Ransomware Stats

[ { “activity”: “Professional Services”, “attackdate”: “2026-10-30T00:02:21.477082+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Susman Godfrey L.L.P. is a premier litigation firm recognized for its exceptional courtroom talent and\u2026”, “discovered”: “2026-10-30T00:02:22.816559+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/U3VzbWFuIEdvZGZyZXkgTExQQFNpbGVudFJhbnNvbUdyb3Vw”, “victim”: “Susman Godfrey LLP” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-29T21:53:22.986061+00:00”, “claim_url”: “http:\/\/b5gozwifyvy5bhys3bsiq5tedhpot345udggjyb54fsjd2m7nteftkad.onion\/project\/peKL2tmrm6MUe6WN\/”, “country”: “US”, “data_size”: null, “description”: “Country: Madison, Wisconsin, US |\nWebsite: tdstelecom.com |\nRevenue: $1.30 Billion |\nIndustry: Telecommunications, Internet Service Providers |\nEmployees: 3,000-5,000 |\nProperties: 27.4 GB (79,679 Files, 1,943 Folders)”, “discovered”: “2026-10-29T21:54:07.712704+00:00”, “domain”: “tdstelecom.com”, “group”: “Global Secret Group”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/fcf40ee7009038c1d5e08e339c0e8144.png”, “url”: “https:\/\/www.ransomware.live\/id\/VERTIFRlbGVjb21tdW5pY2F0aW9ucyBMTEMuQEdsb2JhbCBTZWNyZXQgR3JvdXA=”, “victim”: “TDS Telecommunications LLC.” }, { “activity”: “Agriculture and Food Production”, “attackdate”: “2026-10-29T20:36:54.572208+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Manufacturing”, “discovered”: “2026-10-29T20:36:55.631822+00:00”, “domain”: “”, “group”: “Shiba”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/SVQgRm9vZHMgSW5kdXN0cmllc0BTaGliYQ==”, “victim”: “IT Foods Industries” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-29T20:36:35.098593+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Hospitals & Physicians Clinics”, “discovered”: “2026-10-29T20:36:36.107929+00:00”, “domain”: “”, “group”: “Shiba”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/RnJpZW5kbHkgU2VuaW9yIExpdmluZ0BTaGliYQ==”, “victim”: “Friendly Senior Living” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-29T20:36:15.633086+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Insurance”, “discovered”: “2026-10-29T20:36:16.686785+00:00”, “domain”: “”, “group”: “Shiba”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TW9yZ2FuIFdoaXRlIEdyb3VwQFNoaWJh”, “victim”: “Morgan White Group” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-29T20:35:55.821029+00:00”, “claim_url”: “”, “country”: “GB”, “data_size”: null, “description”: “Local dentist clinic based in Cambridge, London”, “discovered”: “2026-10-29T20:35:57.079262+00:00”, “domain”: “www.antwerphousedentistry.co.uk”, “group”: “Shiba”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QW50d2VycCBIb3VzZSBEZW50aXN0cnlAU2hpYmE=”, “victim”: “Antwerp House Dentistry” }, { “activity”: “Not Found”, “attackdate”: “2026-10-29T20:24:49.884927+00:00”, “claim_url”: “http:\/\/everstakewfma6sxdpshoq4ebtnqamsxnajrtzu2cflai77kfup5kzyd.onion\/about\/announcement\/d323bb06-6361-497b-aea2-2b9262c4751f\/”, “country”: “”, “data_size”: null, “description”: “HR, Staffing, & Recruiting”, “discovered”: “2026-10-29T20:25:08.497064+00:00”, “domain”: “”, “group”: “everstake”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/4cab2011d65ec2c4dc118eae7746575a.png”, “url”: “https:\/\/www.ransomware.live\/id\/YXMqKioqKmcuY29tQGV2ZXJzdGFrZQ==”, “victim”: “as*****g.com” }, { “activity”: “Not Found”, “attackdate”: “2026-10-29T20:24:11.096148+00:00”, “claim_url”: “http:\/\/everstakewfma6sxdpshoq4ebtnqamsxnajrtzu2cflai77kfup5kzyd.onion\/about\/announcement\/d75e3f97-0cc5-470f-834e-5e6d017114dc\/”, “country”: “”, “data_size”: null, “description”: “Insurance Agency”, “discovered”: “2026-10-29T20:24:31.319474+00:00”, “domain”: “”, “group”: “everstake”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/0e3785bac346f4df3a9008418a8221c7.png”, “url”: “https:\/\/www.ransomware.live\/id\/Y2EqKioqKnMuY29tQGV2ZXJzdGFrZQ==”, “victim”: “ca*****s.com” }, { “activity”: “Not Found”, “attackdate”: “2026-10-29T20:23:32.449634+00:00”, “claim_url”: “http:\/\/everstakewfma6sxdpshoq4ebtnqamsxnajrtzu2cflai77kfup5kzyd.onion\/about\/announcement\/51bf1909-aaae-4e11-9529-246b2f6fda1e\/”, “country”: “”, “data_size”: null, “description”: “Chemicals & Related Products”, “discovered”: “2026-10-29T20:23:52.693713+00:00”, “domain”: “”, “group”: “everstake”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/c4c091779d175579be60fe9b1640f3f4.png”, “url”: “https:\/\/www.ransomware.live\/id\/aW4qKioqKnMuY29tQGV2ZXJzdGFrZQ==”, “victim”: “in*****s.com” }, { “activity”: “Technology”, “attackdate”: “2026-10-29T20:22:53.846156+00:00”, “claim_url”: “http:\/\/everstakewfma6sxdpshoq4ebtnqamsxnajrtzu2cflai77kfup5kzyd.onion\/about\/announcement\/a6c43a6a-b365-4b24-863a-20308929149b\/”, “country”: “”, “data_size”: null, “description”: “Corporate Compliance”, “discovered”: “2026-10-29T20:23:13.685971+00:00”, “domain”: “corp-smart.com”, “group”: “everstake”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/81038897a3f938a93f1b5f899793428c.png”, “url”: “https:\/\/www.ransomware.live\/id\/Y29ycC1zbWFydC5jb21AZXZlcnN0YWtl”, “victim”: “corp-smart.com” }, { “activity”: “Technology”, “attackdate”: “2026-10-29T17:51:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “Rolly.io is an on-chain crypto casino on Arbitrum featuring a public bankroll, transparent bonus formulas (rakeback, weekly bonuses), and active player reward systems.\n\nWe hold 1,364 rolly.gg player PII records with linked on-chain wallets, 430K+ ledger transactions, 11,442 wallet addresses, 155 whale payout maps, 299 deanonymized staff\/CTO emails, and 313 internal chat messages.\n\nWe aren’t asking for any ransom, we just thought it was funny to hack a casino that made a joke about Gamdom.”, “discovered”: “2026-10-29T18:04:46.117826+00:00”, “domain”: “rolly.io”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/cm9sbHkuaW9AV2hpdGVhcm1vcg==”, “victim”: “rolly.io” }, { “activity”: “Retail & E-Commerce”, “attackdate”: “2026-10-29T16:24:00+00:00”, “claim_url”: “http:\/\/emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion\/post\/la-profumeria-srl\/”, “country”: “IT”, “data_size”: null, “description”: “Italian company working with perfumes and cosmetics.\nArchived personal and corporate data of employees and customers. [Sector: Manufacturing]”, “discovered”: “2026-10-29T16:53:34.200516+00:00”, “domain”: “”, “group”: “emperador”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/12e1a35cf5ef28df3fec27e506cb7c26.png”, “url”: “https:\/\/www.ransomware.live\/id\/TEEgUFJPRlVNRVJJQSBTUkxAZW1wZXJhZG9y”, “victim”: “LA PROFUMERIA SRL” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-29T14:13:34.393971+00:00”, “claim_url”: “http:\/\/rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion\/archive.php?company=293”, “country”: “”, “data_size”: null, “description”: “INTAX, Inc. Complete file server of INTAX, Inc. (Lexington, KY, USA) – a property-tax compliance and bill-pay firm.892,867 files, 1.27 TBClient tax returns: 649,905 PDFs. Clients include AARP, ADT, Pilot Travel Centers, Wendy’s, Valvoline, Zions, Raytheon (~100 companies).Client accounting: 100+ QuickBooks company files \ufffd full ledgers, banks, payroll.Money: bank account + routing numbers, $910,000 wire form, signed W-9, proof the firm opens dedicated accounts and pays client taxes (~$73.6M\/yr moved).Identity data: US passports of the owner and employees, driver license, birth certificate, W-2s with SSNs, IRS filings 2025\ufffd2026, medical insurance cards.60+ cleartext password files: US government tax portals + the firm’s own QuickBooks.24,000+ emails, personal employee