SecBoard
Threat Intelligence

Leak Monitor

Was Ransomware- und Erpressergruppen auf ihren eigenen Seiten veröffentlichen — laufend eingesammelt und aufbereitet.

Stand 22.10.2026, 20:32

Behauptung des Angreifers, kein bestätigter Vorfall

Ein Eintrag auf einer Leak-Seite ist eine Veröffentlichung der Täter. Gruppen listen regelmäßig Organisationen, bei denen nie ein Vorfall stattfand, und einzelne Gruppen erfinden ihre Opferlisten vollständig. SecBoard gibt diese Einträge wieder, ohne sie zu bestätigen.

Einträge 24 h

42

Einträge 7 Tage

293

aktive Gruppen (30 T.)

97

Länder (30 T.)

75

Neueste Einträge

Filter zurücksetzen
n0nHanjin Information Systems & Telecommunication Co., Ltd.KR
telekommunikation

Beschreibung der Täter

IT services · South Korea | A complete corporate identity directory of an IT services company, 999 personnel accounts with names and corporate email addresses; The client staffing structure showing which personnel are seconded to major client organizations; Third party vendor accounts and their corporate domains | [NOT PAID — EXPOSED]

Herkunft

n0nCompany #92KR
kein Firmenname im Eintrag

Beschreibung der Täter

IT services · South Korea | [PENDING EXPOSURE]

Herkunft

everestTaekwang NetworkKR

Beschreibung der Täter

[AI generated] N/A

Herkunft

thegentlemenSONGWOOIKR
automotive

Beschreibung der Täter

songwooi.co.kr SONGWOOI (Song Woo Industrial Co., Ltd.,) South Korean manufacturer of automotive and industrial rubber hoses — intercooler/TCI, heater, fuel, CPF/DPF, and power steering lines — founded 1998 in Busan, HQ and plant in Yangsan since 2002. Founder-Chairman Park Su-kon localizated TCI hoses that were 100% imported from Japan, claiming 90% Korean market share; customers include Hyundai, Kia, Renault Samsung, Hyundai Heavy Industries, and Volvo CE. Certifications: IATF 16949, ISO 14001, ISO 9001; Plus Inno-Biz/Main-Biz status and national awards (Bronze Tower Medal 2015 to Park). Revenue ₩69.9B ($50M) in 2025, down from ₩104.8B peak (2013) — declining four years straight as the industry shifts to EVs — but profitability improved (5.2% operating margin, ROE 23%). Financials are unusually strong: zero debt, 80% equity ratio, ₩52.9B total assets; ~163–197 employees. Watch-outs: some databases list a different CEO (Park Eun-chul)

Herkunft

qilinKD CorpKR

Beschreibung der Täter

Automotive Parts

Herkunft

n0nMGNP (port terminal operations)KR
transport

Beschreibung der Täter

Port terminal operations · South Korea | Commercial invoice records and billing system material | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nPolaris Shipping (dry bulk shipping)KR
transport

Beschreibung der Täter

Dry bulk shipping · South Korea | Internal financial records (sales vouchers) and vessel operational reports | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nBNCT Busan New Container TerminalKR
transport

Beschreibung der Täter

Port terminal operations · South Korea | Operational EDI archives and internal database scripts | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nGNCNet / DGT Busan (port community IT)KR
transport

Beschreibung der Täter

Port IT services · South Korea | Billing service records and operational EDI sample material | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nDongkuk Steel (steel manufacturing)KR

Beschreibung der Täter

Steel manufacturing · South Korea | Internal financial systems material (invoice and settlement records) | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nSaehan Marine (ship agency operations)KR
finanzentransport

Beschreibung der Täter

Ship agency · South Korea | Port disbursement account records and banking correspondence templates | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nDong-A Tanker (oil tanker operations)KR
transport

Beschreibung der Täter

Oil tanker shipping · South Korea | Internal financial records (demurrage/despatch and performance data) | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nEUSU Logistics (logistics operations)KR
transport

Beschreibung der Täter

Logistics · South Korea | Internal infrastructure configuration and assessment records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nBKH ICD (inland container depot operations)KR
transport

Beschreibung der Täter

Inland container depot · South Korea | Commercial invoice records and systems release documentation | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nKorea Ferry (ferry operations)KR
transport

Beschreibung der Täter

Ferry / RoRo shipping · South Korea | Internal staff account records with plaintext credentials and financial receipt records | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nSamjoo Maritime (ship management)KR
transport

Beschreibung der Täter

Ship management · South Korea | Internal financial records (expense applications and bunker cost calculations) | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

n0nPusan Newport Company (container terminal operations)KR
transport

Beschreibung der Täter

Port terminal operations · South Korea | Terminal operating system deployment and configuration records and operational container documentation | [NOT PAID — EXPOSED: files publish 2026-10-19 13:27 UTC]

