Ransomware Group intelligence
Safepay
ActiveTrack Safepay with 595 published victims and 5 known leak locations in a single intelligence view.
DARK EYE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Safepay is tracked by Dark Eye as a ransomware group with 595 published victims.
United States is currently the most targeted country in this dataset.
5 known leak locations are currently associated with this group.
Leak Status Distribution
595
- Leaked 153 25.7%
- Pending 440 73.9%
- Deleted 2 0.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (5)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 5 | Onion service | Up checked 25m ago | safepaypfxntwixwjrlcscft433ggemlhgkkdupi2ynhtcmvdgubmoyd.onion |
| Leak location 2 | Onion service | Down checked 25m ago | cqkrkmmivhakl3fwgxscurduu3znmroablt7jskxszkctixyseij5gad.onion |
| Leak location 4 | Onion service | Down checked 26m ago | j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion |
| Leak location 3 | Onion service | Down checked 26m ago | nj5qix45sxnl4h4og6hcgwengg2oqloj3c2rhc6dpwiofx3jbivcs6qd.onion |
| Leak location 1 | Onion service | Down checked 26m ago | nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion |
Top Activity Sectors (17)
- Not identified 146
- Communication / Marketing 94
- Manufacturing / Engineering 60
- Services 43
- IT 36
- Construction / Real Estate 31
- Healthcare / Pharma 29
- Finance / Legal / Insurance 27
- Retail / E-commerce 25
- Education 25
- Agriculture / Food 17
- Public Sector 14
- Transportation / Travel / Logistics 14
- Hospitality / Food & Beverage / Tourism 13
- NGOs / Associations 10
- Energy 4
- null 1
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Safepay, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: safepay executes PowerShell scripts to run payload logic, disable defenses, and stage ransomware components.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: safepay uses registry run keys and startup folders to maintain persistence after reboot.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: safepay disables or modifies security tools such as antivirus and monitoring agents to prevent detection and cleanup.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1688 Safe Mode Boot Defense Impairment
What they do: safepay attempts safe mode boot manipulation to disrupt recovery workflows and evade host-based defenses.
What that means: Adversaries may abuse Windows safe mode to disable endpoint defenses.
-
T1027.016 Junk Code Insertion Stealth
What they do: safepay inserts junk code into binaries to evade static analysis and signature-based detection.
What that means: Adversaries may use junk code / dead code to obfuscate a malware’s functionality.
-
T1070.004 File Deletion Stealth
What they do: safepay deletes Volume Shadow Copies and temporary files to eliminate recovery options and reduce forensic traces.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1135 Network Share Discovery Discovery
What they do: safepay uses network share discovery to locate victim file shares and staging directories for encryption targets.
What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: safepay moves laterally through SMB/Windows Admin Shares to encrypt additional systems across the network.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: safepay encrypts victim files and backups using its ransomware payload to maximize impact and extortion leverage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1491.001 Internal Defacement Impact
What they do: safepay performs internal defacement by replacing or corrupting victim files to demonstrate impact and pressure victims.
What that means: An adversary may deface systems internal to an organization in an attempt to intimidate or mislead users, thus discrediting the integrity of the systems.
Tools Observed (8)
▼Software Safepay has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.
Discovery
Invoke-ShareFinder
Exfiltration
FileZilla
7zip
WinRAR
LOLBAS (living-off-the-land binaries)
Regsvr32.exe
CMSTPLUA
dllhost.exe
RMM Tools
Microsoft RDP
Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Dark Eye.