folders, lawsuit records, owner exit\/sale planning. More”, “discovered”: “2026-10-29T14:14:29.488392+00:00”, “domain”: “”, “group”: “rhysida”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/0ce09f7ee8b5bab9494375f6c8075910.png”, “url”: “https:\/\/www.ransomware.live\/id\/SU5UQVgsIEluYy5Acmh5c2lkYQ==”, “victim”: “INTAX, Inc.” }, { “activity”: “Transportation”, “attackdate”: “2026-10-29T14:06:23.420160+00:00”, “claim_url”: “http:\/\/krybitqsdzwmhnitvwuhvsntfgf2wrhxveyxroxpc44c6gkft2cqldyd.onion\/blog\/c5fc6f5c6ce071766c550bc58b3b4f4dcc2b9d1a35ef5672aa6f4e888bb12f92\/”, “country”: “AT”, “data_size”: null, “description”: “Viehhauser KFZ GmbH & Co KG is an Austrian family-owned automotive dealership and service center founded on March 20, 19…”, “discovered”: “2026-10-29T14:06:43.428858+00:00”, “domain”: “www.viehhauser-kfz.at”, “group”: “krybit”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/6528f74f7f8fe57d0268df263963f302.png”, “url”: “https:\/\/www.ransomware.live\/id\/d3d3LnZpZWhoYXVzZXIta2Z6LmF0QGtyeWJpdA==”, “victim”: “www.viehhauser-kfz.at” }, { “activity”: “Government & Defense”, “attackdate”: “2026-10-29T13:09:13.653000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Government Administration Stolen data: 15 GB.”, “discovered”: “2026-10-29T13:21:34.206838+00:00”, “domain”: “www.circlevillepolice.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Q2lyY2xldmlsbGUgUG9saWNlIERlcGFydG1lbnRAQm9vYmEgUHJvamVjdA==”, “victim”: “Circleville Police Department” }, { “activity”: “Education”, “attackdate”: “2026-10-29T13:07:06.942000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Non-profit Organizations Stolen data: 95 GB.”, “discovered”: “2026-10-29T13:21:55.468140+00:00”, “domain”: “www.programsforparents.org”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/UHJvZ3JhbXMgZm9yIFBhcmVudHMsIEluYy5AQm9vYmEgUHJvamVjdA==”, “victim”: “Programs for Parents, Inc.” }, { “activity”: “Government & Defense”, “attackdate”: “2026-10-29T13:04:58.315000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Government Administration Stolen data: 295 GB.”, “discovered”: “2026-10-29T13:22:16.123980+00:00”, “domain”: “www.southwebercity.gov”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/U291dGggV2ViZXIgQ2l0eUBCb29iYSBQcm9qZWN0”, “victim”: “South Weber City” }, { “activity”: “Education”, “attackdate”: “2026-10-29T13:00:33.372000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Education Management Stolen data: 80 GB.”, “discovered”: “2026-10-29T13:22:37.130896+00:00”, “domain”: “www.csba.org”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Q2FsaWZvcm5pYSBTY2hvb2wgQm9hcmRzIEFzc29jaWF0aW9uQEJvb2JhIFByb2plY3Q=”, “victim”: “California School Boards Association” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-29T12:57:11.219000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Financial Services Stolen data: 38 GB.”, “discovered”: “2026-10-29T13:22:58.010345+00:00”, “domain”: “www.nacm.org”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TmF0aW9uYWwgQXNzb2NpYXRpb24gb2YgQ3JlZGl0IE1hbmFnZW1lbnRAQm9vYmEgUHJvamVjdA==”, “victim”: “National Association of Credit Management” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-29T12:51:32.970000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Medical Equipment Manufacturing Stolen data: Less than 1 GB.”, “discovered”: “2026-10-29T13:23:18.856891+00:00”, “domain”: “www.lifefone.