Herkunft

the gentlemenWOOSHIN SAFETY SYSTEMS CO LTDKR
automotive

Beschreibung der Täter

wooshinsys.co.kr wooshinsys.com finance.yahoo.com/quote/017370.KS/financials/ WOOSHIN SAFETY SYSTEMS CO LTD (KOSPI: 017370, founded 1984, Siheung/Seoul, South Korea) is a global car-body automation specialist — building robotic welding assembly lines for 40+ automakers (GM, Ford, Stellantis, Volvo, Hyundai/Kia, Rivian, Tata) — and the only company in the world that also builds EV battery module/pack assembly lines, giving it a unique edge as carmakers merge body and battery production. It also manufactures auto parts (body doors, seat belts via Wooshin Safety Systems, interiors), with seat-belt order backlogs around KRW 2 trillion (Ford F-150, GM Silverado EV, Stellantis Jeep Compass). Financials are cyclical: record 2024 revenue of KRW 563.6B (OP ₩36.1B) fell 31% to ₩388.6B in 2025 on fewer automation orders, and Q1–Q2 2026 posted operating losses as orders slipped — though analysts (Kiwoom BUY target ₩9,500, SK Securities ₩13,000) forecast a 2026–27 recovery to ~₩451–543B revenue.

Herkunft

the gentlemenWooshin Systems CoKR
automotive

Beschreibung der Täter

wooshinsys.com wooshinna.com finance.yahoo.com/quote/017370.KS/financials/ Wooshin Systems Co., Ltd. (KOSPI: 017370, founded 1984, Siheung/Seoul, South Korea) is a global car-body automation specialist — building robotic welding assembly lines for 40+ automakers (GM, Ford, Stellantis, Volvo, Hyundai/Kia, Rivian, Tata) — and the only company in the world that also builds EV battery module/pack assembly lines, giving it a unique edge as carmakers merge body and battery production. It also manufactures auto parts (body doors, seat belts via Wooshin Safety Systems, interiors), with seat-belt order backlogs around KRW 2 trillion (Ford F-150, GM Silverado EV, Stellantis Jeep Compass). Financials are cyclical: record 2024 revenue of KRW 563.6B (OP ₩36.1B) fell 31% to ₩388.6B in 2025 on fewer automation orders, and Q1–Q2 2026 posted operating losses as orders slipped — though analysts (Kiwoom BUY target ₩9,500, SK Securities ₩13,000) forecast a 2026–27 recovery to ~₩451–543B revenue.

Herkunft

ulosewww.newyjh.comKR

Beschreibung der Täter

Korean hospital Country: Korea Status: private Created: 2026-09-29T01:41:32.254Z

Herkunft

metaencryptorHyVision System. IncKR

Beschreibung der Täter

Hyvision System Inc is a Korea-based company principally engaged in the manufacture of automatic test and measurement equipment for mobile camera modules. Its products include testing and measuring system for camera modules, ccm tester, smart comp. tester, vision inspector tester, secondary batteries, and smart components.

Herkunft

  • en.hyvision.co.kr
  • Pfad auf der Leak-Seite: /0AFC:856a43822e31fb07b441f41dfca61ebad2200f893a983b27d257d77c2eabe98c/0AFC:ffcbfe29cb8969f220e87670e25e912c863783e35691
  • Gruppe bei RansomLook
  • Gruppe bei ThreatCluster
  • von SecBoard erfasst: 26.09.2026 · Land laut Quelle
audit teamAUDIT ENTITY: dg.ac.krKR
kein Firmenname im Eintrag

Beschreibung der Täter

AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08

Herkunft

audit teamAUDIT ENTITY: gownet.netKR
kein Firmenname im Eintrag

Beschreibung der Täter

AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08

Herkunft

metaencryptorSFA Engineering CorporationKR

Herkunft

blacklocks광명산업(주)KR

Beschreibung der Täter

URL: Kmin.co.kr Country: South Korea Description: Kwangmyung Industry is a manufacturing company established in 1985 that produces automotive parts, including automotive seats, molds, and jigs. Domestic operations consist of the headquarters, the Cheonan Central Research Institute, Asan, Gwangju, and Gyeongju factories, as well as the Export Division and Kwangmyung Engineering. Overseas subsidiaries include facilities in Ramos, Mexico, and Alabama, USA. DATA SIZE: 6TB

Herkunft

safepayindustry.airliquide.krKR

Beschreibung der Täter

Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, …

Herkunft

panzerDL E&CKR

Beschreibung der Täter

DL E&C Co., Ltd. is a major South Korean construction and engineering company, founded in 1939, specializing in building, infrastructure, housing, and industrial/energy plant projects worldwide.

Herkunft

Land und Branche liefern Ransomware.live und ThreatCluster (dort nur für die selbst erhobenen Einträge); sonst werden sie aus dem Eintragstext abgeleitet. Belegt bei 61 % der Einträge — die übrigen erscheinen ohne Land.

Quellen sind die Aggregatoren RansomLook, ThreatCluster und Ransomware.live (von ThreatCluster nur die selbst erhobenen Einträge). Melden mehrere dasselbe Opfer, steht es einmal da — mehrere Quellen heißt: mehrere haben dieselbe Behauptung gelesen, nicht: der Vorfall ist bestätigt. Die Zuordnung zur Gruppe stammt aus der Quelle, nicht aus einer eigenen Attribution durch SecBoard. Es werden ausschließlich Metadaten verarbeitet — keine erbeuteten Daten.