Ransom Notes (2)
▼The note this group leaves on a compromised machine. Click a filename to read it.
readme_safepay.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
readme_safepay_ascii.txt
Greetings! Your corporate network was attacked by SafePay team. Your IT specialists made a number of mistakes in setting up the security of your corporate network, so we were able to spend quite a long period of time in it and compromise you. It was the misconfiguration of your network that allowed our experts to attack you, so treat this situation as simply as a paid training session for your system administrators. We ve spent the time analyzing your data, including all the sensitive and confidential information. As a result, all files of importance have been encrypted and the ones of most interest to us have been stolen and are now stored on a secure server for further exploitation and publication on the Web with an open access. Now we are in possession of your files such as: financial statements, intellectual property, accounting records, lawsuits and complaints, personnel and customer files, as well as files containing information on bank details, transactions and other internal documentation. Furthermore we successfully blocked most of the servers that are of vital importance to you, however upon reaching an agreement, we will unlock them as soon as possible and your employees will be able to resume their daily duties. We are suggesting a mutually beneficial solution to that issue. You submit a payment to us and we keep the fact that your network has been compromised a secret, delete all your data and provide you with the key to decrypt all your data. WE ARE THE ONES WHO CAN CORRECTLY DECRYPT YOUR DATA AND RESTORE YOUR INFRASTRUCTURE IN A SHORT TIME. DO NOT TRY TO DECRYPT YOUR FILES YOURSELF, YOU WILL NOT BE ABLE TO DO THIS, YOU WILL ONLY DAMAGE THEM AND WE WILL NOT BE ABLE TO RESTORE THEM. In the event of an agreement, our reputation is a guarantee that all conditions will be fulfilled. No one will ever negotiate with us later on if we don't fulfill our part and we recognise that clearly! We are not a politically motivated group and want nothing more than money. Provided you pay, we will honour all the terms we agreed to during the negotiation process. In order to contact us, please use chat below, you have 10 days to contact us, after this time a blog post will be made with a timer for 3 days before the data is published and you will no longer be able to contact us. To contact us follow the instructions: Install and run Tor Browser from https://www.torproject.org/download/ Go to http://dgcg5ncjab6scb7fnk7gx5php4lbpxjy2jjnu3apnkxyippqf6yhw3ad.onion Reserve Link: http://oxly5vxvvhi5fv5vsvj3kvlqeprbijitycqisylaxzf324bn7e4qr2ad.onion Log in with ID: [snip] Contact and wait for a reply, we guarantee that we will reply as soon as possible, and we will explain everything to you once again in more detail. Our blog: http://j3dp6okmaklajrsk6zljl5sfa2vpui7j2w6cwmhmmqhab6frdfbphhid.onion http://nz4z6ruzcekriti5cjjiiylzvrmysyqwibxztk6voem4trtx7gstpjid.onion Our TON blog: tonsite://safepay.ton You can connect through your Telegramm account.
Ransom-note text from RansomLook, licensed CC BY 4.0.
Victims (595)
Search, filter and paginate the victim timeline for Safepay. Showing 201–300 of 595.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | pellcityschools.net id25034 View details | United States | Education | pending | ||
|
Pell City Schools is a public K-12 school district based in Pell City, Alabama, serving students from pre-kindergarten through 12th … |
||||||
| Ransomware | rogitz.com id24953 View details | United States | Communication / Marketing | pending | ||
|
Rogitz & Associates was a small intellectual property law firm based in San Diego, California, specialising in patent prosecution, patent … |
||||||
| Ransomware | reger-zahntechnik.de id24952 View details | Germany | IT | pending | ||
|
Reger Zahntechnik, formally registered in Nuremberg (Nürnberg), Germany as Walter Reger Zahntechnisches Labor GmbH, is a traditional dental laboratory specialising … |
||||||
