly receive an email explaining how to reach us. If that fails, contact us at: Email: emperadorlol@proton.me / xdlmfao@morke.ru Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Manufacturing, Transportation]

Herkunft

emperadorImperial Diamond JewelleryCN

Beschreibung der Täter

Engaged in the sale of jewelry made of precious metals, diamond jewelry and the manufacture of custom jewelry. Country: Hong Kong, China. Year of foundation: 2011 Financial documents, personal and customer data. Publication scheduled: 2026-10-23 15:52:47 UTC Size: 3.1 GB Sectors: Manufacturing, Finance

Herkunft

emperadorPANCARIBBEAN LOGISTICS GROUPPA
transport

Beschreibung der Täter

Panamanian logistics company operating in the field of international cargo transportation. Financial documents, personal and customer data. [Sector: Transportation]

Herkunft

emperadorPANCARIBBEAN LOGISTICS GROUPPA
transport

Beschreibung der Täter

Panamanian logistics company operating in the field of international cargo transportation. Financial documents, personal and customer data. [Sector: Transportation]

Herkunft

emperadorMETROCOLOR S.A.PE

Beschreibung der Täter

A Peruvian company from the printing industry. Commercial printing, packaging, labels, boxes, books, magazines, booklets and promotional products. The archives contain several thousand documents with personnel and customer data. [Sector: Manufacturing, Technology]

Herkunft

emperadorMETROCOLOR S.A.PE

Beschreibung der Täter

A Peruvian company from the printing industry. Commercial printing, packaging, labels, boxes, books, magazines, booklets and promotional products. The archives contain several thousand documents with personnel and customer data. [Sector: Manufacturing, Technology]

Herkunft

emperadorOMUR HIRDAVAT LTDTR

Beschreibung der Täter

A Turkish company engaged in the wholesale and retail trade of construction and household fittings The archives contain several thousand documents with personnel and customer data [Sector: Manufacturing]

Herkunft

emperadorLA PONDEROSAVE

Beschreibung der Täter

GRANJA AVICOLA LA PONDEROSA Venezuela The corporate purpose is mainly the purchase, sale, import, export, breeding, processing and marketing of all types of poultry and/or domestic animals in general. The archives contain several thousand documents with personnel and customer data. Publication scheduled: 2026-10-15 09:12:18 UTC Size: 3.4 GB Sectors: Manufacturing

Herkunft

emperadorSitePro Rentals—

Beschreibung der Täter

I have yet to hear a response from SitePro Rentals regarding the data breach. I have heard rumors that a law firm is investigating the incident([Link entfernt] I am giving you 72 hours to contact me, otherwise I will leak the active employee details. The information includes: IsTotalItem, Department_ShortName, Employee_FirstName, Employee_LastName, EmployeeEmploymentStatus_EmployeeNumber, Employee_HireDate, EmploymentStatus_ShortName, OrgUnit_ShortName, DeptJob_ShortName, EmployeeManager_ManagerDisplayName, PayType_ShortName, PayClass_ShortName, Employee_SocialSecurityNumber, Department_ShortName2, Employee_Gender, Employee_MiddleName, PersonAddress_Address1, PersonAddress_Address2, PersonAddress_City, PersonAddress_PostalCode, PersonAddress_StateCode, Employee_BirthDate, OrgUnit_ContactBusinessPhone, OrgUnit_ContactCellPhone, EmployeeManager_ManagerEmployeeNumber, EmployeeEmploymentStatus_BaseRate, EmployeeEmploymentStatus_BaseSalary, Department_LedgerCode, Department_XRefCode, and OrgUnit_XRefCode. Contact me at xdlmfao@morke.ru Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358. Publication scheduled: 2026-10-03 13:28:29 UTC Size: 173.1 KB Sectors

Herkunft

emperadorPolikemCO

Beschreibung der Täter

Polikem is a Colombian company dedicated to the development, manufacture, and marketing of chemical products for industrial and automotive applications. With decades of experience, the company provides practical and reliable solutions tailored to the needs of various industries and consumers. This leak includes sensitive information, such as the company’s financial status, inventory records, and other internal data. Publication scheduled: 2026-10-14 16:34:58 UTC Size: 388.3 MB Sectors: Manufacturing

