SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

settra

24 Einträge insgesamt

Zeitraum: 11.08.2026 – 18.10.2026

Veröffentlichungskanäle

  • Leak-Seite · zuletzt nicht erreichbar
  • Dateiablage · zuletzt nicht erreichbar

Kanäle laut RansomLook. Die Adressen der Leak-Seiten werden bewusst nicht angezeigt — sie führen direkt zu den erbeuteten Daten.

Medienecho

Meldungen, die den Gruppennamen neben einem Fachbegriff nennen. Kein Maß für die Schwere eines Vorfalls und kein Beleg, dass ein bestimmtes Opfer in der Presse stand.

Neueste Einträge

Filter zurücksetzen
settrawww.marvinpac.comUS

Beschreibung der Täter

Marvinpac CZ, s.r.o. — the Czech subsidiary of Swiss group Marvinpac SA — specialises in contract packaging and co-packing for some of the world's leading brands: Nespresso, L'Oréal, COTY (Gucci, Hugo Boss, Calvin Klein), air up, LEGO, and others. The company has operated since 2010 at its production facility in Říčany–Jažlovice near Prague, and forms part of an international group with divisions in Switzerland, France, and Italy.

Herkunft

settrapassavant-ee.comDE
healthcare

Beschreibung der Täter

German engineering company Passavant Energy & Environment GmbH, which builds wastewater treatment plants with German and Swiss taxpayer money (KfW, SECO), is in reality controlled by Dubai-based conglomerate Drake & Scull International PJSC and through it finances operations in Iraq. Internal debit notes from Drake & Scull Oil & Gas — Iraq Branch show that employees of the Iraqi division flew to Muscat (Oman) and stayed at hotels billed to Passavant Frankfurt, with the company's accounting department at Hahnstraße 31-35 approving those charges for payment. Employee Serikan Kire

Herkunft

settraacclaimcompanies.comUS

Beschreibung der Täter

The Social Security Numbers of both group executives — Gerald C. Johnson Jr. and Mark C. Johnson — are fully exposed in corporate documents (IRS Form SS-4). The Johnson Family Trust holds an investment portfolio of $1.67 million at First Republic Bank against a margin loan of $280K, while parent company Acclaim Asset Management simultaneously received two different EINs from the IRS — per CP212 notice (January 2025). Baboo Properties LLC, in which Mark C. Johnson is a member, failed to file the required Form 940 for 2015, despite receiving IRS notice CP080. A corporate network of 15+ legal ent

Herkunft

settrabinsky.comUS

Beschreibung der Täter

Piscataway, New Jersey. Binsky & Snyder, LLC has been servicing piping, HVAC, and mechanical systems since 1938. Its website tells a story of "family values" and "trust from day one." The actual corporate records tell a different story.

Herkunft

settrakonsis.noNO

Beschreibung der Täter

We hold a large volume of data from Konsis Grafisk AS — a Norwegian design, marketing and print agency with annual revenue of approximately NOK 100 million.

Herkunft

settramonroeroadways.comUS
transport

Beschreibung der Täter

Rochester, New York. A construction company that goes by Monroe Roadways in bid documents but appears as MRI Contractors of New York, Inc. in banking records. One address: 300 Hogan Road, Fairport. One president: Jeffrey D. Taylor. Two names — and not a single public word about what lies behind them.

Herkunft

settraadapt-global.com—

Beschreibung der Täter

The company sells to federal customers under a GSA MAS contract and calls its products "U.S.-made / Made in the USA," yet its own documents reveal Taiwanese and Chinese suppliers, Hong Kong-based developer and manufacturer TMG, budgets in Shanghai and Zhongshan, molds worth $1,698,109.75, and "tariff surcharges" of 3% to 20% in commercial quotes — in the $4,573.20 Mazda order, exactly ×1.20, with a footer reading "TARIFF SURCHARGE." For FDA-RFQ-21-1243788 for the Comfort Zone software, the archive contains proposals dated June 7 and 9, 2021 — two months before the request was published on Augu

Herkunft

settraexo.incUS
finanzen

Beschreibung der Täter

This article is based on a portion of the company's documents to which we gained access. Patient names, internal identifiers of employees as research subjects, specific diagnoses, serial numbers of problematic devices, and banking details have been intentionally redacted—the company failed to protect them, so we are protecting them.

