Ransomware Group intelligence
Rhysida
ActiveTrack Rhysida with 315 published victims and 10 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Rhysida is tracked by Dark Eye as a ransomware group with 315 published victims.
United States is currently the most targeted country in this dataset.
10 known leak locations are currently associated with this group.
Leak Status Distribution
315
- Leaked 37 11.7%
- Pending 277 87.9%
- Deleted 1 0.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (10)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 10 | Onion service | Up checked 3h ago | rhysidaxx6gdihss7urv4ecbh2yz4izhnfulfbrb4ua5dwkocm653yid.onion |
| Leak location 4 | Onion service | Up checked 3h ago | rhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion |
| Leak location 7 | Onion service | Up checked 3h ago | rhysidaqho36b6i6mvpmy5di4ro5zglovtxixrirky6q3fgack7q5uyd.onion |
| Leak location 1 | Onion service | Up checked 3h ago | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion |
| Leak location 2 | Onion service | Up checked 3h ago | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion |
| Leak location 3 | Onion service | Up checked 3h ago | rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion |
| Leak location 9 | Onion service | Down checked 3h ago | rhysidaiqemmlrvn2jvncdwhkvuiv7s2iu342xnrpeynxoe6r2dtjfyd.onion |
| Leak location 8 | Onion service | Down checked 3h ago | rhysida6qqkj5ahjfshlepbhk7m2sgqc25y5iznmabcch2i7pbw4g6yd.onion |
| Leak location 6 | Onion service | Down checked 3h ago | rhysidaeoxtkejwuheks3a7htk4zn3dfuynt5mqw6oawlcx6kcxjdeyd.onion |
| Leak location 5 | Onion service | Down checked 3h ago | grhysidafc6lm7qa2mkiukbezh7zuth3i4wof4mh2audkymscjm6yegad.onion |
Top Activity Sectors (18)
- Not identified 47
- Education 45
- Communication / Marketing 41
- Healthcare / Pharma 34
- Public Sector 27
- Manufacturing / Engineering 24
- Finance / Legal / Insurance 19
- Services 16
- IT 9
- Retail / E-commerce 7
- NGOs / Associations 6
- Transportation / Travel / Logistics 6
- Construction / Real Estate 5
- null 4
- Telecommunications 3
- Hospitality / Food & Beverage / Tourism 3
- Energy 2
- Agriculture / Food 1
Typical Attacks (9)
▼MITRE ATT&CK does not currently catalogue Rhysida, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: rhysida executes malicious commands via PowerShell scripts to stage payloads and manipulate system behavior.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: rhysida modifies registry run keys to ensure malware execution upon system reboot for persistence.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: rhysida disables antivirus tools and security software to prevent detection and hinder incident response efforts.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1027.016 Junk Code Insertion Stealth
What they do: rhysida inserts junk code into legitimate binaries to evade static analysis and detection by security tools.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: rhysida deletes Volume Shadow Copies and backup directories via vssadmin and native commands to eliminate recovery options.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: rhysida performs remote system discovery to identify additional hosts for lateral movement within the victim network.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1135 Network Share Discovery Discovery
What they do: rhysida scans network shares using Windows tools to identify victim files and expand foothold across the network.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1567.002 Exfiltration to Cloud Storage Exfiltration
What they do: rhysida exfiltrates stolen data via encrypted channels to pressure victims into paying ransom.
What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
-
T1486 Data Encrypted for Impact Impact
What they do: rhysida encrypts victim files using custom ransomware binaries targeting critical data across affected systems.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
Tools Observed (8)
▼Software Rhysida has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery & enumeration
PowerView
Exfiltration
WinSCP
LOLBAS (living-off-the-land binaries)
NTDS Utility (ntdsutil)
PsExec
Windows Event Utility (wevtutil)
WMIC
Offensive security tooling
Impacket
Remote monitoring & management
AnyDesk
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (1)
▼The note this group leaves on a compromised machine. Click a filename to read it.
CriticalBreachDetected.txt
Critical Breach Detected - Immediate Response Required Dear company, This is an automated alert from cybersecurity team Rhysida. An unfortunate situation has arisen - your digital ecosystem has been compromised, and a substantial amount of confidential data has been exfiltrated from your network. The potential ramifications of this could be dire, including the sale, publication, or distribution of your data to competitors or media outlets. This could inflict significant reputational and financial damage. However, this situation is not without a remedy. Our team has developed a unique key, specifically designed to restore your digital security. This key represents the first and most crucial step in recovering from this situation. To utilize this key, visit our secure portal: rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion with your secret key [snip] It's vital to note that any attempts to decrypt the encrypted files independently could lead to permanent data loss. We strongly advise against such actions. Time is a critical factor in mitigating the impact of this breach. With each passing moment, the potential damage escalates. Your immediate action and full cooperation are required to navigate this scenario effectively. Rest assured, our team is committed to guiding you through this process. The journey to resolution begins with the use of the unique key. Together, we can restore the security of your digital environment. Best regards
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (315)
Search, filter and paginate the victim timeline for Rhysida. Showing 1–100 of 315.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Cipsa Industrias Sa De Cv id35980 View details | Mexico | Manufacturing / Engineering | pending | ||
|
Cipsa Industrias Sa De Cv Compania Industrial Papelera Poblana, S.A. de C.V. (CIPPSA) and Tubos y Empaques de Puebla, S.A. de C.V. (TEPSA / KJAS TEPSA), a Mexican corrugated cardboard, packaging and paper-tube manufacturer. Complete employee HR records: names, dates of birth, home addresses, phone numbers, personal and corporate email addresses, CURP, RFC, IMSS numbers, salaries and employee badge photographs.Payroll records, tax data, fiscal validation files and HSBC payroll-bank files containing employee account and CLABE data.Information showing executive compensation through an **honorarios** arrangement outside the regular payroll system.Financial and industrial reports, sales/procurement/payroll budgets, production costs, operational analytics, invoices and accounting records.Customer complaint records and overdue receivables data.Occupational-safety, psychosocial-risk, industrial-incident and hazardous-waste documentation. More |
||||||
| Ransomware | INTI International University & Colleges id35956 View details | Malaysia | Education | pending | ||
|
INTI International University & Colleges INTI International University & Colleges offers a diverse range of academic programs including undergraduate, postgraduate, and professional development courses across various fields such as business, engineering, health sciences, and design. More |
||||||
| Ransomware | INTAX, Inc. id35934 View details | United States | Finance / Legal / Insurance | pending | ||
|