Herkunft

emperadorOntrac—

Beschreibung der Täter

OnTrac's offer to negotiate 'early next week' is unacceptable. Our deadline isn't flexible, and we don't have the luxury of waiting. You have 48 hours to contact us with a serious proposal, or we will release employee addresses if you do not cooperate. The clock is ticking. We've exhausted the diplomatic approach. After OnTrac pleaded with us to remove the posts and engaged in discussions, they had the audacity to propose 'early next week' as a timeline. Even more insulting? A company generating over $1B in revenue claiming 'your ask is very large.' Let's be clear: this entire situation disappears immediately when the ransom is paid. That's our final position. Email: xdlmfao@morke.ru Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Publication scheduled: 2026-10-01 13:05:35 UTC Size: 60.0 MB Sectors: Retail, Transportation

Herkunft

emperadorAmazon InformaticaBR
behoerden

Beschreibung der Täter

Amazon Informática LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995. Amazon Informática's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Brasília/DF (to service the federal government cluster) and Belém/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions. Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information! Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data. TOX ID: 3D6EF83C3C4517FE42B212A9

Herkunft

emperadorElectrolux 2...SE
kein Firmenname im Eintrag

Beschreibung der Täter

Hi Electrolux, im getting kind of inpatient, therefore i might just leak something. If i hear nothing from you in the next 3 days, more data WILL be leaked. Thanks. Emails: xdlmfao@morke.ru Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Publication scheduled: 2026-09-28 05:16:55 UTC Size: 1.8 MB Sectors: Retail, Manufacturing, Transportation

Herkunft

emperadorSiteProRentalsUS

Beschreibung der Täter

SitePro Rentals is a Texas-based construction and industrial equipment rental company founded in 2021. A subsidiary of Sammons Industrial, it rents aerial lifts, forklifts, and earthmoving equipment, serving contractors across the U.S. from over 30 locations. We have every employee's Social Security number. Home addresses. Birth dates. Salaries. We know who's sick, who's on leave, who got fired and why. We also have 338,000 pay records.... Shortly, you will receive an email containing the instructions on how to proceed with this situation. The ransom is relatively small, just $150k USD in XMR... If you do not receive the email, contact us at: Email: xdlmfao@morke.ru Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Publication scheduled: 2026-10-12 01:27:34 UTC Size: 6.2 MB Sectors: Construction

Herkunft

emperadorCar Service AbschleppDE
transport

Beschreibung der Täter

CSA Car Service Abschlepp- & Bergungsdienst GmbH Genslerstraße 72, 13055 Berlin Archived personal and corporate data of employees and customers Here are the most important documents Publication scheduled: 2026-10-07 09:14:06 UTC Size: 2.8 GB Sectors: Transportation

Herkunft

emperadorElectrolux & Ontrac—

Beschreibung der Täter

Hello Electrolux & OnTrac, Still no response from you. When we called your IT helpdesk posing as threat researchers and asked about the breach, we were told, "We cannot talk about it." You have one week before we release more data - starting with information on your employees. We'd prefer to settle this directly. Same goes for OnTrac. We recently learned that OnTrac has been paying employees as little as $14.50 an hour. As a result, we will be releasing salary information for all of their employees. I also managed to get in touch with a former OnTrac employee, chill guy. Said his time there was horrible. EMAIL: xdlmfao@morke.ru SESSION: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Publication scheduled: 2026-09-25 21:24:27 UTC Size: 75.1 MB Sectors: Retail, Manufacturing, Transportation

Herkunft

emperadorOnTracUS
transport

Beschreibung der Täter

OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. It positions itself as a direct alternative to FedEx and UPS, offering coast-to-coast coverage, 7-day-a-week operations, and competitive rates to reach over 75% of the U.S. population. We hold your full employee database, 197k records of employee PII: employeeNumber,xrefCode,firstName,middleName,lastName,loginId,employeeId,hireDate,originalHireDate,startDate,terminated,roles,legalEntity,legalEntityAddress,homePhone,mobilePhone,businessPhone,businessMobile,pager,personalFax,personalEmail,businessEmail,facebook,linkedin,addressPrimary1,addressPrimary2,addressMailing1,addressMailing2,userApproved,nativeAuth,culture We demand an amount of 1 million, otherwise your data WILL be publicly posted. Instructions will be emailed to you shortly. If you do not receive them, contact me on session, or email me. Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Email: xdlmfao@morke.ru, kajsdsalkufsaoiuairw7@outlook.com (I prefer session.) If you do not cooperate, your partners and employees will be targeted. Emails were sent to: webcustomerservice@ontrac.com