Herkunft

settranorthshoresun.timesreview.comUS

Beschreibung der Täter

FAMILY NEWSPAPER The company that spent twenty years telling Long Island readers about their communi...

Herkunft

settrawindor.com—

Beschreibung der Täter

Documents: Windor Supply & Manufacturing, Inc. PROLOGUE Sales representative Mark Brewster, on D...

Herkunft

settrawindor.com—

Beschreibung der Täter

Documents: Windor Supply & Manufacturing, Inc. PROLOGUE Sales representative Mark Brewster, on D...

Herkunft

settrahollypoultry.comUS

Beschreibung der Täter

Holly Poultry: 435 Gigabytes from the Inside Baltimore, Maryland · FEIN 25-1434395 · October 2026 Pr...

Herkunft

settrawww.windor.com—

Beschreibung der Täter

Documents: Windor Supply & Manufacturing, Inc. PROLOGUE Sales representative Mark Brewster, on D...

Herkunft

settratranslarity.comUS

Beschreibung der Täter

Closed Circuit The company that probes semiconductors for Boeing and the U.S. military concealed its...

Herkunft

settrabaltimorefreightliner.comUS
transport

Beschreibung der Täter

Harbor Truck Sales and Service, Inc. (Baltimore Freightliner): Inside an Authorized Freightliner Dea...

Herkunft

settragoldenpearfunding.com—
finanzen

Beschreibung der Täter

Golden Pear Funding: A Cash Advance on Desperation — At Felony Rates A company selling financial lif...

Herkunft

settramcpolymers.comUS

Beschreibung der Täter

MCPolymers.com: 27 Years of Corporate Secrets PROLOGUE This article contains only a portion of the d...

Herkunft

settradfiretailgroup.comUS

Beschreibung der Täter

DFI RETAIL GROUP 27 Years of Email Archives + 397 Illegal Stores + 40,000 Medical Files Over 160 mai...

Herkunft

settraoligo.deDE

Beschreibung der Täter

Revenue: 12,500,000 Size: N/A | A group of companies whose luminaires illuminate Deutsche Bank, Burj Dubai, and Scout Motors' assembly lines failed to protect its own data. --- Prologue We hold an archive belonging to the OLIGO Lichttechnik GmbH and RSL Lichttechnik GmbH groups — two German lighting manufacturers based in Sankt Augustin, affiliated with TRILUX Group (Arnsberg). The archive spans more than 144 gigabytes of corporate documentation. Emails, spreadsheets, contracts, tax returns, technical drawings marked as trade secrets, passport data, employees' home addresses, their children's school documents, power of attorney records, credit insurance policies, dealer databases, and incoming quality control reports. The complete operational memory of two companies accumulated over 27 years of business. Inside: a contract with Scout Motors Inc. (USA) for $1,200,000 , signed on March 13, 2026 — two light tunnels for quality inspection on Scout Motors' American assembly line. Incoming inspection reports from April 2024 : one Turkish supplier managed to deliver a shipment in which 99.7% of glass items were rejected — 1,053 units out of 1,056. A database of home addresses for 20 emplo

Herkunft

settraflowco-inc.comUS

Beschreibung der Täter

Revenue: 776,900,000 Size: 1200GB | DEEP WELL: Flowco Production Solutions Documents PROLOGUE Payroll records with employee names and positions. Executive bonus payments detailed to the cent. Complete customer database with order numbers, prices, and contacts. Supplier banking information. Tax returns for multiple years. Internal development plans by department. Asset purchase agreements worth millions of dollars. Trademarks and correspondence with law firms. Employee health insurance with detailed payment breakdowns. Medical insurance claims for hundreds of thousands of dollars with patient names and diagnoses. Accounts payable balances for 2025–2026. Details of employee fringe benefits broken down by department. Driver Qualification Files with Social Security numbers, photographs of SSN cards and CDLs, and medical certificates. All of this comprises documents from Flowco Production Solutions, LLC , an American company based in Houston, Texas, operating in the oil and gas equipment sector. The company specializes in artificial lift systems, gas lift equipment manufacturing, and related services for the oil and gas industry. The nature of Flowco's business makes this leak particula