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TGlmZUZvbmVAQm9vYmEgUHJvamVjdA==”, “victim”: “LifeFone” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-29T09:08:00+00:00”, “claim_url”: “http:\/\/emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion\/post\/maa-group-consulting-engineers\/”, “country”: “”, “data_size”: null, “description”: “MAA Group Consulting Engineers is a leading regional engineering and consulting service provider founded in 1975, with over 1,000 professionals operating across East and Southeast Asia. The group provides comprehensive integrated solutions\u2014ranging from conceptual planning and engineering design to project management\u2014across infrastructure, buildings, land resources, environment, and information technology. Renowned for its industry-leading expertise in Building Information Modeling (BIM), MAA Group has successfully completed major high-speed rail, mass rapid transit (MRT), and tunnel projects throughout Taipei, Hong Kong, Bangkok, and Singapore.\n\nThe client data and internal documents you\u2019ve leaked go well beyond what you\u2019ve seen here. We have taken several terabytes of files\u2014this is just a small sample. In fact, we have obtained sensitive documents pertaining to virtually all of your clients. \n\nWarning: You have 3 days to enter negotiations. Once the deadline passes, the negotiation window will be permanently closed and all exfiltrated data will be published. Additionally, the encrypted data will be rendered completely unrecoverable.\n\nsample files: \nhttps:\/\/mega.nz\/file\/CgxxTKCZ#PzGFlZt67HDF2oLsP4jn_W_QdrquHJpNAfVm-jXGYxo\n\nhttps:\/\/mega.nz\/file\/2ogzwAyY#r8F31SFQTqyW6bzQA-e8HNzgw-rEW_gn7fhwY5TAByg\n\nhttps:\/\/mega.nz\/file\/2gIRXQwY#-4IzU70FjqvSYotZoaJuod_H2P5sXoGTvsja9Patte0\n\nhttps:\/\/mega.nz\/file\/alQU0JaT#2GgaPb1Z-z1xB1FfAd_NohXbfkbfRfhfZ_OwtxPd0cc [Sector: Construction]”, “discovered”: “2026-10-29T10:21:43.189083+00:00”, “domain”: “”, “group”: “emperador”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/42cd6738663fd225a92ad6f388bc433b.png”, “url”: “https:\/\/www.ransomware.live\/id\/TUFBIEdyb3VwIENvbnN1bHRpbmcgRW5naW5lZXJzQGVtcGVyYWRvcg==”, “victim”: “MAA Group Consulting Engineers” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-29T09:06:56.581515+00:00”, “claim_url”: “http:\/\/rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion\/archive.php?company=292”, “country”: “”, “data_size”: null, “description”: “ClaimTek Systems ClaimTek Systems specializes in preparing individuals for successful entry into the medical billing and practice management business with a comprehensive training and support system. They offer a range of scalable products and services, including state-of-the-art billing software and marketing tools, targeted towards aspiring entrepreneurs in the healthcare industry. More”, “discovered”: “2026-10-29T09:07:28.112468+00:00”, “domain”: “claimtek.com”, “group”: “rhysida”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/4a3245fc063d9bec8e7e6d7bd6007647.png”, “url”: “https:\/\/www.ransomware.live\/id\/Q2xhaW1UZWsgU3lzdGVtc0ByaHlzaWRh”, “victim”: “ClaimTek Systems” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-29T04:00:00+00:00”, “claim_url”: “http:\/\/scarlettgutttdlyxz6rdqfslpdvdqnnzuxvzfsqavys2hvtnd3aidyd.onion\/?open=648ffb2e5ea5cfd4d1”, “country”: “CA”, “data_size”: null, “description”: “Sunnybrook Health Sciences Centre is a leading Canadian teaching and research hospital based in Toronto, providing specialized healthcare services in trauma, cancer, cardiac care, rehabilitation, and emergency medicine.”, “discovered”: “2026-10-29T15:46:24.034979+00:00”, “domain”: “sunnybrook.ca”, “group”: “Scarlettgroup”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/4d12aa1fcb69b7a6aa842f605e8afc4e.png”, “url”: “https:\/\/www.ransomware.live\/id\/c3Vubnlicm9vay5jYUBTY2FybGV0dGdyb3Vw”, “victim”: “sunnybrook.ca” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-29T04:00:00+00:00”, “claim_url”: “http:\/\/scarlettgutttdlyxz6rdqfslpdvdqnnzuxvzfsqavys2hvtnd3aidyd.onion\/?open=597003a29234562e47”, “country”: “IN”, “data_size”: null, “description”: “AU Small Finance Bank is an Indian financial institution offering personal and