| Ransomware | springersjewelers.com id24951 View details | United States | Communication / Marketing | pending | ||
|
Springer’s Jewelers is a historic family-owned jewelry retailer based in Portland, Maine, with additional store locations in Bath, Maine and … |
||||||
| Ransomware | dfcsystems.de id24950 View details | Germany | IT | pending | ||
|
DFC-SYSTEMS GmbH is a German software and technology company headquartered in Munich that specialises in clinical documentation and digital workflow … |
||||||
| Ransomware | kenalex.ca id24949 View details | Canada | Construction / Real Estate | leaked | ||
|
Kenalex Construction Co. Ltd. is a Canadian construction and development firm headquartered in North Bay, Ontario, serving Central and Northern … |
||||||
| Ransomware | meyer-lift.de id24948 View details | Germany | Other | pending | ||
|
Meyer Lift GmbH is a German equipment rental company headquartered in Hohenwestedt, northern Germany. It specialises in the rental and … |
||||||
| Ransomware | coloradopowerline.com id24947 View details | United States | Energy | pending | ||
|
Colorado Powerline, Inc. (often abbreviated CPI) is a U.S. electrical infrastructure construction company headquartered in Sedalia, Colorado. Founded in 2006, … |
||||||
| Ransomware | peus-muenzen.de id24946 View details | Germany | Communication / Marketing | pending | ||
|
Peus Münzen, officially Dr. Busso Peus Nachfolger e.K., is one of Germany’s oldest and most prestigious coin dealers and numismatic … |
||||||
| Ransomware | capsum.com id24945 View details | United States | Communication / Marketing | leaked | ||
|
Capsum is a global beauty and cosmetics contract manufacturer that specialises in microfluidic technology, a patented scientific process that allows … |
||||||
| Ransomware | seguriamericas.com id24872 View details | Colombia | Retail / E-commerce | pending | ||
|
SeguriAmericas, formally known as Seguridad Las Americas Ltda, is a Colombian company specialising in private security and investigation services. Founded … |
||||||
| Ransomware | smilecenterutah.com id24871 View details | United States | Communication / Marketing | pending | ||
|
Smile Center Utah is a private dental practice located in Provo, Utah, providing comprehensive oral healthcare services to patients of … |
||||||
| Ransomware | silverlinegroupinc.com id24870 View details | Canada | Construction / Real Estate | pending | ||
|
Silverline Group Inc. is a Canadian construction and civil contracting firm based in St. Catharines, Ontario. It operates in the … |
||||||
| Ransomware | notar-gerresheim.de id24869 View details | Germany | Communication / Marketing | pending | ||
|
Notare Dr. Heinrich & Dr. Berg is a private notary office located in the Gerresheim district of Düsseldorf, Germany. The … |
||||||
| Ransomware | artcitydental.com id24868 View details | United States | Healthcare / Pharma | pending | ||
|
Art City Dental is a family-oriented dental clinic located in Springville, Utah, within the United States. The practice provides a … |
||||||
| Ransomware | gandlmechanical.com id24867 View details | United States | Construction / Real Estate | leaked | ||
|
G & L Mechanical Contractor, L.P. is a regional mechanical contracting firm based in Grapevine, Texas, and has been operating … |
||||||
| Ransomware | zimeda.eu id24866 View details | Germany | Healthcare / Pharma | pending | ||
|
Zimeda GmbH & Co. KG is a German medical technology and healthcare supplier headquartered in Passau, Bavaria. The firm operates … |
||||||
| Ransomware | aspenviewacademy.org id24828 View details | United States | Education | pending | ||
|
Aspen View Academy is a charter school located in Castle Rock, Colorado, serving students from pre-kindergarten through 8th grade. Founded … |
||||||
| Ransomware | feldmanandlopez.com id24827 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Feldman & Lopez, P.A. is a law firm based in Miami, Florida, that specialises in property insurance law and related … |
||||||
| Ransomware | hoodriverdentist.com id24826 View details | United States | Healthcare / Pharma | pending | ||
|