INTAX, Inc. INTAX, Inc. Complete file server of INTAX, Inc. (Lexington, KY, USA) - a property-tax compliance and bill-pay firm. 892,867 files, 1.27 TB Client tax returns: 649,905 PDFs. Clients include AARP, ADT, Pilot Travel Centers, Wendy's, Valvoline, Zions, Raytheon (~100 companies). Client accounting: 100+ QuickBooks company files � full ledgers, banks, payroll. Money: bank account + routing numbers, $910,000 wire form, signed W-9, proof the firm opens dedicated accounts and pays client taxes (~$73.6M/yr moved). Identity data: US passports of the owner and employees, driver license, birth certificate, W-2s with SSNs, IRS filings 2025�2026, medical insurance cards. 60+ cleartext password files: US government tax portals + the firm's own QuickBooks. 24,000+ emails, personal employee folders, lawsuit records, owner exit/sale planning. With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! Price: 11 BTC Send Complete file server of INTAX, Inc. (Lexington, KY, USA) - a property-tax compliance and bill-pay firm. 892,867 files, 1.27 TB Client tax returns: 649,905 PDFs. Clients include AARP, ADT, Pilot Travel Centers, Wendy's, Valvoline, Zions, Raytheon (~100 companies). Client accounting: 100+ QuickBooks company files � full ledgers, banks, payroll. Money: bank account + routing numbers, $910,000 wire form, signed W-9, proof the firm opens dedicated accounts and pays client taxes (~$73.6M/yr moved). Identity data: US passports of the owner and employees, driver license, birth certificate, W-2s with SSNs, IRS filings 2025�2026, medical insurance cards. 60+ cleartext password files: US government tax portals + the firm's own QuickBooks. 24,000+ emails, personal employee folders, lawsuit records, owner exit/sale planning. |
||||||
| Ransomware | ClaimTek Systems id35920 View details | United States | Services | pending | ||
|
ClaimTek Systems ClaimTek Systems ClaimTek Systems specializes in preparing individuals for successful entry into the medical billing and practice management business with a comprehensive training and support system. They offer a range of scalable products and services, including state-of-the-art billing software and marketing tools, targeted towards aspiring entrepreneurs in the healthcare industry. With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! Price: 5 BTC Send With a proven business model backed by decades of experience, ClaimTek caters to various medical and dental specialties across the U.S. by providing ongoing training and high client acquisition potential, enabling licensees to thrive in a rapidly growing market. |
||||||
| Ransomware | Noelker and Hull id35855 View details | United States | null | pending | ||
|
Noelker and Hull Noelker and Hull NHA-FULL � US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026 No credentials in this lot (excluded by decision). Focus: identity and family packages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail. SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPC legacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M. ~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, Select Medical, Tower Health, Holland America, Hershey, Gettysburg College - incl. hospital & crisis-center plans. KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail | 60+ SSN rows | exec passports+DL x4 | edge 2026. INVENTORY - raw files from the firm's servers, values masked, full set on close. [1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residents Passports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024), pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks - MD Criminal History + FBI Identity History + fingerprints. 'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical. 'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts, Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA. 'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45. Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim. [2] PAYROLL - Ajera ERP SQL backups, 140 tables SSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 | BankAccount x1503. Full compensation/bank anatomy for payroll-diversion. [3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 + $803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct 104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022) + fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven. [4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'design errors, omissions' against NHA � internal assessments, stop-work, delay claims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE' hold; SpiriTrust privileged folder; CIA subpoena response. [5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140 Certificates of Insurance; license keys (Autodesk/Adobe) bonus. [6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%, Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards 37.7 GB; aborted Olsen merger docs. [7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI. Rest as-is, unprobed. [+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed), Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price. FRESHNESS - A�live: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail. B�recent: Ajera, pipeline, returns 2022-25, litigation. C�archival (KAPC 2009-14): W-2, background - SSN/biometrics don't expire. BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6); PA/MD plaintiff bar (1+4); contractor scams (5). DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarked seal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split. 3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive. DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory (60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIED assumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! Price: 20 BTC Send NHA-FULL � US ARCHITECTURE FIRM (est. 1971) - HEALTHCARE / SENIOR-LIVING DESIGN - COMPLETE INTERNAL FILE-SERVER - FRESH TO 2026 No credentials in this lot (excluded by decision). Focus: identity and family packages, payroll SQL, tax/bank pipes, litigation, seals & signatures, 26 GB mail. SUBJECT - Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPC legacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M. ~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, Select Medical, Tower Health, Holland America, Hershey, Gettysburg College - incl. hospital & crisis-center plans. KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail | 60+ SSN rows | exec passports+DL x4 | edge 2026. INVENTORY - raw files from the firm's servers, values masked, full set on close. [1] IDENTITY & FAMILY PACKAGES - FULLZ - ~80-100 PA residents Passports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024), pay stubs (VP, YTD ~$116K, 07/2026), 401(k) x2, I-9; background checks - MD Criminal History + FBI Identity History + fingerprints. 'Kennedy': SSN, mortgage 03/2024, 3 child birth certs, child medical. 'Karpowicz' (employee's mother, dementia): Medicare MBI, bank accounts, Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA. 