SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

rhysida

30 Einträge insgesamt

Zeitraum: 13.08.2026 – 22.10.2026

Veröffentlichungskanäle

  • Leak-Seite · Rhysida · zuletzt erreichbar
  • Leak-Seite · zuletzt nicht erreichbar
  • Dateiablage · Onionsite Not Found · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Meldungen, die den Gruppennamen neben einem Fachbegriff nennen. Kein Maß für die Schwere eines Vorfalls und kein Beleg, dass ein bestimmtes Opfer in der Presse stand.

Neueste Einträge

Filter zurücksetzen
rhysidaDR.SCHNELL GmbH & Co. KGaADE

Beschreibung der Täter

DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA � full network dump. 175,151 files / 2.52 TB.1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement).Complete HR & payroll for Germany, Switzerland, Austria: home addresses, personal emails, payslips with social-security and tax IDs, long-term sick lists (GDPR Art. 9 data).Family-office accounting: signed annual statements of dozens of related entities, bank statements, a EUR 35M credit-line agreement.CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns.Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists. More

Herkunft

rhysidaReed & Giordano PAUS

Beschreibung der Täter

Reed & Giordano PA 94,604 files / ~51.3 GBACH instructions for the firm's client trust account (IOLTA) with complete account details; clients' wire-transfer details.PII: W-9/W-2 forms with SSNs, Massachusetts driver's licenses, birth certificate, personal UBS documents of a financial advisor.Client money flows (incoming/outgoing funds by case).Signed conflict-of-interest letter (matter - Alhassan) - a direct written admission of an internal firm problem. More

Herkunft

rhysidaCharles E. Tabor AAL LLCUS
healthcare

Beschreibung der Täter

Charles E. Tabor AAL LLC 96,456 files / ~114.5 GBSettlement checks � 2026: $600,000 (USAA / Hailey), $587,500 (Travelers / Young), $350,000 (Caddo Parish School Board / Hoffman), $50,000 (USAA UM / Paul).Complete client database - PII for all cases spanning years, consolidated in a single file.Hospital and insurance scans across dozens of cases.Medical scans and HIPAA authorization forms.Driver's licenses and IDs of minor victims.Tax forms containing SSNs.Louisiana state death certificate (evidence item 'plaintiff's exhibit D7').Settlement artifacts: endorsement authorizations with signature lines (2026), signed releases, HIPAA authorizations.Scans of large settlement checks bearing signatures and MICR lines - a ready-made toolkit for check fraud; includes the $350,000 check from the high-profile child case Hoffman. More

Herkunft

rhysidaGress Clark Young & Schoepper—
finanzen

Beschreibung der Täter

Gress Clark Young & Schoepper 167,804 files / ~166.4 GBBanking details - of the firm and its clients.SSNs + signatures of clients/witnesses; W-9, I-9 forms with DL/SSN card copies; W-4 forms.BIIA case-management procedures (Board of Industrial Insurance Appeals): default orders (Order of Default), internal 'Conference Questions', consulting-fee payments to experts.Firm finances: the firm's QuickBooks company file, VOID checks bearing signatures, expert-payment records, SaaS invoices.Medical photos and imaging; hundreds of pages of PHI/APF (Activity Prescription Forms) - X-rays, complete medical records.'Coaching' letters to doctors - including a letter to the physician in the Jachacy matter with wording indicative of steering a medical opinion ('coaching letter') - a potential ethics violation regarding witness handling.Credentials/access to the SPC e-file system (court e-filing).Disciplinary action against partner Daniel W. Gress. More

Herkunft

rhysidaAnne Arundel CountyUS

Beschreibung der Täter

Anne Arundel County Established in 1964, Anne Arundel County is a governmental body, consisting of numerous departments, services and sections all working together to serve the residents. This company is headquartered in Anne Arundel County, Maryland.814,500 files, 2.6 TB721 background-check dossiers with full SSNs in filenames, including 2026 records.Tens of thousands of medical faxes, 2022 to 2026, with patient names and diagnoses.Methadone clinic records under 42 CFR Part 2, the strictest US confidentiality regime.47,602 medical-assistance files with driver licenses, Green Cards, SSN cards, tax forms and bank data.County payroll registers with all salaries, HR memos, contracts, pension and discipline databases.Jail gang-intelligence files with a gang-member master list. More