Hood River Dental is a private dental practice located in Hood River, Oregon, providing comprehensive oral healthcare services to individuals … |
||||||
| Ransomware | seeberger-appel.de id24825 View details | Germany | Finance / Legal / Insurance | pending | ||
|
Seeberger Appel is a German law firm specialising in commercial law, corporate law, employment law, and civil litigation, with a … |
||||||
| Ransomware | stadtwerke-clausthal.de id24824 View details | Germany | Public Sector | pending | ||
|
Stadtwerke Clausthal-Zellerfeld is a municipal utility company (Stadtwerk) serving the town of Clausthal-Zellerfeld in Lower Saxony, Germany. As a publicly … |
||||||
| Ransomware | autohaus-paschke.de id24823 View details | Germany | Communication / Marketing | pending | ||
|
Autohaus Paschke is a German automobile dealership and automotive service provider that operates primarily in the regional car retail and … |
||||||
| Ransomware | ernst-auto.de id24822 View details | Germany | Manufacturing / Engineering | leaked | ||
|
Ernst Autohaus is a German automotive dealership and service company operating in the regional vehicle retail market. The business is … |
||||||
| Ransomware | teccart.qc.ca id24772 View details | Canada | Services | pending | ||
|
Founded in 1945, the institution has a long history of delivering practical, career-focused education in technology, design, business, management, arts, … |
||||||
| Ransomware | sbws.org.sg id24771 View details | Singapore | Services | pending | ||
|
Singapore Buddhist Welfare Services (SBWS) is a well-established voluntary welfare organisation (VWO) in Singapore that focuses on holistic, community-based support … |
||||||
| Ransomware | fest-group.de id24770 View details | Germany | Manufacturing / Engineering | leaked | ||
|
FEST Group is a German engineering and industrial technology company headquartered in Goslar. It specialises in advanced automation, electrification and … |
||||||
| Ransomware | lampus.com id24769 View details | United States | Construction / Real Estate | pending | ||
|
R.I. Lampus Company, operating the domain Lampus.com, is a long-established American manufacturer and distributor in the building materials industry. Founded … |
||||||
| Ransomware | inttrust.gr id24768 View details | Greece | IT | pending | ||
|
InTTrust S.A. is a Greek information technology and consulting firm headquartered in Agia Paraskevi, Athens. Founded in 2006, the company … |
||||||
| Ransomware | aysa.com.ar id24767 View details | Argentina | Retail / E-commerce | leaked | ||
|
AYSA, formally known as Agua y Saneamientos Argentinos Sociedad Anónima, is Argentina’s largest state-owned water and sanitation utility, responsible for … |
||||||
| Ransomware | chemstress.com id24645 View details | United States | Communication / Marketing | pending | ||
|
Since its founding in 1965, the company has combined in-house disciplines — process, mechanical, piping, structural, instrumentation, electrical, and architectural … |
||||||
| Ransomware | mmc.de id24464 View details | Germany | Communication / Marketing | pending | ||
|
MMC Studios is a major German media-production and facility company headquartered in Cologne. The firm operates one of Germany’s leading … |
||||||
| Ransomware | juliuskoch.com id24463 View details | Germany | Construction / Real Estate | leaked | ||
|
Julius Koch GmbH is a historic German company founded in 1895 that specialises in the development and manufacture of high-performance … |
||||||
| Ransomware | untereisesheim.de id24462 View details | Germany | Public Sector | pending | ||
|
Untereisesheim is a small municipality in the district of Heilbronn in the federal state of Baden-Württemberg, southwestern Germany. It is … |
||||||
| Ransomware | steuerberater-scheerer.de id24461 View details | Germany | Finance / Legal / Insurance | pending | ||
|
Steuerberater-Scheerer (operating as C. M. Scheerer GmbH) is a German tax-consulting and auditing firm based in Schweinfurt, Bavaria. The practice … |
||||||
| Ransomware | mactavishco.ca id24460 View details | Canada | Retail / E-commerce | pending | ||
|
MacTavish & Co. is a small Canadian boutique retailer located in Medicine Hat, Alberta, specializing in curated home décor, gifts, … |