'Hoffman': UPMC/WellSpan medical, custody. + ~62 resumes, phones ~45. Below PA AG >500 bar - but every name is a plaintiff (Dittman) + a victim. [2] PAYROLL - Ajera ERP SQL backups, 140 tables SSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 | BankAccount x1503. Full compensation/bank anatomy for payroll-diversion. [3] TAX & FINANCE - Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 + $803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct 104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022) + fraudulent SBA EIDL #7672918108 in the firm's name - scheme proven. [4] LITIGATION - ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, 'design errors, omissions' against NHA � internal assessments, stop-work, delay claims. Fleet Landing demand ~$1.41M. Vincentian 'DO NOT MOVE OR DELETE' hold; SpiriTrust privileged folder; CIA subpoena response. [5] FORGERY KIT - signatures of 14 employees + architect seals (MD/PA); ~140 Certificates of Insurance; license keys (Autodesk/Adobe) bonus. [6] COMMERCIAL SECRETS - fee pipeline 2010-2026 (5.00-8.50%, markup 10%, Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards 37.7 GB; aborted Olsen merger docs. [7] MAIL - ~26 GB, into 2026. Indexed sample: 6,195 msgs - 401(k)/ERISA/PHI. Rest as-is, unprobed. [+] AS-IS - encrypted browser stores x3 (OWA/banks/PayPal/USCIS listed), Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price. FRESHNESS - A�live: pay stubs 07/2026, COI to 05/2027, case 2026-C-2439, mail. B�recent: Ajera, pipeline, returns 2022-25, litigation. C�archival (KAPC 2009-14): W-2, background - SSN/biometrics don't expire. BUYERS - elder-fraud/fullz (1); BEC/payroll-diversion (2+3); competitor AEC (6); PA/MD plaintiff bar (1+4); contractor scams (5). DEAL - mockup only. 1. Sample: masked docs, table-list screenshot, watermarked seal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split. 3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive. DISCLAIMER - HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory (60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIED assumption (artifacts dated 2026). '~' = enumerated; unparsed = unproven. |
||||||
| Ransomware | Broadstreet HEOR id35850 View details | United States | IT | pending | ||
|
Broadstreet HEOR Broadstreet HEOR Broadstreet Health Economics & Outcomes Research (Vancouver, Canada) is a consultancy running health-economics and real-world-evidence studies for Pfizer, Bayer, Boehringer Ingelheim, Takeda, Madrigal, Alexion/AstraZeneca, Bristol-Myers Squibb, Sarepta, Taysha, Biohaven and others. - US patient PHI: Medicaid (11.3M rows: DOB, race, diagnoses, NDC drugs, payments), Veradigm/Allscripts EHR tables, licensed IBM MarketScan / Optum Clinformatics data. - Production Alexiondb (PostgreSQL): schema + claims rows. - Live SQL Server credentials of client Taysha Gene Therapies (production DB irsf-nhs-prod-db, public IP). - Confidential pharma materials: unpublished Boehringer Ingelheim slides, Takeda manuscript, Bayer CEM models, Madrigal reports, Pfizer/VA emails. - Staff personal documents. With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! Price: 9 BTC Send Broadstreet Health Economics & Outcomes Research (Vancouver, Canada) is a consultancy running health-economics and real-world-evidence studies for Pfizer, Bayer, Boehringer Ingelheim, Takeda, Madrigal, Alexion/AstraZeneca, Bristol-Myers Squibb, Sarepta, Taysha, Biohaven and others. - US patient PHI: Medicaid (11.3M rows: DOB, race, diagnoses, NDC drugs, payments), Veradigm/Allscripts EHR tables, licensed IBM MarketScan / Optum Clinformatics data. - Production Alexiondb (PostgreSQL): schema + claims rows. - Live SQL Server credentials of client Taysha Gene Therapies (production DB irsf-nhs-prod-db, public IP). - Confidential pharma materials: unpublished Boehringer Ingelheim slides, Takeda manuscript, Bayer CEM models, Madrigal reports, Pfizer/VA emails. - Staff personal documents. |
||||||
| Ransomware | Machelen (Belgium) id35839 View details | Belgium | Manufacturing / Engineering | pending | ||
|
Machelen (Belgium) Machelen (Belgium) Machelen (Belgium) - municipal and social welfare (OCMW) file servers 1.3 million files, ~2.9 TB. Working copy + backup copy (lawer2/lawer3). Language: Dutch, partly French. Contents: Social welfare and migration service client files: passports, ID cards, residence permits, sick notes. WZC nursing home: medical files, staff HR dossiers, workplace accidents. Civil status records (births, marriages) with national register numbers (NISS/RRN). Payslips, financial data. Correspondence (~23k messages), employee home folders. Databases and backups: full OCMW database backup (6 GB, 09/2026), 645 .mdb databases, 12,873 .dbf, 110 .bak (17 GB). Verified: 13,319 files with personal data. Among them - a valid Belgian ID card (expiry 02/2029), Belgian and Moroccan passports, national register numbers (RRN), sick notes with patient addresses, medical documents (GDPR Art. 9 special categories). With just 7 days on the clock, seize the opportunity to bid on exclusive, unique, and impressive data. Open your wallets and be ready to buy exclusive data. We sell only to one hand, no reselling, you will be the only owner! Price: 20 BTC Send Machelen (Belgium) - municipal and social welfare (OCMW) file servers 1.3 million files, ~2.9 TB. Working copy + backup copy (lawer2/lawer3). Language: Dutch, partly French. Contents: Social welfare and migration service client files: passports, ID cards, residence permits, sick notes. WZC nursing home: medical files, staff HR dossiers, workplace accidents. Civil status records (births, marriages) with national register numbers (NISS/RRN). Payslips, financial data. Correspondence (~23k messages), employee home folders. Databases and backups: full OCMW database backup (6 GB, 09/2026), 645 .mdb databases, 12,873 .dbf, 110 .bak (17 GB). Verified: 13,319 files with personal data. Among them - a valid Belgian ID card (expiry 02/2029), Belgian and Moroccan passports, national register numbers (RRN), sick notes with patient addresses, medical documents (GDPR Art. 9 special categories). |
||||||
| Ransomware | Sanders Law Group id35508 View details | United States | Finance / Legal / Insurance | pending | ||
|
Sanders Law Group DATA SALE LISTING - Sanders Law Group / Sanders Law Firm, PLLC (Uniondale, NY) Target: Sanders Law Firm, PLLC (d/b/a Sanders Law Group; former brands - Barshay Sanders PLLC, Baker Sanders) Addresses: 333 Earle Ovington Blvd, Suite 402, Uniondale, NY 11553 � 100 Garden City Plaza, Garden City, NY 11530 Phone: (516) 203-7600 � Owner: Craig B. Sanders, Esq. (founding partner) Size: ~8 TB � 4.5 million files � 2005�2026, history through most recent Format: full file-server clones + 2 dumps of the firm's ARES case-management DB + mail archives (33 PST, ~120 GB + 2,479 mailbox dumps) Who they are and who they work with A high-volume litigation factory out of Long Island, NY, running three conveyor-belt practices: FDCPA mill - 9,332 mass cases against banks and collectors. Their evidence pipeline: 1,144 audio recordings of their own clients' calls with banks Copyright machine - ~17,000 'photo-enforcement' suits. In January 2022 Sanders bought the entire practice of Richard Liebowitz � the most-sanctioned copyright attorney in U.S. history (discredited, bar-suspended). Included: the executed Asset Purchase Agreement, a confidential WZMP settlement (7 versions incl. redlines), the acquired book of cases and clients, and solicitation letters to poach his client list FCRA litigation vs Equifax, Experian, TransUnion � 953 cases. Plus a dedicated Equifax SRAs folder: executed settlements with Equifax LLC, named client by client, alongside their full credit disclosures Corporate clients/partners in the files: The Mega Agency, Pixsy (exclusive enforcement deals), Signature Health Center / CareHealth (healthcare), Chase debt-buyer packages, Esquire Funding (litigation finance - loan agreements, commission invoices). Case-management dev outsourced to an Indian shop (neuralit.com). Active matters right now: 6,098 (of 30,671 total in the DB). What's inside - value breakdown Practice-side (the firm's jugular) Full ARES DB (2 dumps) - all 30,671 cases with settlement offers/demand ceilings in 13,413 files (up to $4,000,000 per case), statuses, internal notes, deadlines. Publication - burned negotiation positions across every active case at once 2,342 executed CONFIDENTIAL settlement agreements (e.g., NationalPhoto v. Entravision + dozens more) - bearing secrecy clauses the firm itself is liable for 1,315 documents of the firm's own sanctions and discipline: court