Herkunft

settrafirstdigital.com—

Beschreibung der Täter

Revenue: 44,000,000 Size: N/A | The Digital Cartel: How a Telecom Empire Robs Its Own Customers and Employees A company that sells connectivity, trust, and quality service as its philosophy maintains an archive that tells a very different story — about systematic billing fraud totaling $2+ million annually, family vacations to Paris charged to corporate cards, 89 employees whose salaries and Social Security Numbers sit in unprotected folders, and tax schemes that defraud the US budget of nearly a million dollars every year. This article covers only a portion of the data we have chosen to release. Everything else will be available for download after full publication. Names of private individuals, Social Security numbers, exact salaries, dates of birth, and banking details have been intentionally redacted — the company failed to protect them, and you will be able to see everything after publication. --- Prologue. An Open Server In telecommunications, boundaries are always visible: contracts define prices, SLAs guarantee quality, the FCC sets the rules. The data we obtained had none of that. No encryption. No access controls. No audit trail. Customer invoices, dealer contracts, call d

Herkunft

settrapowdr.com—

Beschreibung der Täter

Revenue: 400,000,000 Size: 120GB | Point of No Return: What the Ski Empire Is Hiding A company that sells adventure, family memories, and mountain magic maintains an archive that tells a very different story—of undocumented deaths, workers punished for organizing, $8.3 million in financial maneuvers while retained earnings stood at minus $39, and medical records scattered across unprotected folders alongside accounting reports. This article covers only a portion of the data we obtained. The remainder will be available for download after full publication. Social security numbers, medical diagnoses, dates of birth, home addresses, and family details of injured workers and deceased guests have been intentionally redacted—the company failed to protect them. --- Prologue. The Open Archive In skiing, boundaries are always visible: a rope line, a closed trail sign, a fence marking an avalanche zone. The data we received had none of these. No encryption. No access control. No audit. Payroll files, worker's compensation claims, legal case summaries detailing injuries, FMLA medical certifications, NLRB settlement documents, SQL scripts that altered thousands of employee records, and balance

Herkunft

settraadvancedtaxsolutions.comUS

Beschreibung der Täter

Revenue: 7,100,000 Size: N/A | Frank Rim & Associates: Archive of a Tax Consulting Practice PROLOGUE Every tax case. Initial client meetings. Letters containing full details. Financial calculations of IRS liabilities. Paycheck stubs. Social Security numbers. Home addresses and ZIP codes. Bank accounts and balances. Tax returns. All IRS correspondence. Court collection notices. Installment agreement plans with the federal tax authority. Medical insurance coverage. Family members. Dependents. Children. A contact management system (CRM) with the full history of meetings and negotiations. Automated export and backup processes. This article contains only a portion of the data. The full archive will be available to download and review independently once it is published. --- Part I. Frank Rim & Associates CPA PC Frank Rim & Associates CPA PC — a tax consulting practice in Denver, Colorado. Has operated for decades, serving thousands of taxpayers. Basic information: - Registered address: 1609 Gaylord Street, Denver, CO 80206 - Phone: (303) 753-6040 - Fax: (303) 753-6275 - Entity type: Professional Corporation (C-Corp) - Active since: at least 2003 Practice partners: | Name | Ro

Herkunft

settraprofinrg.nlNL

Beschreibung der Täter

Revenue: 6,200,000 Size: N/A | How Profinergy BV Lost Control of Thousands of Files PROLOGUE: Thousands of files. The complete digital archive of a group of companies building solar power plants across Europe. Consolidated financial statements totaling over €35 million in assets . A Tesla Energy commercial proposal — marked "Proprietary & Confidential | Disclosed under NDA" — with three pricing options for Megapack energy storage systems with a combined value ranging from €5.1 to €6.4 million . Credit documents for a 9.4 MW solar farm financed by BNG Bank. A power purchase agreement with ENGIE Energie Nederland NV . Insurance policies with exact coverage amounts. Confidential supplier technical manuals marked "CONFIDENTIAL/PROPRIETARY" . Court documents from a lawsuit against Profinergy — a summons seeking a penalty of €1,000 per violation . Personal customer data: names, addresses, phone numbers, and banking details for payments. A letter confirming "highly skilled migrant" status — an employee record complete with work authorization. All of it — in a single unprotected archive belonging to Profinergy BV (trade name ProfiNRG ), a Dutch solar energy developer and EPC contractor

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.