Herkunft

rhysidaRealManageUS
finanzen

Beschreibung der Täter

RealManage RealManage is a privately held, tech-enabled community association management company headquartered in Plano, Texas. Founded in 2002 and backed by American Securities, the company has grown into one of the largest and fastest-growing community association management firms in the United States, having been recognized on the Inc.1.84 TBThe tax, banking and debt secrets of hundreds of American HOAs and thousands of homeowners - complete with SSNs, account numbers and signatures.Genuine W-9 forms with Social Security numbers, addresses and signatures; IRS 1099-MISC/NEC e-file transmissions for 2014�2025 - thousands of vendor TINs/SSNsHomeowners' banking keys: ACH debit files with routing and account numbers, USAA brokerage statements, signed bank signature cardsPeople's debts by name: assessments through September 2026, bankruptcies, late-fee waivers, hardship letters from debtors begging for payment plansPersonal documents: HUD-1 home purchase settlements (names, prices, mortgages), signed waivers with addresses, HOA election ballots with voter namesFull SQL Server databases: RM_Warehouse, RM_Sales, RM_Portals, CiraNetIdentity (portal accounts), CiraBooks_GL (general ledger

Herkunft

rhysidaSkaff Group—
finanzen

Beschreibung der Täter

Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce � price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More

Herkunft

rhysidaSkaff Group—
finanzen

Beschreibung der Täter

Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce � price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More

Herkunft

rhysidaMat Bao CorporationVN

Beschreibung der Täter

Mat Bao Corporation Mat Bao Corporation offers a range of services including domain registration, cloud hosting, professional email solutions, and cloud server storage. Files: 746,108Data volume: 106.8 GBGovernment inspection materials - NEAC inspection decision No. 61/QD (29.04.2025) against the certification authority, working minutes naming state inspectors and company staff (through December 2025).Corporate core - GPKD business-registration documents bearing the owner's signature, shareholder records, tax commitments (January 2026).Personal data - national ID cards (CCCD) and employee passports with signatures, staff lists.Regulator correspondence - VNNIC, NEAC, the Government Cipher Committee (including RSA-1024 token vulnerabilities).Litigation and operations - the VINASEED dispute, internal investigations, operations-department mail. More

Herkunft

rhysidaElectro Heat Sweden ABSE
finanzenenergie

Beschreibung der Täter

Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing industries all over the world.Files: 1,723,527Data volume: 2,55 TBAll intellectual property - SolidWorks CAD designs of every product, backups of the PDM drawing vault.All accounting and payroll - Visma databases and SPCS payroll databases of four legal entities.Legally sensitive material - confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, cost-pricing calculations.Employee personal data - passport details, visa applications (passport, address, phone, DOB ), insurance policies.Contracts and acceptances - signed agreements and acceptance certificates with Hitachi, ABB, Scania and other customers. More

Herkunft

rhysidaclicks digital GmbH InformationDE

Beschreibung der Täter

clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More

Herkunft

rhysidaLaw Offices of R. David Williams, P.A.—

Beschreibung der Täter

Law Offices of R. David Williams, P.A. Contents. A complete dossier of the firm's criminal defense practice covering ~175+ clients: felonies (an undercover sex sting involving a minor - Ramirez; domestic violence robbery - Valderrama, involving a 4-year-old child; felony DUI - Segula; fraud - B. Williams), a core caseload of ~10 DUI matters (including an arrest at breath readings of 0.011 and SCRAM alcohol monitoring), violations of probation (VOP), FDLE expungement packets with FD-258 fingerprint cards, a 'red flag' Risk Protection Order (RPO), 2 clients in ICE custody, and a material witness under GPS monitoring for 3+ years. Attorney fees range from $750 to $25,000. The case files include complete police discovery: ~206 GB of bodycam video, 911 recordings, and jail calls, incident reports, photo line-ups, FCIC/NCIC forms, and victim and witness data (Marsy's Law). More

Herkunft

rhysidaNEAD ProIT

Beschreibung der Täter

NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services. More

Herkunft

rhysidaLegis—

Beschreibung der Täter

Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT)

Herkunft

rhysidaKreishandwerkerschaft BorkenDE

Beschreibung der Täter

Kreishandwerkerschaft Borken The Kreishandwerkerschaft Borken is the official trade association and advocacy organization representing local craft enterprises (Handwerksbetriebe) in the Borken district of Germany.1,382,523 files, 1.31 TBhealth data (disability lists with ID numbers, GdB medical ruling with diagnosis)sick leave, absence records, pension ruling2026 payslip (tax ID, social-security no., IBAN) and staff rostersigned contracts/terminations, CV with religionmember and creditor IBANsSCHUFA credit checks, court enforcement order, debtor affidavitMail and databases in full (Exchange, PST, SQL backups) + access/infrastructure slide (2FA secrets, S-FIRM code) More