orders on sanctions motions, a DFS Disciplinary Stipulation, 6� 'Notice of Attorney Sanction' filings, public discipline orders Banking & trusts 11 accounts, 562 statements, incl. attorney trust accounts IOLTA NY (�9068) and IOLTA NJ (�2302) - bar-mandated audit territory = direct license threat for every named attorney Wire instructions for the client fund �6327 (JPMorgan Chase) Partnership tax returns 2015�2020 (Form 1065, TurboTax source files), payroll, full HR (I-9s, staff employment contracts, employee handbook) Client PII � industrial scale 12,803 full credit reports of the firm's own plaintiff-clients 20,106 W-9/1099 forms, 520 files: SSN cards / passports / driver licenses / birth certificates 1,471+ medical records (named patients, incl. NYUI files) CRM: 5,352 clients + 13,178 leads with phones/emails32,816 executed retainer agreements Owner-level leverage (Craig B. Sanders) His 2022 divorce: Judgment of Divorce (Michelle Sanders v. Craig Sanders) + settlement stipulation + sworn Net Worth Statement + brokerage/bank statements Bonus: the firm's 78-page FBI IC3 criminal complaint dated 08/22/2026 Email � 20 years 33 legacy PSTs (~120 GB) + 2,479 mailbox dumps + daily email backups (2013�2014) Freebies: office password lists in plaintext, owner's Chrome password export, court ECF login sheets. Documents (part 1) Documents (part 2) Documents (part 3) Documents (part 4) Documents (part 5) Documents (part 6) Data Catalog: 8 Tb, 4 564 445 Files 100% All files was uploaded to public access, data hunters, enjoy |
||||||
| Ransomware | Line2Line Coatings id35455 View details | United States | Manufacturing / Engineering | pending | ||
|
Line2Line Coatings 796,433 files - 641.0 GB ~20 years of email: 34 mailboxes (PST/OST), 107,279 messages, 13,068 contacts - including the president's own mailbox (4.0 GB). The entire QuickBooks history: 1,232 backups (.QBB) + 174 live company files (.QBW) for both entities, 15+ years of revenue. Full banking footprint: Chase statements, Clarkston State Bank, account and routing numbers, credit card numbers with CVV. Personal data: 3,614 Social Security Numbers; 64,907 files containing PII - W-2s of all employees, contractor 1099/W-9s, passport and driver license scans, HR files. 77,118 PDFs, 66,691 Excel spreadsheets, 38,688 Word documents. Military material: SBIR/ONR/TARDEC files, CUI, patent correspondence. Customer base: Eaton (15,320 emails), GM, Chrysler, Linamar, Whipple (~50% of revenue), Honda R&D, TVS, Mercury Marine, Stihl. Documents (part 1) Documents (part 2) Data Catalog: 599 Gb, 799 239 Files 100% All files was uploaded to public access, data hunters, enjoy |
||||||
| Ransomware | DR.SCHNELL GmbH & Co. KGaA id35440 View details | Germany | Manufacturing / Engineering | leaked | ||
|
DR.SCHNELL GmbH & Co. KGaA DR.SCHNELL GmbH & Co. KGaA � full network dump. 175,151 files / 2.52 TB. 1.2+ TB of Navision/Business Central ERP backups - full commercial history (clients, pricing, procurement). Complete HR & payroll for Germany, Switzerland, Austria: home addresses, personal emails, payslips with social-security and tax IDs, long-term sick lists (GDPR Art. 9 data). Family-office accounting: signed annual statements of dozens of related entities, bank statements, a EUR 35M credit-line agreement. CEO's personal dossier: valid passport, ID card, tax ID, 11 years of signed tax returns. Access material: TLS private keys for *.dr-schnell.de, ~120 Elster tax certificates, O365 admin password, password lists. Documents Data Catalog: 2,5 Tb, 175 150 Files 100% All files was uploaded to public access, data hunters, enjoy |
||||||
| Ransomware | Reed & Giordano PA id33708 View details | United States | — | leaked | ||
|
Reed & Giordano PA 94,604 files / ~51.3 GBACH instructions for the firm's client trust account (IOLTA) with complete account details; clients' wire-transfer details.PII: W-9/W-2 forms with SSNs, Massachusetts driver's licenses, birth certificate, personal UBS documents of a financial advisor.Client money flows (incoming/outgoing funds by case).Signed conflict-of-interest letter (matter - Alhassan) - a direct written admission of an internal firm problem. More |
||||||
| Ransomware | Charles E. Tabor AAL LLC id33698 View details | United States | — | leaked | ||
|
Charles E. Tabor AAL LLC 96,456 files / ~114.5 GBSettlement checks � 2026: $600,000 (USAA / Hailey), $587,500 (Travelers / Young), $350,000 (Caddo Parish School Board / Hoffman), $50,000 (USAA UM / Paul).Complete client database - PII for all cases spanning years, consolidated in a single file.Hospital and insurance scans across dozens of cases.Medical scans and HIPAA authorization forms.Driver's licenses and IDs of minor victims.Tax forms containing SSNs.Louisiana state death certificate (evidence item 'plaintiff's exhibit D7').Settlement artifacts: endorsement authorizations with signature lines (2026), signed releases, HIPAA authorizations.Scans of large settlement checks bearing signatures and MICR lines - a ready-made toolkit for check fraud; includes the $350,000 check from the high-profile child case Hoffman. More |
||||||
| Ransomware | Gress Clark Young & Schoepper id33666 View details | United States | — | leaked | ||
|
Gress Clark Young & Schoepper 167,804 files / ~166.4 GBBanking details - of the firm and its clients.SSNs + signatures of clients/witnesses; W-9, I-9 forms with DL/SSN card copies; W-4 forms.BIIA case-management procedures (Board of Industrial Insurance Appeals): default orders (Order of Default), internal 'Conference Questions', consulting-fee payments to experts.Firm finances: the firm's QuickBooks company file, VOID checks bearing signatures, expert-payment records, SaaS invoices.Medical photos and imaging; hundreds of pages of PHI/APF (Activity Prescription Forms) - X-rays, complete medical records.'Coaching' letters to doctors - including a letter to the physician in the Jachacy matter with wording indicative of steering a medical opinion ('coaching letter') - a potential ethics violation regarding witness handling.Credentials/access to the SPC e-file system (court e-filing).Disciplinary action against partner Daniel W. Gress. More |
||||||
| Ransomware | Anne Arundel County id33613 View details | United States | — | leaked | ||
|
Anne Arundel County Established in 1964, Anne Arundel County is a governmental body, consisting of numerous departments, services and sections all working together to serve the residents. This company is headquartered in Anne Arundel County, Maryland.814,500 files, 2.6 TB721 background-check dossiers with full SSNs in filenames, including 2026 records.Tens of thousands of medical faxes, 2022 to 2026, with patient names and diagnoses.Methadone clinic records under 42 CFR Part 2, the strictest US confidentiality regime.47,602 medical-assistance files with driver licenses, Green Cards, SSN cards, tax forms and bank data.County payroll registers with all salaries, HR memos, contracts, pension and discipline databases.Jail gang-intelligence files with a gang-member master list. More |
||||||
| Ransomware | RealManage id33602 View details | United States | — | leaked | ||
|
RealManage RealManage is a privately held, tech-enabled community association management company headquartered in Plano, Texas. Founded in 2002 and backed by American Securities, the company has grown into one of the largest and fastest-growing community association management firms in the United States, having been recognized on the Inc.1.84 TBThe tax, banking and debt secrets of hundreds of American HOAs and thousands of homeowners - complete with SSNs, account numbers and signatures.Genuine W-9 forms with Social Security numbers, addresses and signatures; IRS 1099-MISC/NEC e-file transmissions for 2014�2025 - thousands of vendor TINs/SSNsHomeowners' banking keys: ACH debit files with routing and account numbers, USAA brokerage statements, signed bank signature cardsPeople's debts by name: assessments through September 2026, bankruptcies, late-fee waivers, hardship letters from debtors begging for payment plansPersonal documents: HUD-1 home purchase settlements (names, prices, mortgages), signed waivers with addresses, HOA election ballots with voter namesFull SQL Server databases: RM_Warehouse, RM_Sales, RM_Portals, CiraNetIdentity (portal accounts), CiraBooks_GL (general ledger)Mail and document flow: CiraMail$, CiraDocs$, SalesDocs$ More |
