SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

inc

20 Einträge insgesamt

auch bekannt als: inc-ransom

Zeitraum: 29.09.2026 – 19.10.2026

Medienecho

Keine Meldung im Bestand nennt diese Gruppe — sie arbeitet unbeachtet. Das ist der Regelfall: von 81 aktiven Gruppen haben 23 ein Medienecho.

Neueste Einträge

Filter zurücksetzen
incSeetelhotels.deDE

Beschreibung der Täter

Seetel Hotels (SEETEL Hotel GmbH & Co. Betriebs KG) has been notified that a substantial volume of confidential and internal corporate data has been compromised. The affected data includes, but is not limited to: Full guest identity records, government-issued passport and ID numbers, payment card details (credit card numbers, CVVs, and expiration dates), direct booking notes, special requests, dietary restrictions, documented allergies, and medical/health-related accommodation preferences. Invoices, payment transaction logs, accounts receivable and payable (Debitorenbuchhaltung / Kreditorenbuchhaltung) records, internal financial audits, and controlling documentation.

Herkunft

incwww.coopecaja.fi.crCR
finanzen

Beschreibung der Täter

/

Herkunft

incnowaszkola.comPL

Beschreibung der Täter

/

Herkunft

incWolf & Sofsky GmbHDE

Beschreibung der Täter

Wolf & Sofsky GmbH is a construction company with a 75-year history, based in Zweibrücken, Germany. The company operates on highly complex projects and maintains a significant financial position. Critical Information We Possess Financial Data: Complete spectrum of financial information (reports, budgets, cost estimates), revealing project profitability, total revenue, cost structure, and financial stability of the company. Commercial Information: Contracts with clients, commercial offers, contract terms — these form the foundation of Wolf & Sofsky's competitive advantage. Personal Data: Information about employees and clients (names, contacts, job titles, possibly salaries), which falls under GDPR legislation. Technical Assets: Technical plans, project drawings, architectural solutions — the company's unique intellectual property. Strategic Plans: Business plans and strategic documents, revealing development directions, new markets, and future projects.

Herkunft

incbrookslawfirm.comUS

Beschreibung der Täter

personal data 8200 client hippa etc

Herkunft

inchsc.mb.caCA
healthcare

Beschreibung der Täter

The Health Sciences Centre in Winnipeg, one of the largest medical institutions, was targeted by us that resulted in the largest data breach among healthcare institutions. Our group chose not to completely disrupt the facility’s operations, recognizing the potentially devastating consequences that such an action could have had on patients’ lives and health. Nevertheless, Health Sciences Centre management stated that no sensitive data had been affected, despite having been informed otherwise. The data included, but was not limited to, the following information: Patient medical records: Full name, date of birth, address and phone number Hospital medical record number Diagnoses, medical history, allergies and medications Laboratory results, imaging reports Appointment dates, treatment details and physician information. Employee and healthcare professional information: Names, contact details, dates of birth and employee numbers Employment, payroll and banking information Professional credentials, work schedules and departmental assignments. Financial and insurance information: Billing records and payment histories Insurance or benefits claim information. Confidential ho

Herkunft

incThe New Community SchoolUS

Beschreibung der Täter

The New Community School is an independent co-educational day school located in Richmond, VA, catering to students in grades 5-12 with dyslexia. The school offers a customized curriculum designed to unlock each student's potential, emphasizing small class sizes and a student-centered approach. With a focus on nurturing relationships and community connections, TNCS empowers students to achieve success academically and personally. The school also provides a range of extracurricular activities, including arts, athletics, and community service opportunities.

Herkunft

incWavecrest HFAUS
finanzen

Beschreibung der Täter

12,143 Files, 267 Folders 23,991,067,648 bytes

Herkunft

incTec ImportsBR

Beschreibung der Täter

Tec Imports group offers a complete range of logistics solutions, from coordinating shipments from the manufacturer's plant to the end customer, whether by sea, air, or road. Commercial Department - contact@dorte.com.br Importation - alexandre@dorte.com.br Export - stefani@dorte.com.br Hospitalar – Cosmético - ricardolinhares@dorte.com.br Professional Hairdressing Machines -ricardoamaral@dorte.com.br Tec Zipper - diogo@teczipper.com.br Phone/Fax: +55 11 3809-6870 Phone/Fax: 55 27 3318-0888

Herkunft

incUAE Pro LeagueAE

Beschreibung der Täter

The UAE Pro League is the top division of professional soccer in the United Arab Emirates. GENERAL INQUIRIES +971-2-4044999 activations@uaeproleague.ae MEDIA INQUIRIES +971-2-4044999 media@uaeproleague.ae

Herkunft

incCity of CloverdaleUS

Beschreibung der Täter

Cloverdale is a small city in Sonoma County, Northern California, set among the vineyards and rolling hills of the Alexander Valley. Known for its small-town charm, wineries, outdoor recreation, and historic downtown, it is about 85 miles north of San Francisco

Herkunft

incacmestamping.comUS

Beschreibung der Täter

Acme Stamping & Wire Forming Co. specializes in metal stamping, CNC machining, precision wire forming, and tool & die services. They offer a range of capabilities including progressive blanking, deep draw, and single station compound processes. The company caters to clients requiring high-quality manufacturing solutions with advanced equipment and precision engineering. Located in Pittsburgh, PA, Acme Stamping & Wire Forming is equipped to handle various production needs. Employees: 20 Revenue: $5 Million Phone Number: (412) 771-5720

Herkunft

incharborpacific.comUS
transport

Beschreibung der Täter

Harbor Pacific Contractors, Inc. specializes in Industrial, Mechanical, and Heavy Civil Construction Services in the Pacific Northwest. Their offerings include wastewater and water treatment facilities, transportation infrastructure, pump stations, and power generation facilities. The company serves clients in Washington, Oregon, and Alaska, focusing on large-scale construction projects. With a commitment to quality and efficiency, they cater to various industrial construction needs. Employees: 20 Revenue: $5 Million Phone Number: (425) 488-7131

Herkunft

incarchitekt-vondanwitz.deDE

Beschreibung der Täter

Architektur in der Symbiose aus der erfahrenen und sicheren Anwendung der innovativen Bauteilevorfertigung, mit ökonomischer Umsetzung, ist seitüber 40 Jahren unsere Leidenschaft. Employees: 20 Revenue: $5 Million Phone Number: 06761/95900

Herkunft

incRimrock FoundationUS

Herkunft

incGuardian Pharmacy LLCUS
healthcare

Herkunft

incDen Hartog IndustriesUS

Herkunft

incNorthern Counties Health CareUS
healthcare

Herkunft

incPost Metal RecyclingUS

Herkunft

incbcx.co.zaZA

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.