business banking, loans, credit cards, savings accounts, and digital banking services.”, “discovered”: “2026-10-29T15:45:17.986426+00:00”, “domain”: “au.bank.in”, “group”: “Scarlettgroup”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/2b5f4fb5ea37da1658ef7812f67313fb.png”, “url”: “https:\/\/www.ransomware.live\/id\/YXUuYmFuay5pbkBTY2FybGV0dGdyb3Vw”, “victim”: “au.bank.in” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-29T00:00:00+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=32f6a06d-3db3-4147-af6d-564b8f0c1a87”, “country”: “JP”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-29T15:10:23.232443+00:00”, “domain”: “www.proterial.com”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/e78addbb992c3741be3b39c84f2eeef1.png”, “url”: “https:\/\/www.ransomware.live\/id\/UHJvdGVyaWFsQHFpbGlu”, “victim”: “Proterial” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-28T23:31:54.432809+00:00”, “claim_url”: “http:\/\/anubisyfkh5rixydjpoo3jqucauajz2juybrbtuglcppjj2y3eg3y6ad.onion\/r\/nq9u4+YdH6O0Btja8GGfFCclUwfaUiA4JPpD1WSBOBmNpC1D1MADe1UbZ6Le5I34OzabZHvwaYzWjlWeqfDoQUZhUFY1MTNr”, “country”: “US”, “data_size”: null, “description”: “A major medical data breach.”, “discovered”: “2026-10-28T23:32:38.524137+00:00”, “domain”: “”, “group”: “anubis”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/c08bb45691a2c8a7cf59133fc89b945f.png”, “url”: “https:\/\/www.ransomware.live\/id\/U2FudGlhbSBIb3NwaXRhbCAmIENsaW5pY3NAYW51Ymlz”, “victim”: “Santiam Hospital & Clinics” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-28T23:30:54.144910+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Founded in 1961 and headquartered in New York City, New York, Lowenstein Sandler is a national law fir\u2026”, “discovered”: “2026-10-28T23:30:55.412982+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TG93ZW5zdGVpbiBTYW5kbGVyIExMUEBTaWxlbnRSYW5zb21Hcm91cA==”, “victim”: “Lowenstein Sandler LLP” }, { “activity”: “Not Found”, “attackdate”: “2026-10-28T21:47:00+00:00”, “claim_url”: “http:\/\/lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion\/post\/98851f019da8167a79f7e392f513b5a4”, “country”: “MX”, “data_size”: null, “description”: “Die Unternehmensgruppe Susanne Cerd\u00e1 bietet nicht nur Dienstleistungen im Bereich Unternehmensgr\u00fcndu…”, “discovered”: “2026-10-29T04:03:09.015718+00:00”, “domain”: “susannecerda.com”, “group”: “lockbit5”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/2296e45ce96cbcef0f33b842d409d12b.png”, “url”: “https:\/\/www.ransomware.live\/id\/c3VzYW5uZWNlcmRhLmNvbUBsb2NrYml0NQ==”, “victim”: “susannecerda.com” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-28T21:42:00+00:00”, “claim_url”: “http:\/\/lockbitapt67g6rwzjbcxnww5efpg4qok6vpfeth7wx3okj52ks4wtad.onion\/post\/ed9b39cc52e5ab03735c34039a652f5d”, “country”: “TH”, “data_size”: null, “description”: “XSpring Capital Public Company Limited is a company that operates in the business of investing in va…”, “discovered”: “2026-10-29T04:03:54.440445+00:00”, “domain”: “xspringcapital.com”, “group”: “lockbit5”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/d05f10ddce70b0030b7c3819218a5d1e.png”, “url”: “https:\/\/www.ransomware.live\/id\/eHNwcmluZ2NhcGl0YWwuY29tQGxvY2tiaXQ1”, “victim”: “xspringcapital.com” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-28T21:29:39.087475+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Morrison Foerster is a leading international law firm with a presence in the United States, Asia, and \u2026”, “discovered”: “2026-10-28T21:29:40.152117+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TW9ycmlzb24gRm9lcnN0ZXJAU2lsZW50UmFuc29tR3JvdXA=”, “victim”: “Morrison Foerster” }, { “activity”: “Not Found”, “attackdate”: “2026-10-28T21:29:15.760056+00:00”, “claim_url”: “https:\/\/business-data-leaks.com\/about#8c2f7273bc39909135e813619”, “country”: “”, “data_size”: null, “description”: “Redacted entry – full company name pending disclosure (FULL DATA TIMER active).”, “discovered”: “2026-10-28T21:29:20.618729+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VC4uLiBFLi4uQFNpbGVudFJhbnNvbUdyb3Vw”, “victim”: “T… E…” }, { “activity”: “Not Found”, “attackdate”: “2026-10-28T21:28:52.204716+00:00”, “claim_url”: “https:\/\/business-data-leaks.com\/about#7728820d79a9ce011efaa5ee6”, “country”: “”, “data_size”: null, “description”: “Redacted entry – full company name pending disclosure (FULL DATA TIMER active).”, “discovered”: “2026-10-28T21:28:57.171470+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Uy4uLiBILi4uQFNpbGVudFJhbnNvbUdyb3Vw”, “victim”: “S… H…” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-28T20:40:22+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Fortrex is the premier provider of food safety solutions in North America, offering comprehensive sanitation services, chemical products and intervention solutions for food processing facilities. Our team of skilled food sanitors, microbiologists, technical experts and engineers are committed to keeping USDA, FDA, and CFIA processing facilities clean, safe, and audit-ready”, “discovered”: “2026-10-28T21:31:10.907978+00:00”, “domain”: “fortrexsolutions.com”, “group”: “Wallstreet”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Rm9ydHJleEBXYWxsc3RyZWV0”, “victim”: “Fortrex” }, { “activity”: “Education”, “attackdate”: “2026-10-28T20:23:33.870413+00:00”, “claim_url”: “http:\/\/o5lsqyar7ox25z734k6zaxt2vf7bsyi4q5rturi5iyxzqo3ica7bjsad.onion\/project\/7Q5RjYTfKXnj5nth\/”, “country”: “IL”, “data_size”: null, “description”: “Country: Grenada.Spain |\nWebsite: aisj.co.il |\nRevenue: $11.1 Million |\nIndustry: Primary and Secondary Education |\nEmployees: 50-100 |\nProperties: 218 GB (257,960 Files, 28,378 Folders)”, “discovered”: “2026-10-28T20:24:06.315999+00:00”, “domain”: “aisj.co.il”, “group”: “Global Secret Group”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VGhlIEFuZ2xpY2FuIEludGVybmF0aW9uYWwgU2Nob29sQEdsb2JhbCBTZWNyZXQgR3JvdXA=”, “victim”: “The Anglican International School” }, { “activity”: “Not Found”, “attackdate”: “2026-10-28T17:33:20.472441+00:00”, “claim_url”: “https:\/\/business-data-leaks.com\/about#09ff2527e54d34a5b5d757d9f”, “country”: “”, “data_size”: null, “description”: “Redacted entry – full company name pending disclosure (FULL DATA TIMER active).”, “discovered”: “2026-10-28T17:34:09.834165+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/ed73112c216d055e9a83d57c447a8fe3.png”, “url”: “https:\/\/www.ransomware.live\/id\/TC4uLkBTaWxlbnRSYW5zb21Hcm91cA==”, “victim”: “L…” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-28T16:58:28.226154+00:00”, “claim_url”: “http:\/\/rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion\/archive.php?company=290”, “country”: “US”, “data_size”: null, “description”: “Noelker and Hull NHA-FULL \ufffd US ARCHITECTURE FIRM (est. 1971) – HEALTHCARE \/ SENIOR-LIVING DESIGN – COMPLETE INTERNAL FILE-SERVER – FRESH TO 2026No credentials in this lot (excluded by decision). Focus: identity and familypackages, payroll SQL, tax\/bank pipes, litigation, seals & signatures, 26 GB mail.SUBJECT – Noelker and Hull Associates, Inc. (Chambersburg PA, est. 1971) + KAPClegacy (Frederick MD). ~41 employees, 9 shareholders. Revenue $8.56M -> $7.01M.~990 delivered projects: Penn State Health, WellSpan, Meritus, UPMC, SelectMedical, Tower Health, Holland America, Hershey, Gettysburg College – incl.hospital & crisis-center plans.KEY NUMBERS: 990 project folders | 30+ healthcare clients | 26 GB mail |60+ SSN rows | exec passports+DL x4 | edge 2026.INVENTORY – raw files from the firm’s servers, values masked, full set on close.