||||||
| Ransomware | barnet.com.au id24459 View details | Australia | Hospitality / Food & Beverage / Tourism | pending | ||
|
BarNet is an Australian specialist communications management organisation focused on serving legal professionals, particularly barristers and associated legal chambers. Founded … |
||||||
| Ransomware | wachtmann.eu id24457 View details | Germany | Retail / E-commerce | pending | ||
|
Specializing in consumer goods distributed online via a web store. The business model is typical for small e-commerce firms: sourcing … |
||||||
| Ransomware | becksgroup.au id24456 View details | Australia | Manufacturing / Engineering | pending | ||
|
Family-owned Australian company established in 1976 that operates within the luxury goods and jewellery industry, focusing on precious metals and … |
||||||
| Ransomware | hyperdomemedicalcentre.com.au id24455 View details | Australia | Healthcare / Pharma | leaked | ||
|
Hyperdome Medical Centre is a general practice clinic located in the South.Point shopping centre in Greenway, Tuggeranong, within the Australian … |
||||||
| Ransomware | dynamichomerepair.com id24176 View details | United States | Services | pending | ||
|
Dynamic Home Repair is a U.S.-based company specializing in repair services for manufactured homes. It offers a “lifetime warranty” on … |
||||||
| Ransomware | rehmann.de id24175 View details | Germany | Retail / E-commerce | pending | ||
|
Furniture-retail company in Velbert, Germany, operating a furniture house and a high-end studio for home furnishings. This company is mid-sized, … |
||||||
| Ransomware | istitutocomprensivo-cavaglia.edu.it id23984 View details | Italy | Communication / Marketing | pending | ||
|
Istituto Comprensivo di Cavaglià is a public school district in the Biella province of the Piedmont region, serving students from … |
||||||
| Ransomware | puertoricowarehousing.com id23983 View details | United States | Construction / Real Estate | pending | ||
|
Puerto Rico Warehousing Management Corp. is a logistics and storage company based in Carolina, Puerto Rico. It operates a modern … |
||||||
| Ransomware | adesursas.com id23982 View details | Colombia | Agriculture / Food | pending | ||
|
Adesur SAS is a Colombian company based in Pasto, Nariño, that operates in the wholesale distribution of agricultural and veterinary … |
||||||
| Ransomware | aussenwelten.ch id23981 View details | Switzerland | Other | leaked | ||
|
Zuber Aussenwelten AG is a Swiss company based in Domat/Ems (Graubünden), operating in the garden design and outdoor-living sector. The … |
||||||
| Ransomware | simmonsbb.com id23980 View details | Barbados | Hospitality / Food & Beverage / Tourism | pending | ||
|
Simmons Electrical Co. Ltd. is a well-established Barbadian electrical contracting firm headquartered in St. Philip. The company specializes in a … |
||||||
| Ransomware | killinglyschools.org id23907 View details | United States | Education | pending | ||
|
Killingly Public Schools is a K-12 public school district based in Danielson, Connecticut, serving students in the town of Killingly. … |
||||||
| Ransomware | confortchem.com & rogitex.com id23845 View details | Canada | Manufacturing / Engineering | pending | ||
|
ConfortChem Inc. is a Canada-based distributor and technical partner specializing in raw materials and machinery for the polyurethane foam industry. … |
||||||
| Ransomware | doversd.org id23826 View details | United States | Education | pending | ||
|
Dover City Schools is a public K-12 school district located in Dover, Ohio, serving approximately 2,650 students across multiple schools. … |
||||||
| Ransomware | glendaleobgyn.com id23807 View details | United States | Healthcare / Pharma | leaked | ||
|
Glendale OBGYN (an obstetrics and gynecology practice) would likely operate as a mid-sized women’s health clinic in Glendale, California, offering … |
||||||
| Ransomware | himmelstein.com id23785 View details | United States | Construction / Real Estate | pending | ||
|
