Leak Monitor

Beschreibung der Täter

Philander Smith University is a private, historically Black liberal arts institution in Little Rock, Arkansas, founded in 1877 and affiliated with the United Methodist Church. They provide undergraduate and graduate education with a focus on academic excellence, social justice, and leadership development for a diverse student body. We successfully exfiltrated 500GB+ worth of data which includes VERY confidential information about students and staff, as well as financial information. Alongside, we have encrypted files across the entire network.

Herkunft

• Pfad auf der Leak-Seite: #philander-smith-sample
• Gruppe bei RansomLook
• Gruppe bei Ransomware.live
• Screenshot der Veröffentlichung
• von SecBoard erfasst: 06.10.2026 · Land aus dem Text abgeleitet

Beschreibung der Täter

This is what happens when you ignore us or go ghost. Momentum Telecom is a prime example of negligence in action. They don't care about their 7.5 million customers whose PII has been exposed. They don't care about the 100,000+ people who lost internet service due to widespread outages we caused as a direct result of their poor security practices. The Eagle Mountain, Utah "cyberattack" and internet outage that made national news? That was us. That was a direct consequence of Momentum's failure to secure their systems. They ignored repeated warnings, they burned access repeatedly, and we kept gaining it back. We deleted modems, caused service disruptions, and left families, businesses, and students without internet for days. Read the coverage: ABC4 | Fox 13 Momentum management repeatedly contacted us, then ghosted us every single time. They reached out to initiate negotiations, then disappeared. They agreed to terms, then stopped responding. This pattern continued over and over. They don't take this seriously. They don't care about their customers. Now their data is public and their customers are paying the price for the

Herkunft

• Gruppe bei RansomLook
• Gruppe bei Ransomware.live
• von SecBoard erfasst: 05.10.2026 · Land aus dem Text abgeleitet

Beschreibung der Täter

eTeam Inc. is a privately held global workforce solutions and business transformation company. Founded in 1999 by Ben Thakur, the company is certified as a Minority Business Enterprise (MBE). It has grown from a boutique IT staffing agency into a massive global network, managing thousands of internal employees and contract workers across continents. We successfully exfiltrated all employee records (15K), including full names, email addresses, home addresses, DOBs, SSNs, phone numbers, contracts, managers, hire dates, salaries and more. We engaged with eTeam privately some time back, and now we are going public with the announcement as eTeam was negligent of the incident that took place then. We're giving you one more chance. Speak soon or leak soon!

Herkunft

• Pfad auf der Leak-Seite: #eteam-sample
• Gruppe bei RansomLook
• Gruppe bei ThreatCluster
• von SecBoard erfasst: 26.09.2026

Beschreibung der Täter

Momentum is a telecommunications company founded in 2001 that provides cloud-based communication solutions for businesses, specializing in cloud voice services, managed networks, SD-WAN solutions, and Microsoft Teams Phone integration. We gained access to a diagnostic and provisioning tool used by Momentum through a compromised Multi-Service Operator (MSO). Upon reconnaissance, we identified multiple critical vulnerabilities throughout the system. This tool controls internet and voice services for millions of users across global markets. We successfully accessed user data for every MSO, exposing personally identifiable information (PII) for over 7.5 million users. They didn't notice the prolonged access or the customer data dump for a while, but when we started deleting modems they noticed. They kept burning access and we gained it back, they'd burn it again. We have caused widespread outages ([Link entfernt] We now have had over 100,000 packages successfully deleted. That's 100,000+ people without internet service right now. Families, businesses, students all cut off from the digital world. This is the direct result of their negligence and failure to secure their systems. These se

Herkunft

• gomomentum.com
• Pfad auf der Leak-Seite: #gomomentum_com-sample
• Gruppe bei RansomLook
• von SecBoard erfasst: 26.09.2026

Beschreibung der Täter

Accela is a comprehensive cloud based software platform used by state and local governments to manage internal agency operations. We have successfully extracted over 50 GB of data from Accela. Data includes over 2 million lines of user data with PII, and 6 million user requests (from their citizen engagement portal where citizens report everyday non-emergencies in/around their neighbourhoods) also with PII. There is a lot of government data, from FBI agents to cops to regular government workers. Speak soon or Leak soon!

Herkunft

• accela.com
• Gruppe bei RansomLook
• Screenshot der Veröffentlichung
• von SecBoard erfasst: 18.09.2026

Beschreibung der Täter

Initial access was via a CX contractor doing business with AT&T. Access originally used as vehicle for Equipment Changes/Call Forwarding (thanks a lot TORCH patch) - VPN + HVD (both external and internal MyDesktop) instances were accessed for a prolonged period without any detection or incident response taking place. Certificates exported from certlm in the VDI + OPUS self installer (automatically joins EP to S1) opened up the door to the VPN. Salesforce data was accessed via a project manager ATTUID + a DirecTV contractor who for some reason had the apps available in Salesforce. AT&T CSO, if you are reading this, you are to contact us ASAP!

Herkunft

• Gruppe bei RansomLook
• Screenshot der Veröffentlichung
• von SecBoard erfasst: 18.09.2026