Herkunft

rhysidaMPA PharmaDE
healthcarefinanzenbehoerden

Beschreibung der Täter

MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accounting records and database backups, government audits (customs / corporate tax / social security / wage tax),corporate ownership (nominee structure, beneficial-ownership filings, related-party payments), narcotics/BtM records (opioids, cannabis, precursors),litigation files, executive and employee personal data, IT artifacts, pharmacovigilance correspondence.Credit cards with CVV of executives, Oltersdorf ID card valid until 2030, the Pfeiffer letter on the hidden Paranova Pack B.V., UBO passportsSQL backups (17.7 million general-ledger rows), commercial register extract (HRB), organizational chartCredentials (TIER 1) - a list of all password files (values not repeated here, stored in the MPA PASSWORDS report)Government audits - customs 17,011.77 EUR with a breakdown, corporate tax +202,203.18 EUR, social security (DRV) 23,134.96 EUR with a separate case against the managing director, wage-tax auditNarcotics (BtM) - permits (3

Herkunft

rhysidaAxdia InternationalDE

Beschreibung der Täter

Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More

Herkunft

rhysidaGeneral Santos Doctors Hospital—
healthcare

Beschreibung der Täter

General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals � accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance � audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data � personal cell numbers of the president, hospital administrator and board members More

Herkunft

rhysidaProfessional Retail Services—
finanzen

Beschreibung der Täter

Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate financials: owner�s personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More

Herkunft

rhysidaSAD'S Interim—
finanzen

Beschreibung der Täter

SAD'S Interim Since 2000, SAD'S INTERIM has established itself as a key player in the temporary employment sector.Bank statements (relev�s) with SEPA credit transfersFactoring: invoice import batches, client receivables ledgers (encours) with EUR amounts and named clients, payment receipts (quittances)SQL backups of the BRANIPP ERP (the temp-workers payroll database)Payslips (bulletins de salaire) and payroll validation workbooksPermanent-staff employment contracts signed by the owners (Sadoun family)Temp-worker contracts, Pole Emploi attestationsPassports (EU and third-country nationals)CARTE BTP (construction-worker cards with photo and DOB)carte Vitale (health-insurance cards)RIB (bank account details)NIR (national insurance numbers)MDPH (disability recognition documents) More

Herkunft

rhysidaRug & HomeUS

Beschreibung der Täter

Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customers�full names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scans�signed delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 � tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More

Herkunft

rhysidaSzechenyi Programiroda Nonprofit KfHU

Beschreibung der Täter

Szechenyi Programiroda Nonprofit Kf As a key player in Hungarian development policy, our Company participates in the planning and implementation of development programs based on certain EU and domestic funds. More

Herkunft

rhysidaBerlin, GermanyDE
finanzenbehoerden

Beschreibung der Täter

Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: Geb�udeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell � Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 2025�2026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/M�LLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQ

Herkunft

rhysidaValley Health Team—

Beschreibung der Täter

Valley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial statements, salaries, taxes.Dear customers, please submit your requests�there are plenty of files here that can be monetized. More

Herkunft

rhysidaCRI ElectricIL

Beschreibung der Täter

CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts** (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms** (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More

Herkunft

rhysidaFairview Dental Group—

Beschreibung der Täter

Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More

Herkunft

rhysidaComing soon—

Beschreibung der Täter

Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More

Herkunft

rhysidaBattle Creek Public SchoolsUS

Beschreibung der Täter

Battle Creek Public Schools Battle Creek Public Schools in Nebraska provides educational services for students from pre-kindergarten through 12th grade. We are pleased to present:Student records of named minors:** IEP/special-ed files, disability determination notices, discipline/suspension records.Federal funds compliance trail (ESSA/Title I application), staff health-spending claims (payflex/EHA) More

Herkunft

rhysidaPierce TownshipUS

Beschreibung der Täter

Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More

Herkunft

rhysidaSIA Medical Centre—
finanzenhealthcare

Beschreibung der Täter

SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patient medical records - names, dates of birth, Medicare numbers, clinical notes, insurance and work-cover files, full patient dossiersStaff identity documents - passports, driver's licenses, police checks, tax file declarations of doctors and employeesPlaintext credentials - logins and passwords for clinical systems (Synapse imaging, PRODA, terminal server, doctor accounts)HR records - signed employment contracts, staff incident reports, immunisation registersLegal & financial - subpoenas, complaints, Bupa contracts, bank details (BSB/ABN), provider payment forms More

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.