S. Himmelstein & Company is a U.S.-based specialist manufacturer founded in 1960, headquartered in Hoffman Estates, Illinois. The company focuses … |
||||||
| Ransomware | ielplumbing.com id23774 View details | Canada | Construction / Real Estate | leaked | ||
|
I.E. Plumbing Services is a privately-held plumbing contractor based in Southern California, operating from two locations in the Riverside / … |
||||||
| Ransomware | mcintoshlabs.com id23613 View details | United States | Other | pending | ||
|
McIntosh Laboratory is an iconic American company, founded in 1949 and headquartered in Binghamton, New York. It specializes in high-end, … |
||||||
| Ransomware | holtzofficesupport.com id23535 View details | Germany | Services | leaked | ||
|
Holtz Office Support GmbH is a family-owned, medium-sized German company headquartered in Wiesbaden, founded in 1956. The company specializes in … |
||||||
| Ransomware | constructiondprovost.com id23336 View details | Canada | Construction / Real Estate | leaked | ||
|
Construction Donald Provost is a regional general contracting firm established in Mont-Tremblant that specialises in high-quality residential and light-commercial construction, … |
||||||
| Ransomware | xortec.de id23335 View details | Germany | Services | pending | ||
|
Xortec GmbH is a German value-added distributor and systems integrator for professional video surveillance, IP network infrastructure and security-tech solutions. … |
||||||
| Ransomware | mino-in.co.jp id23334 View details | Japan | Communication / Marketing | pending | ||
|
MINO Group is a long-established Japanese manufacturer (founded 1946) that designs and builds screen-printing machines, stencil makers, dryers, printing accessories … |
||||||
| Ransomware | bannenbergandrowell.com id23333 View details | United Kingdom | Other | pending | ||
|
Bannenberg & Rowell is a luxury studio specialising in superyacht exterior and interior design, founded as the direct successor to … |
||||||
| Ransomware | greenhouseapt.com id23332 View details | United States | Construction / Real Estate | pending | ||
|
The Greenhouse is an apartment building and management/letting operation in Boston’s Back Bay / South End that offers 1–3 bedroom … |
||||||
| Ransomware | healthandvitalitycenter.com id23220 View details | United States | Healthcare / Pharma | leaked | ||
|
The Health & Vitality Center is a holistic medical practice located at 11600 Wilshire Blvd, Suite 120, Los Angeles, CA. … |
||||||
| Ransomware | empirico-mr.com id22960 View details | United States | Other | leaked | ||
|
Empirico Research is a boutique global market-research and data-collection firm founded around 2016. The company combines online panels, telephone interviewing … |
||||||
| Ransomware | tango-hotel.com.ar id22959 View details | Argentina | NGOs / Associations | pending | ||
|
The Argentina Tango Hotel (often listed as Tango de Mayo / Argentina Tango in booking platforms) is a boutique city … |
||||||
| Ransomware | bridgenetcommunicationsrgv.com id22958 View details | United States | Communication / Marketing | leaked | ||
|
BridgeNet Communications is a regional low-voltage and structured-cabling specialist serving the Rio Grande Valley and parts of Central Texas. The … |
||||||
| Ransomware | krne.com id22957 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Krne Law Firm a small to mid-size private legal practice, perhaps specializing in general civil law, real estate, business contracts, … |
||||||
| Ransomware | glatten.de id22956 View details | Germany | Manufacturing / Engineering | leaked | ||
|
Located in Glatten, J. Schmalz GmbH is a long-established, family-run engineering group specialising in vacuum technology and automation for handling … |
||||||
| Ransomware | portofuneralhomes.net id22955 View details | United States | Public Sector | pending | ||
|
Porto Funeral Homes (Porto / Porto Funeral Home) operates funeral and memorial services in New Haven County, Connecticut, with facilities … |
||||||
| Ransomware | ggw.net id22954 View details | Canada | Finance / Legal / Insurance | leaked | ||
|
Glenn Graydon Wright LLP (GGW) is an established Oakville, Ontario accounting and advisory firm (founded 1958) that provides assurance, tax, … |