||||||
| Ransomware | Skaff Group id33435 View details | Germany | Services | leaked | ||
|
Skaff Group SKAFF is a leader in Lebanon in the field of decorative fabrics. Files: 139,377Data volume: ~268 GB**Full HR dossiers - ~40 scans of Lebanese national ID cards (both sides + photos), a director's passport, civil-status extracts.Banking data - employee account files at Byblos Bank (named per person), Cedrus Bank corporate card program with banker contacts, account statements.Payroll violations - unpaid-salary analysis file, payroll module source code, staff leave requests.Employees' private lives - family photo archives on the work server.Commerce � price lists, Four Seasons and Les Galeries proposals, customs/export documents (Dubai, Erbil), customer claims. More |
||||||
| Ransomware | Mat Bao Corporation id33417 View details | Viet Nam | null | leaked | ||
|
Mat Bao Corporation Mat Bao Corporation offers a range of services including domain registration, cloud hosting, professional email solutions, and cloud server storage. Files: 746,108Data volume: 106.8 GBGovernment inspection materials - NEAC inspection decision No. 61/QD (29.04.2025) against the certification authority, working minutes naming state inspectors and company staff (through December 2025).Corporate core - GPKD business-registration documents bearing the owner's signature, shareholder records, tax commitments (January 2026).Personal data - national ID cards (CCCD) and employee passports with signatures, staff lists.Regulator correspondence - VNNIC, NEAC, the Government Cipher Committee (including RSA-1024 token vulnerabilities).Litigation and operations - the VINASEED dispute, internal investigations, operations-department mail. More |
||||||
| Ransomware | Electro Heat Sweden AB id33415 View details | Sweden | Manufacturing / Engineering | leaked | ||
|
Electro Heat Sweden AB ElectroHeat industrial furnaces are used in manufacturing industries all over the world.Files: 1,723,527Data volume: 2,55 TBAll intellectual property - SolidWorks CAD designs of every product, backups of the PDM drawing vault.All accounting and payroll - Visma databases and SPCS payroll databases of four legal entities.Legally sensitive material - confidential settlement agreement with ABB for a $75,000 payment, liquidated-damages dispute correspondence, cost-pricing calculations.Employee personal data - passport details, visa applications (passport, address, phone, DOB ), insurance policies.Contracts and acceptances - signed agreements and acceptance certificates with Hitachi, ABB, Scania and other customers. More |
||||||
| Ransomware | clicks digital GmbH Information id33334 View details | Germany | IT | leaked | ||
|
clicks digital GmbH Information With more than 40 employees, the agency manages national and international online projects of companies from a wide range of industries. Based in Berlin, Dresden, Munich and Cologne, has been a specialist in online marketing for more than twelve years. More |
||||||
| Ransomware | Law Offices of R. David Williams, P.A. id33331 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Law Offices of R. David Williams, P.A. Contents. A complete dossier of the firm's criminal defense practice covering ~175+ clients: felonies (an undercover sex sting involving a minor - Ramirez; domestic violence robbery - Valderrama, involving a 4-year-old child; felony DUI - Segula; fraud - B. Williams), a core caseload of ~10 DUI matters (including an arrest at breath readings of 0.011 and SCRAM alcohol monitoring), violations of probation (VOP), FDLE expungement packets with FD-258 fingerprint cards, a 'red flag' Risk Protection Order (RPO), 2 clients in ICE custody, and a material witness under GPS monitoring for 3+ years. Attorney fees range from $750 to $25,000. The case files include complete police discovery: ~206 GB of bodycam video, 911 recordings, and jail calls, incident reports, photo line-ups, FCIC/NCIC forms, and victim and witness data (Marsy's Law). More |
||||||
| Ransomware | NEAD Pro id33154 View details | — | null | leaked | ||
|
NEAD Pro Nead Pro is a professional multidisciplinary firm based in Gorizia and Udine, Italy, that provides legal, tax, bankruptcy, and accounting consulting services.What it is: a network share belonging to two Italian professional firms located at Via Roma 20, Gorizia (Friuli-Venezia Giulia):NEAD SRL (NORTH EAST ADVISORS S.R.L.) - an accounting firm, dottore commercialista, P.IVA 01114220310, REA GO-72906;NEAD PRO - PROFESSIONISTI RIUNITI - a law firm, P.IVA 01157140318.Volume: ~575,000 files / ~253 GB. The root contains a single branch Nuova directory\NEAD\ (plus an empty Documenti folder and a scatter of PDF scans at the root level).Structure and contents:Branch Volume ContentsNEAD PRO SITE - Documenti 231,137 files / 193.5 GB Law firm: 03.PRATICHE (46,620 files: CIVILE 9,665, PENALE 537, SOVRAINDEBITAMENTO 1,208), 04. INCARICHI (85,321: FALLIMENTI 22,492, ESECUZIONI 28,509, ADS 14,547, TRUST, CURATELE), SEGRETERIA with CREDENZIALI VARIE.xlsx (~40 firm accounts: SPID, PEC, banks, 2 cards with full PAN+CVC, safe code), bank scans (BANCOMAT PIN, BCC agreements)NEAD SRL SITE - Documenti 101,125 / 55.3 GB Accounting firm: 03.CLIENTI - 199 active + 184 former client folders (730, CU, F24, contracts), 44 private SOGEI Entratel .P12 keys (signing clients' tax returns), ISA/IRAP tax filings 2019�2020, client master data, Account.xlsxPRIMA NOTA - Documenti 1,885 / 871 MB Cash books 2019�2026 (21 xlsx): CASSA / CONTO CORRENTE / POS / CARTA / SISTERPOWERBI - Documenti 548 / 627 MB 37 financial BI models .pbix (BI_ISIDE, BI_NEAD, ATHENA, PNAI)ARCHIVIO 921 / 2.6 GB MPS bank statements 2020�2024, NEAD SRL account closure, firm mail archivePOSTA SARDAMAR / PANEGIOCHI / ISIDE / ADMIN SRL ~165+ / ~174 MB Client and firm mail: IVECO Capital leasing, accertamento Agenzia Entrate, Capitaneria di Porto, verbali poliziaES. IMM. 112-2024 10 files Real-estate enforcement proceedings (Tribunale di Gorizia): bank statements and CIE (ID cards) of auction participantsNEAD root ~85 PDF / 127 MB Scanned bank statements, F24 forms, IPZS envelope with the PIN/PUK of a CIE cardMost sensitive data: client dossiers with tax codes (codici fiscali), court case files (civil/criminal/bankruptcy), medical documents (Art. 9 GDPR), the firm's credential database with full PAN+CVC of two cards and the safe code, 52 Entratel electronic signature keys, ~100 SEPA mandates with IBANs and signatures, client PST archives (7.5 GB), a client's Huawei phone backup (Facebook/Gmail/Telegram databases), passports of foreign shareholders. More |
||||||
| Ransomware | Legis id33120 View details | — | null | pending | ||
|