Herkunft

emperadorRECEITA FEDERAL DO BRASILBR

Beschreibung der Täter

MINISTÉRIO DA FAZENDA SECRETARIA DA RECEITA FEDERAL DO BRASIL The archives contain several thousand documents with personnel and customer data, as well as all user date on gov.br with passwords. Publication scheduled: 2026-10-13 07:57:23 UTC Size: 6.3 GB Sectors: Finance

Herkunft

emperadorAlabama Woman's Health CareUS
healthcare

Beschreibung der Täter

Alabama Woman's Health Care Comprehensive Consultative Medicine, Wellbeing and Aesthetic Care Organization Several thousand documents of employees and clients and an archive of photos 420 Lowell Dr Suite 400 Huntsville, AL 35801 Publication scheduled: 2026-09-30 14:54:24 UTC Size: 2.5 GB Sectors: Medical, Other

Herkunft

emperadorStudio Notarile Associato Salvatore Costantino E Anna FavaratoIT

Beschreibung der Täter

Studio Notarile Associato Salvatore Costantino E Anna Favarato, Follina +39 0438 971778 Piazza Iv Novembre, 20, 31051, Follina , Italia Notary's office several thousand documents There are many customer documents and employee data. Publication scheduled: 2026-09-30 08:30:04 UTC Size: 7.1 GB Sectors: Finance, Other

Herkunft

emperadorCassias MG GovernmentBR
behoerden

Beschreibung der Täter

network commitment, from government credentials to justice panels, such as access to the financial sector, police, personal data, medical (SUS), RG(CIN), BIRTH CERTIFICATE, CPF (identity number in Brazil) among other data from CASSIAS.MG.GOV departments, we will give you a deadline to negotiate with us! Publication scheduled: 2026-09-29 07:21:56 UTC Size: 720.0 MB Sectors: Medical, Government, Finance

Herkunft

emperadorWestbridge Institute of Technology, Inc.PH

Beschreibung der Täter

Westbridge Institute of Technology, Inc. is an educational institution in the Philippines that offers various technical and vocational programs. It is designed to provide students with practical skills and knowledge in fields such as information technology, healthcare, business, and other technical disciplines. The leak includes full employee information, full student information, and full guardian information Publication scheduled: 2026-09-22 13:57:14 UTC Size: 102.0 MB Sectors: Education

Herkunft

emperadorRDA MOTORS S.P.A.IT

Beschreibung der Täter

is an Italian company engaged in premium cars. There are many customer documents and employee data Publication scheduled: 2026-09-26 20:26:23 UTC Size: 7.3 GB Sectors: Technology, Other

Herkunft

emperadorSEVENOAKS s.r.o.CZ

Beschreibung der Täter

Sevenoaks, S.R.O. is an enterprise based in Czech Republic. Its main office is in Prague. The company operates in the Computer Systems Design and Related Services industry. Publication scheduled: 2026-09-26 17:48:54 UTC Size: 3.3 GB Sectors: Technology, Other

Herkunft

emperadorElectroluxSE

Beschreibung der Täter

Electrolux Group is a Swedish multinational home-appliance manufacturer, producing refrigerators, washing machines, ovens, dishwashers, vacuum cleaners, and other household appliances under several brands worldwide. We were able to access your azure database, and export every piece of data which adds up to ~41GB. You will receive an email shortly containing the instructions you need to proceed. Electro_backup.7z is currently password locked, but if they do not pay the ransom, the password and the data WILL be leaked Time is ticking, Pay the ransom. Publication scheduled: 2026-10-19 14:42:59 UTC Size: 41GB Sectors: Manufacturing

Herkunft

emperadorNavitransCO
transport

Beschreibung der Täter

Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. Publication scheduled: 2026-09-23 13:01:31 UTC Size: 223.2 MB Sectors: Manufacturing, Transportation

Herkunft

emperadorNexbex Solutions Private LimitedIN

Beschreibung der Täter

Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB. Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc. Subdomains Type staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle admin.bookings-staging, backend.academy, admin.spike.booking, etc. We have the source code for all 200+ of their projects. 10 GB +. going up. Publication scheduled: 2026-09-22 13:15:18 UTC

Herkunft

emperadorEASY JOB S.A.S.CO

Beschreibung der Täter

Colombian Company. Audit and Tax Audit with more than 5 years of experience Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medellín Colombia. Llámanos o escríbenos: 310 447 2013 - 313 796 9917 The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents 17000 documents Publication scheduled: 2026-09-20 10:21:04 UTC Size: 2.7 GB Sectors: Finance