||||||
| Ransomware | cmlmachinery.com id22953 View details | Canada | Manufacturing / Engineering | leaked | ||
|
CML Machinery is a Canadian distributor and supplier of metal-forming and woodworking equipment — press brakes, shears, tube benders, CNC … |
||||||
| Ransomware | browneco.com id22462 View details | United States | Agriculture / Food | leaked | ||
|
Browne (Browne Group Inc.) is a legacy kitchenware and foodservice products designer and distributor with a multi-decade history (70+ years) … |
||||||
| Ransomware | alliancesteelco.com id22461 View details | United States | Manufacturing / Engineering | leaked | ||
|
“Alliance Steel” is a generic trade name used by multiple flat-rolled steel service centers in North America; relevant examples include … |
||||||
| Ransomware | slusarski.com id22460 View details | United States | Construction / Real Estate | leaked | ||
|
Slusarski is a Michigan-based sitework, earthmoving and paving contractor founded in 1982 that provides excavation, asphalt paving, sealcoating, striping, materials … |
||||||
| Ransomware | drcloudemr.com id22459 View details | United States | IT | leaked | ||
|
DrCloudEHR (often referenced as DrCloud/DrCloudEMR) provides cloud-hosted electronic health record (EHR) / practice management software targeted at ambulatory clinics and … |
||||||
| Ransomware | venetianassociates.com id22458 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Venetian Associates is a private family-office style investment vehicle and lower-middle-market acquirer based in Michigan that focuses on buying consumer … |
||||||
| Ransomware | armourhome.co.uk id22457 View details | United Kingdom | Services | leaked | ||
|
Armour Home is a UK-based designer, manufacturer and distributor of hi-fi, home-cinema and multi-room audio furniture and electronic solutions. The … |
||||||
| Ransomware | biosorthopedics.com id22456 View details | United States | Communication / Marketing | leaked | ||
|
Broward Institute of Orthopaedic Specialties (BIOS) is a multi-physician orthopaedic practice headquartered in Hollywood and Pembroke Pines, Florida. The practice … |
||||||
| Ransomware | gosheating.co.uk id22455 View details | United Kingdom | Construction / Real Estate | leaked | ||
|
GOS Heating is a long-standing, family-run heating, plumbing and electrical contractor based in Preston, Lancashire. The company markets domestic and … |
||||||
| Ransomware | halbarstainless.com id22314 View details | Canada | Hospitality / Food & Beverage / Tourism | leaked | ||
|
Halbar Stainless Products Ltd., founded in 1974 by Cliff Baird, is a family-owned custom metal fabrication company specializing in stainless … |
||||||
| Ransomware | cityofmiddletown.org id22313 View details | United States | Public Sector | leaked | ||
|
The City of Middletown, located in Ohio, United States, operates as a municipal government dedicated to providing essential services and … |
||||||
| Ransomware | osdcourtks.org id22312 View details | United States | Public Sector | leaked | ||
|
The domain osdcourtks.org appears to belong to the Osage County District Court in Kansas. As part of Kansas’s Fourth Judicial … |
||||||
| Ransomware | waverlychildcare.org id22263 View details | United States | Communication / Marketing | leaked | ||
|
Waverly Child Care & Preschool is a nonprofit early childhood education provider based in Waverly, Iowa, established in 1970. It … |
||||||
| Ransomware | bthcpa.com id22082 View details | United States | Finance / Legal / Insurance | leaked | ||
|
BTH CPA is a professional accounting and advisory firm based in the United States, offering a full range of financial … |
||||||
| Ransomware | kclub.ie id22081 View details | Ireland | Hospitality / Food & Beverage / Tourism | leaked | ||
|
The K Club is a luxury resort and golf destination located in County Kildare, Ireland. Known for its five-star accommodations, … |
||||||
| Ransomware | usai.io id22080 View details | United States | IT | leaked | ||
|
USAI is a U.S.-based artificial intelligence and technology solutions provider. The company develops AI-driven platforms and software designed to optimize … |