Legis Legis is a well-known Latin American publisher that creates specialized legal and business information resources. Founded over 60 years ago, the company serves professionals across six countries including Colombia, Venezuela, Argentina, Mexico, Peru, and Chile.DATABASES (SQL)PST/OSTLEGAL DOCUMENTS:Tutela - constitutional actions with claimants' personal dataID card copies (cedulas) of shareholders and third partiesEnvironmental sanction proceedings against the company (AUTO 10852)Sanction dispute with the pension authority (UGPP)Signed cease & desist - trademark dispute (Xpandia case)Personal data transfer agreements (Colsubsidio, Universidad Externado)Litigation log of all company lawsuitsContract matrix, payment agreements, reorganization documentsFINANCE & OWNERSHIP:Shareholder and ultimate-beneficial-owner register with ID copiesOwnership structure: ~99.94% held by a single ownerDividend payment recordsDebt write-off letters naming debtors and amountsFinancial and tax reporting (exogena, estados financieros)CUSTOMERS:Customer databases: law firms, universities, government contractorsIncluding Ecopetrol, Halliburton, the AIM state agency, hundreds of companiesTax IDs (NIT), contacts, contract history More |
||||||
| Ransomware | Kreishandwerkerschaft Borken id32995 View details | Germany | Manufacturing / Engineering | — | pending | |
|
Kreishandwerkerschaft Borken |
||||||
| Ransomware | MPA Pharma id32966 View details | Germany | Healthcare / Pharma | leaked | ||
|
MPA Pharma MPA Pharma GmbH is an internationally active, rapidly growing company specializing in the import and trade of high-quality pharmaceuticals, including both patented and generic products. 2,899,290 files, ~5.8 TBPharmaceutical companyCategories: accounting records and database backups, government audits (customs / corporate tax / social security / wage tax),corporate ownership (nominee structure, beneficial-ownership filings, related-party payments), narcotics/BtM records (opioids, cannabis, precursors),litigation files, executive and employee personal data, IT artifacts, pharmacovigilance correspondence.Credit cards with CVV of executives, Oltersdorf ID card valid until 2030, the Pfeiffer letter on the hidden Paranova Pack B.V., UBO passportsSQL backups (17.7 million general-ledger rows), commercial register extract (HRB), organizational chartCredentials (TIER 1) - a list of all password files (values not repeated here, stored in the MPA PASSWORDS report)Government audits - customs 17,011.77 EUR with a breakdown, corporate tax +202,203.18 EUR, social security (DRV) 23,134.96 EUR with a separate case against the managing director, wage-tax auditNarcotics (BtM) - permits (318 04 74), reconciliations of 588 rows / 93 differences, fentanyl, hydromorphone, oxycodone, tapentadol, unexplained remainders of 1-13 units, documentation gap 2017-2020, cannabis up to 22 percent THC, precursorsLitigation - MSD/Merck memo, settlement agreement, Amgros judgment 5,180,043.09 DKK, complaint to the Ministry of Health, arbitration filingPeople, security, pharmacovigilance, bulk financial recordsArtifacts - leadership phone book, employee medical documents, Eli Lilly 2025, AstraZeneca, rebate contracts, a list of all produced reports More |
||||||
| Ransomware | Axdia International id32787 View details | United States | Manufacturing / Engineering | leaked | ||
|
Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More |
||||||
| Ransomware | General Santos Doctors Hospital id32743 View details | Philippines | Healthcare / Pharma | leaked | ||
|
General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals � accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance � audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data � personal cell numbers of the president, hospital administrator and board members More |
||||||
| Ransomware | Professional Retail Services id32744 View details | — | Retail / E-commerce | leaked | ||
|
Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate financials: owner�s personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More |
||||||
| Ransomware | SAD'S Interim id32674 View details | France | — | leaked | ||
|
SAD'S Interim Since 2000, SAD'S INTERIM has established itself as a key player in the temporary employment sector.Bank statements (relev�s) with SEPA credit transfersFactoring: invoice import batches, client receivables ledgers (encours) with EUR amounts and named clients, payment receipts (quittances)SQL backups of the BRANIPP ERP (the temp-workers payroll database)Payslips (bulletins de salaire) and payroll validation workbooksPermanent-staff employment contracts signed by the owners (Sadoun family)Temp-worker contracts, Pole Emploi attestationsPassports (EU and third-country nationals)CARTE BTP (construction-worker cards with photo and DOB)carte Vitale (health-insurance cards)RIB (bank account details)NIR (national insurance numbers)MDPH (disability recognition documents) More |
||||||
| Ransomware | Rug & Home id32647 View details | United States | Retail / E-commerce | leaked | ||
|
Rug & Home Rug & Home is a leading destination in the USA for rugs, furniture, and home decor, offering a vast selection of unique designs and top brands.Database of 50,193 customers�full names, home addresses, email addresses, phone numbers, purchase amounts (CSV)~10,800 scans�signed delivery notes with customer addresses/phone numbersPlaintext passwords for ~60 B2B supplier portalsW-2, 1099, W-9 � tax forms with employees' and contractors' SSNsPayroll database for all employees (Sage EMPLOYEE/ESWAGE)Company bank details (First Citizens Bank deposits) and employee accounts (direct deposit)HR: background checks, terminations, workplace injuries, 401(k)And much more More |
||||||
| Ransomware | Szechenyi Programiroda Nonprofit Kf id32406 View details | Hungary | NGOs / Associations | — | pending | |
|
Szechenyi Programiroda Nonprofit Kf |
||||||
| Ransomware | Valley Health Team id32236 View details | — | — | leaked | ||
|
Valley Health Team 9,056,196 files3.28 TBLarge SQL databases containing the clinic's entire lifetime of information.Major databases:160,870 patients4.18 million diagnoses7.6 million unencrypted EHR scansSSN, passports, and other personal data.Financial statements, salaries, taxes.Dear customers, please submit your requests�there are plenty of files here that can be monetized. More |
||||||
| Ransomware | Berlin, Germany id32233 View details | Germany | — | leaked | ||
|
Berlin, Germany Total capacity 5.79 TBArchive scale: ~1.44 million files scanned; by category � Maps/Geo 124,823, Legal/complaints 77,939, Financial 55,553, Contracts 46,522, HR 27,299,Government supervisory 13,142, Confidential 11,777, Infrastructure 8,110, Passwords 5,941, Health 2,738, Contacts 2,287.PII leak: 16,389 e-mails, 11,963 phone numbers, 12,076 individuals, 148 IBANs.Credentials in plaintext: Geb�udeAtlas, the ePayment PAYONE payment database, personal 'password safes' (danz, kramell � Z_ADMIN database accounts, franssen), leadership credentials.Disciplinary proceedings: the ANDERSON case (432 files, 2025�2026, lawsuit at VG Berlin administrative court), the politically motivated misconduct case involving the LKA Staatsschutz (state security police), the forestry cases BLAUTH/M�LLER/FIELICKE.State secrets: Bundesrat committee protocols with declassification correspondence, Geheimschutz (classified-material handling) data.Passports/IDs (recent, from personnel files and GI-Vertraulich).KRITIS: vulnerability analyses of Berlin's water supply.Mass personal data: Personalakten (personnel files) >5,000, Convotis payroll, OWi (administrative-offence) files >5,000, Postbuch SQL dumps 2020�2026, PST archives, leadership private data (IBANs, ID cards, Behrendt's bank card).NDA: 3,226 documentsLegal violation map (GDPR Art. 32/9/33, VSA/StGB upon VS classification confirmation, BSIG/KRITIS) More |
||||||
| Ransomware | CRI Electric id31956 View details | United States | — | leaked | ||
|
CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts** (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms** (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More |
||||||
| Ransomware | Coming soon id31965 View details | — | — | leaked | ||
|
Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More |