Herkunft

emperadorBosnia and Herzegovina Mine Action CenterBA

Beschreibung der Täter

important documents Publication scheduled: 2026-09-19 12:33:49 UTC Size: 1.7 GB Sectors: Other

Herkunft

emperadorBAYMER—

Beschreibung der Täter

Important documents Publication scheduled: 2026-09-19 11:23:44 UTC Size: 1.4 GB Sectors: Other

Herkunft

emperadorUniversal Starch-Chem Allied LtdIN

Beschreibung der Täter

important documents Publication scheduled: 2026-09-19 11:13:14 UTC Size: 3.5 GB Sectors: Other

Herkunft

emperadorJudicial Branch of the Province of JujuyAR

Beschreibung der Täter

The official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digital case management, mediation services, legal rulings, and judicial news for legal professionals and the public. Now i have your wordpress databases, login credentials to internal systems(thanks to marcos :)), as well as your email credentials Respond to us, pay the ransom.(Check your emails & check spam as well.) OR email me at : asojfdhaslkfjsasafyw@onionmail.org for instructions Publication scheduled: 2026-09-19 02:16:35 UTC Size: 4.2 GB Sectors: Government, Law

Herkunft

emperadorUniguacu—
finanzen

Beschreibung der Täter

full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! Publication scheduled: 2026-09-13 02:22:46 UTC Size: 151.0 MB Sectors: Education

Herkunft

emperadorHanwha Renewables—

Beschreibung der Täter

The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. Publication scheduled: 2026-09-04 23:48:30 UTC Size: 12GB Sectors: Energy

Herkunft

emperadorIpro.com(revealdata.com) customer DB + full database backup—

Beschreibung der Täter

Yes, this data has been posted before by ME under a different alias, yes the individual that posted the data on cracked.st is a fraud. I am posting this just for fun. Data contains: Customer identifiers, Contact & Location, Account metadata, Internal System IDS, Client relationships. The full database backup contains everything such as transcripts, cases, though it is from 2023. Published Size: 79.5 MB Sectors: Government, Law

Herkunft

emperadorCapitol Mechanics—

Beschreibung der Täter

Capitol Mechanics , fresh databases, important docs Publication scheduled: 2026-09-10 08:37:25 UTC Size: 120.9 MB Sectors: Finance, Transportation

Herkunft

emperadorFRUCASTRO SL—

Beschreibung der Täter

Recent databases, important documents Publication scheduled: 2026-09-06 11:40:43 UTC Size: 540.1 MB Sectors: Manufacturing

Herkunft

emperadorVietnam Electricity(EVNHANOI)VN
energie

Beschreibung der Täter

Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 Size: 300GB Sectors: Government, Energy

Herkunft

emperadorTest—

Beschreibung der Täter

test test test Size: 9.8 GB Sectors: Other

Herkunft

emperadorNetExam—

Beschreibung der Täter

NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system built for external audiences rather than internal employees. It helps companies train, certify, and enable their channel partners, customers, and association members, with features like certification tracking, self-paced and instructor-led courses, e-commerce, white-labeling, Salesforce integration, and AI-powered course authoring agents. Headquartered in Dallas, with clients including AMD, AT&T, Oracle, Trellix, and Sabre. Publication scheduled: 2026-09-09 17:06:52 UTC Size: 18.1 MB Sectors: Education, Retail, Other

Herkunft

emperadorPrefeitura Municipal de Arcos—

Beschreibung der Täter

We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated. Critical systems have been encrypted. We have your data. You do not. You have 14 days to respond. No response = data published + permanent loss. Contact us through the provided channel. No third parties. No recovery attempts. Publication scheduled: 2026-09-01 07:24:09 UTC Size: 462.3 MB Sectors: Government

Herkunft

emperadorAlbania's Official National Teacher Training Portal—

Beschreibung der Täter

Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:33:40 UTC Size: 5.9 GB Sectors: Education, Government

Herkunft

emperadorAlbania's official national teacher training portal.—

Beschreibung der Täter

Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:31:58 UTC Size: 5.9 GB Sectors: Education, Government

Herkunft

emperadorCity Government of BaguioPH
behoerden

Beschreibung der Täter

The City Government of Baguio stands as one of the wealthiest and most prominent local governments in the Philippines. This leak includes highly sensitive and confidential data, such as official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals, procurement records, and other classified administrative materials. Publication scheduled: 2026-08-25 15:29:08 UTC Size: 2.9 GB Sectors: Government, Finance, Construction

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.