||||||
| Ransomware | wilsonatllaw.com id22079 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Wilson AT Law is a U.S.-based legal practice specializing in areas such as personal injury, family law, estate planning, and … |
||||||
| Ransomware | scottschiff.com id22078 View details | United States | Finance / Legal / Insurance | leaked | ||
|
Scott Schiff & Associates is a U.S.-based law firm located in Columbus, Ohio, with a specialization in personal injury and … |
||||||
| Ransomware | mdneal.com id22077 View details | United States | Manufacturing / Engineering | pending | ||
|
M.D. Neal Engineering is an American engineering consulting company specializing in structural engineering, design, and project management. The firm provides … |
||||||
| Ransomware | umweltprofis.at id22074 View details | Austria | Communication / Marketing | leaked | ||
|
Umweltprofis is an Austrian company specializing in environmental management, waste disposal, and recycling solutions. It provides sustainable services for municipalities, … |
||||||
| Ransomware | waterfordsurgicalcenter.com id22073 View details | United States | Healthcare / Pharma | leaked | ||
|
Waterford Surgical Center is a specialized healthcare facility in the United States dedicated to outpatient surgical care. The center provides … |
||||||
| Ransomware | oiwky.com id22072 View details | United States | Services | leaked | ||
|
Oiwky is a U.S.-based technology and innovation company focused on providing IT solutions, digital platforms, and business support services. The … |
||||||
| Ransomware | sandersonmanagement.com id22052 View details | United States | Services | leaked | ||
|
Sanderson Management is a renowned property management company based in the United States, specializing in the efficient and effective management … |
||||||
| Ransomware | lipcare.de id22043 View details | Germany | Other | leaked | ||
|
Lipcare, operated by KHK GmbH in Germany, is a specialized manufacturer of natural and conventional cosmetics, with a particular focus … |
||||||
| Ransomware | companionsandhomemakers.com id22042 View details | United States | Communication / Marketing | leaked | ||
|
Companions & Homemakers, based in Connecticut, is a nonprofit home-care service provider with more than 30 years of experience. It … |
||||||
| Ransomware | camaravalencia.com id22041 View details | Spain | Retail / E-commerce | leaked | ||
|
The Cámara de Valencia, officially known as the Chamber of Commerce, Industry, Services and Navigation of Valencia, was founded in … |
||||||
| Ransomware | dasmeshschool.com id22040 View details | Canada | Education | leaked | ||
|
Dasmesh Punjabi School in Winnipeg, Manitoba, is a private independent institution that integrates the provincial curriculum with Punjabi language, Sikh … |
||||||
| Ransomware | zanettisrl.it id22039 View details | Italy | Construction / Real Estate | leaked | ||
|
Zanetti S.r.l., headquartered in Florence, Italy, is a leading architectural company specializing in the design and construction of glass and … |
||||||
| Ransomware | uwock.ca id22038 View details | Canada | Communication / Marketing | leaked | ||
|
Information Chatham-Kent is a nonprofit service based in Ontario, Canada, and operated under United Way Chatham-Kent. It serves as a … |
||||||
| Ransomware | hardwicktactical.com id22037 View details | United States | Communication / Marketing | leaked | ||
|
Hardwick Tactical Corporation, located in Cleveland, Tennessee, is a historic American manufacturer of military and professional uniforms. Founded in 1880, … |
||||||
| Ransomware | templeemanu-el.org id22036 View details | United States | Other | leaked | ||
|
Temple Emanu-El, located in Dallas, Texas, is one of the largest and most historically significant Reform Jewish congregations in the … |
||||||
| Ransomware | thecelestehotel.com id22035 View details | United States | Hospitality / Food & Beverage / Tourism | leaked | ||
|
The Celeste Hotel is a boutique hotel located in Orlando, Florida, within the University of Central Florida (UCF) campus area. … |
||||||