||||||
| Ransomware | Fairview Dental Group id31968 View details | United States | — | leaked | ||
|
Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More |
||||||
| Ransomware | Battle Creek Public Schools id31970 View details | United States | — | leaked | ||
|
Battle Creek Public Schools Battle Creek Public Schools in Nebraska provides educational services for students from pre-kindergarten through 12th grade. We are pleased to present:Student records of named minors:** IEP/special-ed files, disability determination notices, discipline/suspension records.Federal funds compliance trail (ESSA/Title I application), staff health-spending claims (payflex/EHA) More |
||||||
| Ransomware | Pierce Township id31710 View details | United States | Public Sector | leaked | ||
|
Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More |
||||||
| Ransomware | SIA Medical Centre id31666 View details | Australia | Healthcare / Pharma | pending | ||
|
SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patient medical records - names, dates of birth, Medicare numbers, clinical notes, insurance and work-cover files, full patient dossiersStaff identity documents - passports, driver's licenses, police checks, tax file declarations of doctors and employeesPlaintext credentials - logins and passwords for clinical systems (Synapse imaging, PRODA, terminal server, doctor accounts)HR records - signed employment contracts, staff incident reports, immunisation registersLegal & financial - subpoenas, complaints, Bupa contracts, bank details (BSB/ABN), provider payment forms More |
||||||
| Ransomware | Lawson Roofing id29977 View details | — | Construction / Real Estate | — | pending | |
|
Lawson Roofing |
||||||
| Ransomware | IDS Group id29519 View details | United States | Services | leaked | ||
|
IDS Group IDS Group is an award-winning multi-discipline design, engineering, and management consulting firm based in Southern California. More |
||||||
| Ransomware | Landeshauptstadt Stuttgart id29258 View details | Germany | Public Sector | — | pending | |
|
Landeshauptstadt Stuttgart Stuttgart is the capital city of Baden-Wurttemberg in southwestern Germany. |
||||||
| Ransomware | Tower View Primary School id29170 View details | United Kingdom | Education | — | pending | |
|
Tower View Primary School Tower View Primary School is an educational institution that serves approximately 380 pupils across 14 classes. |
||||||
| Ransomware | Stelia North America id28583 View details | United States | Manufacturing / Engineering | — | pending | |
|
Stelia North America |
||||||
| Ransomware | Southold Town Senior ServicesSouthold Police Department id26970 View details | — | Public Sector | — | pending | |
|
Southold Town Senior ServicesSouthold Police Department The Town of Southold, New York provides various government services including forms and permits, online payments, and notifications for residents. Southold Police Department is a company that operates in the Local industry. |
||||||
| Ransomware | Rohner id26735 View details | Switzerland | Manufacturing / Engineering | — | pending | |
|
Rohner Rohner designs and builds high-quality, custom paint booths and manufactured industrial paint systems. Our quality and service, cutting-edge technology, and engineering experience provide the best value in the finishing equipment industry. |
||||||
| Ransomware | Cheyenne & Arapaho Tribes id26632 View details | United States | Public Sector | — | pending | |
|
Cheyenne & Arapaho Tribes The Cheyenne and Arapaho Tribes are a federally recognized united nation of two distinct peoples-the Tsistsistas (Cheyenne) and Hinono'ei (Arapaho)-with a historic alliance formed in the early 19th century. |
||||||
| Ransomware | Phoenix Art Museum id26463 View details | United States | Other | — | pending | |
|
Phoenix Art Museum Phoenix Art Museum is an art museum that showcases art from around the U.S. in Phoenix, Arizona. |
||||||
| Ransomware | Leading Edge Speciali id26237 View details | — | Other | — | pending | |
|
Leading Edge Speciali |
||||||
| Ransomware | Lakeside Union School District id26102 View details | United States | Education | — | pending | |
|
Lakeside Union School District |
||||||
| Ransomware | Elabs id26075 View details | Sweden | Services | — | pending | |
|
Elabs Elabs is a pioneer in IT services in Germany, delivering innovative IT solutions that enable businesses to harness modern technology for added value and transformation. |
||||||
| Ransomware | MACT Health Board id25909 View details | United States | Healthcare / Pharma | — | pending | |
|
MACT Health Board |
||||||
| Ransomware | Cytek Biosciences id25762 View details | United States | Services | leaked | ||
|
Cytek Biosciences Cytek Biosciences is a leading cell analysis solutions company founded in 1992 and headquartered in Fremont, California with global offices across North America, Europe, and Asia. Sold 0% All data was sold, stay with us, we will upload new Companies later More |
||||||
| Ransomware | Jet-care International id25673 View details | Switzerland | Services | — | pending | |
|
Jet-care International |
||||||
| Ransomware | Charles Leonard Steel Services id25342 View details | United States | Manufacturing / Engineering | — | pending | |
|
Charles Leonard Steel Services |
||||||
| Ransomware | Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics id25222 View details | United States | Other | — | pending | |
|
Falk, Waas, Hernandez, Cortina, Solomon & Bonner Overview Metrics |
||||||
| Ransomware | Larry Pitt & Associates id24914 View details | United States | Other | — | pending | |
|
Larry Pitt & Associates |
||||||
| Ransomware | YOKOSUKA GAKUIN id24798 View details | Japan | Other | — | pending | |
|
YOKOSUKA GAKUIN |
||||||
| Ransomware | ***** *********** id24750 View details | — | Other | — | pending | |
|
***** *********** |
||||||
| Ransomware | United Keetoowah Band of Cherokee Indians in Oklahoma id24732 View details | United States | Other | — | pending | |
|
United Keetoowah Band of Cherokee Indians in Oklahoma |
||||||
| Ransomware | Woodard, Emhardt, Henry, Reeves & Wagner, LLP id24706 View details | United States | Other | — | pending | |
|
Woodard, Emhardt, Henry, Reeves & Wagner, LLP |
||||||
| Ransomware | Harbour Town Doctors id24698 View details | Australia | Healthcare / Pharma | — | pending | |
|
Harbour Town Doctors |
||||||
| Ransomware | Kane's Furniture id24533 View details | United States | Other | — | pending | |
|
Kane's Furniture |
||||||
| Ransomware | SODISE id24475 View details | France | Other | — | pending | |
|
SODISE |
||||||
| Ransomware | Bo Beuckman Ford id24407 View details | United States | Other | — | pending | |
|
Bo Beuckman Ford |
||||||
| Ransomware | Cleveland County Sheriff's Office id24363 View details | United States | Public Sector | — | pending | |
|
Cleveland County Sheriff's Office |
||||||
| Ransomware | AGS id24242 View details | — | Other | — | pending | |
|
AGS |
||||||
| Ransomware | Marlex Human Capital id24198 View details | Poland | Other | — | pending | |
|
Marlex Human Capital |
||||||
| Ransomware | Collge Superieur De Montreal id24172 View details | Canada | Other | — | pending | |
|
Collge Superieur De Montreal |
||||||
| Ransomware | St. Joseph's Healthcare Hamilton id24137 View details | Canada | Healthcare / Pharma | — | pending | |
|
St. Joseph's Healthcare Hamilton |
||||||
| Ransomware | Wachusett School District MA id24087 View details | United States | Education | pending | ||
|
Wachusett School District MA Wachusett School District MA is a public school district. More |
||||||
| Ransomware | Smoll & Banning, CPAs id23958 View details | United States | Finance / Legal / Insurance | — | pending | |
|
Smoll & Banning, CPAs Smoll & Banning, CPA's, LLC is an independent accounting firm located in Dodge City, Kansas. |
||||||
| Ransomware | Heart South Cardiovascular Group id23773 View details | United States | Communication / Marketing | pending | ||
|
Heart South Cardiovascular Group Heart South is a leading provider of comprehensive cardiac and vascular care in Central Alabama. More |
||||||
| Ransomware | LMHT Associates id23759 View details | United States | Other | — | pending | |
|
LMHT Associates |
||||||
| Ransomware | KISS FM id23620 View details | Spain | Communication / Marketing | — | pending | |
|
KISS FM Spanish radio station KISS FM, which broadcasts popular music and entertainment programs. The radio is available online, as well as traditionally on radio waves in Spain. The station is owned by the Spanish media group Mediaset Espana. |
||||||
| Ransomware | Automated Logistics Systems id23591 View details | United States | Transportation / Travel / Logistics | — | pending | |
|
Automated Logistics Systems |
||||||
| Ransomware | Invacare id23587 View details | United States | Healthcare / Pharma | pending | ||
|
Invacare Invacare, founded in 1885 and headquartered out of Elyria, Ohio, is a manufacturer and distributor of home and long term care medical products. More |
||||||
| Ransomware | Spindletop Center id23500 View details | United States | Healthcare / Pharma | — | pending | |
|
Spindletop Center Spindletop Center is a non-profit healthcare organization focused on providing behavioral healthcare, as well as programs for individuals with intellectual and developmental disabilities and substance use recovery services. Over 100,000 patient records (address, phone number, passport number, social security number, diagnosis, medical history, etc.) |
||||||
| Ransomware | Gemini Group id23449 View details | United States | Services | — | pending | |
|
Gemini Group |
||||||
| Ransomware | Bellflower Unified School District id23424 View details | United States | Education | pending | ||
|
Bellflower Unified School District Headquartered Bellflower, California, Bellflower Unified School District is a general education district that offers K-12 classes. More |
||||||
| Ransomware | Abilene Family Medical Associates id23390 View details | United States | Healthcare / Pharma | — | pending | |
|
Abilene Family Medical Associates |
||||||
| Ransomware | Peraso id23267 View details | Canada | Other | — | pending | |
|
Peraso |
||||||
| Ransomware | Hematology Oncology Consultants id23182 View details | United States | Communication / Marketing | — | pending | |
|
Hematology Oncology Consultants Michigan Hematology Oncology is a private practice dedicated to providing the highest level of quality care in a healing environment for the mind, body and spirit of patients dealing with cancer and blood disorders. |
||||||
| Ransomware | GEIGER id23164 View details | Germany | Communication / Marketing | — | pending | |
|
GEIGER GEIGER Antriebstechnik is a leading manufacturer of innovative mechanical and electric drive solutions for sun protection products such as blinds, awnings, and shutters, employing over 250 staff. |
||||||
| Ransomware | Sibbalds id23144 View details | United Kingdom | Services | pending | ||
|
Sibbalds Sibbalds Chartered Accountants, based in Derby, specializes in providing a wide range of accountancy services to owner-managed businesses across England. More |
||||||
| Ransomware | Tex-Tube id23135 View details | United States | Manufacturing / Engineering | — | pending | |
|
Tex-Tube Tex Tube has over 75 years of experience in manufacturing steel products, specifically electric resistance welded (ERW) steel pipes, adhering to API and ASTM specifications. Serving the North American continent, the company produces tubular steel products that meet both API and ASTM standards. |
||||||
| Ransomware | Furuno Electric id23013 View details | Japan | Communication / Marketing | — | pending | |
|
Furuno Electric FURUNO strives to contribute to realisation of the pleasant society filled with safety and peace of mind by giving visual form to that previously invisible, such as underwater condition, situation around ships, accurate time, people's physical conditions, etc. |
||||||
| Ransomware | Sdii Global id22921 View details | United States | Manufacturing / Engineering | — | pending | |
|
Sdii Global Since 1989, Sdii Global has set the standard in forensic engineering and consulting, renowned for our expertise and unwavering commitment to excellence. |
||||||
| Ransomware | JASCO Applied Sciences id22865 View details | Canada | Other | — | pending | |
|
JASCO Applied Sciences |
||||||
| Ransomware | Medstar Health id22805 View details | United States | Healthcare / Pharma | — | pending | |
|
Medstar Health |
||||||
| Ransomware | Peavey Electronics Corporation id22650 View details | United States | Communication / Marketing | — | pending | |
|
Peavey Electronics Corporation Founded by Hartley Peavey in 1965 as a one-man shop, today Peavey Electronics Corporation is one of the largest makers and suppliers of musical instruments, amplifiers and professional audio systems in the world-distributing more than 2,000 products to more than 130 countries. |
||||||
| Ransomware | The Maryland Department of Transportation id22562 View details | United States | Transportation / Travel / Logistics | — | pending | |
|
The Maryland Department of Transportation |
||||||
| Ransomware | Coastal Pacific Xpress id22251 View details | Canada | Communication / Marketing | — | pending | |
|
Coastal Pacific Xpress |
||||||
| Ransomware | Elite Trailers id22141 View details | United States | Manufacturing / Engineering | — | pending | |
|
Elite Trailers Elite Trailer MFG, LLC. specializes in the custom manufacturing of high-quality trailers, including horse, livestock, and specialty models. |
||||||
| Ransomware | Firelands Scientific id21997 View details | United States | Other | pending | ||
|
Firelands Scientific |
||||||
| Ransomware | ZCORP id21984 View details | United States | Communication / Marketing | — | pending | |
|
ZCORP ZCORP is a technology enterprise based in Princeton, NJ, specializing in providing innovative products, services, and tools to help clients navigate the challenges of a rapidly evolving marketplace. |
||||||
| Ransomware | Elkhart Independent School District id21866 View details | United States | Education | pending | ||
|
Elkhart Independent School District Elkhart Independent School District is a public school district based in Elkhart, Texas (USA). The district is located in southwest Anderson County and extends into northern Houston County. More |
||||||
| Ransomware | Trans-Tex id21699 View details | Poland | Communication / Marketing | — | pending | |
|
Trans-Tex Trans-Tex has been the leader in narrow web dye sublimation printing for over 25 years. |
||||||
| Ransomware | Alascom id21659 View details | Italy | Telecommunications | pending | ||
|
Alascom It has been operating for over 20 years as a system integrator and supplier of technical consulting services in the ICT and industrial automation sector with a fundamental knowledge of telecommunication networks and IP technologies. |
||||||
| Ransomware | Cookeville Regional Medical Center id21658 View details | United States | Healthcare / Pharma | pending | ||
|
Cookeville Regional Medical Center At Cookeville Regional Medical Center, we are dedicated to providing the highest quality care to our patients and making a positive impact on our community. |
||||||
| Ransomware | First Baptist Church of Hammond id21657 View details | United States | Other | pending | ||
|
First Baptist Church of Hammond Established in 1887, The First Baptist Church was listed as 2009's 12th largest church in America in Outreach magazine. |
||||||