[1] IDENTITY & FAMILY PACKAGES – FULLZ – ~80-100 PA residentsPassports+DL of the President and VP (x4); W-2 with full SSN (SSA TY2024),pay stubs (VP, YTD ~$116K, 07\/2026), 401(k) x2, I-9; background checks -MD Criminal History + FBI Identity History + fingerprints.’Kennedy’: SSN, mortgage 03\/2024, 3 child birth certs, child medical.’Karpowicz’ (employee’s mother, dementia): Medicare MBI, bank accounts,Morgan Stanley check $86,650.68, returns 2022-2025, IRS POA.’Hoffman’: UPMC\/WellSpan medical, custody. + ~62 resumes, phones ~45.Below PA AG >500 bar – but every name is a plaintiff (Dittman) + a victim.[2] PAYROLL – Ajera ERP SQL backups, 140 tablesSSN x61+ | Salary x459 | W-2 x1151 | 1099 x991 | DirectDeposit x176 |BankAccount x1503. Full compensation\/bank anatomy for payroll-diversion.[3] TAX & FINANCE – Form 1120 x4 yrs, QuickBooks (KAPC); PPP $802,480 +$803,347.83 forgiven; IRS audit TY2020 closed no-change; BlueRidge acct104729, positive-pay exports. Fraud precedent: forged checks $45.5K (2022)+ fraudulent SBA EIDL #7672918108 in the firm’s name – scheme proven.[4] LITIGATION – ACTIVE: PJ Dick v. Lehigh No. 2026-C-2439, $13M+, ‘designerrors, omissions’ against NHA \ufffd internal assessments, stop-work, delayclaims. Fleet Landing demand ~$1.41M. Vincentian ‘DO NOT MOVE OR DELETE’hold; SpiriTrust privileged folder; CIA subpoena response.[5] FORGERY KIT – signatures of 14 employees + architect seals (MD\/PA); ~140Certificates of Insurance; license keys (Autodesk\/Adobe) bonus.[6] COMMERCIAL SECRETS – fee pipeline 2010-2026 (5.00-8.50%, markup 10%,Hourly Rates, Past-Due notices); Meritus master specs; CAD Standards37.7 GB; aborted Olsen merger docs.[7] MAIL – ~26 GB, into 2026. Indexed sample: 6,195 msgs – 401(k)\/ERISA\/PHI.Rest as-is, unprobed.[+] AS-IS – encrypted browser stores x3 (OWA\/banks\/PayPal\/USCIS listed),Credential Manager x91, .pfx, ACT! DB. Unproven, not in the price.FRESHNESS – A\ufffdlive: pay stubs 07\/2026, COI to 05\/2027, case 2026-C-2439, mail.B\ufffdrecent: Ajera, pipeline, returns 2022-25, litigation. C\ufffdarchival (KAPC2009-14): W-2, background – SSN\/biometrics don’t expire.BUYERS – elder-fraud\/fullz (1); BEC\/payroll-diversion (2+3); competitor AEC (6);PA\/MD plaintiff bar (1+4); contractor scams (5).DEAL – mockup only. 1. Sample: masked docs, table-list screenshot, watermarkedseal, SHA-256 manifest. 2. Escrow, multi-sig; whole lot or per-section split.3. Dead-drop container, hash check vs. manifest, proof-of-deletion on exclusive.DISCLAIMER – HYPOTHETICAL RED-TEAM SCENARIO from a confirmed forensic inventory(60 findings). Nothing is offered for sale. Credential rotation = UNVERIFIEDassumption (artifacts dated 2026). ‘~’ = enumerated; unparsed = unproven. More”, “discovered”: “2026-10-28T16:59:06.260497+00:00”, “domain”: “noelkerhull.com”, “group”: “rhysida”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/a0790344784d0cf5e0eb6d38b55ca43a.png”, “url”: “https:\/\/www.ransomware.live\/id\/Tm9lbGtlciBhbmQgSHVsbEByaHlzaWRh”, “victim”: “Noelker and Hull” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-28T14:48:54.570512+00:00”, “claim_url”: “http:\/\/payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion\/posts\/553c19b7-b089-4b2c-af38-c5d755cb32af”, “country”: “DE”, “data_size”: null, “description”: “Hauhinco is a German manufacturer of high-pressure water hydraulics. The company produces plunger pumps, valves, and pump stations for mining and industry. It also develops rail-bound shunting systems for automated material handling.”, “discovered”: “2026-10-28T14:49:50.250850+00:00”, “domain”: “hauhinco.de”, “group”: “payload”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/67dfb32388149de0abb828f7d33a87ed.png”, “url”: “https:\/\/www.ransomware.live\/id\/SGF1aGluY29AcGF5bG9hZA==”, “victim”: “Hauhinco” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-28T14:47:38.408353+00:00”, “claim_url”: “http:\/\/payloadrz5yw227brtbvdqpnlhq3rdcdekdnn3rgucbcdeawq2v6vuyd.onion\/posts\/9dc5e696-700c-4c5d-88b7-396487d81128”, “country”: “FR”, “data_size”: null, “description”: “Marbre Design is a French company specializing in the processing of natural stone, marble, granite, and composite materials. The enterprise custom-manufactures kitchen countertops, bathroom fixtures, fireplace surrounds, and interior architectural elements. Its core operations focus on precision cutting, slab polishing, and the on-site installation of finished products.”, “discovered”: “2026-10-28T14:48:35.878124+00:00”, “domain”: “”, “group”: “payload”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/4ef7325c37a0cf40213668e78327aa7f.png”, “url”: “https:\/\/www.ransomware.live\/id\/TWFyYnJlIERlc2lnbkBwYXlsb2Fk”, “victim”: “Marbre Design” }, { “activity”: “Not Found”, “attackdate”: “2026-10-28T07:53:30.006400+00:00”, “claim_url”: “http:\/\/nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion”, “country”: “MY”, “data_size”: null, “description”: “telecommunications services \u00b7 Malaysia | [PENDING EXPOSURE: \u00b7 settlement window open]”, “discovered”: “2026-10-28T07:53:44.722544+00:00”, “domain”: “”, “group”: “N0n”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/cd9319ce146401b8763e0b86ae1f7407.png”, “url”: “https:\/\/www.ransomware.live\/id\/Q29tcGFueSAjMTEyQE4wbg==”, “victim”: “Company #112” }, { “activity”: “Technology”, “attackdate”: “2026-10-28T01:05:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “DE”, “data_size”: null, “description”: “Echo Global Logistics is a Chicago-based, technology-enabled third-party logistics provider offering freight brokerage and integrated supply chain services, including truckload, LTL, warehousing, and cross-border shipping across North America.\n\nWe hold Echo Global Logistics data: 2.06M claims rows, 153,727 freight loads, 261,440 quotes ($705M buy volume), 136,273 tenderings, 59,607 tracking records, 3,890 employee identity mappings with emails, 2,418 customers, 9,122 carriers, and warehouse geodata.\n\nWe suggest you pay a small ransom demand of $10,000,000 in BTC and move on with your lives.\n\nEmails with instructions will be sent to you shortly.\n\nSamples can be found below.\n\nContact:\nSession: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67\nEmail: whitearmorrxd@proton.me”, “discovered”: “2026-10-28T02:10:02.050465+00:00”, “domain”: “Echo.com”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/RWNoby5jb21AV2hpdGVhcm1vcg==”, “victim”: “Echo.com” }, { “activity”: “Other”, “attackdate”: “2026-10-28T00:46:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “wagyu.xyz runs two rigged systems, both proven by the evidence:\n\n1. Rigged coinflip. The site advertises \”48% win chance, 4% house edge\” (coinflip-public-claim.txt, coinflip-public-terms.json), but server settings aimed for a 4.00% expected edge and the distribution of outcomes is measurably shifted against players: of 2,852 provably-fair-verified flips, 1,417 fell in the 0-48000 band versus 1,325 above 52000, with only 110 in the dead zone (coinflip-measured-odds.json, result_bins). The provably-fair HMAC checks all pass (coinflip-fairness-verify.py, coinflip-sample-seed-chain.json), which only proves the commits weren’t tampered per-round; the win thresholds themselves are crooked. Internal accounting confirms: expectedEdge \”4.00\”, actualEdge \”2.92\” against a published 2% edge, and a 36.49% player win rate (coinflip-house-stats.json, coinflip-settings.json, coinflip-accepted-orders.json).\n\n2. Hidden fee overcharging. Across 28,840 swap\/bridge orders totaling ~$264.9M notional, wagyu advertised $1.73M in fees but actually collected $5.64M, hiding $3.9M or 69.28% of its real take (fee-overcharge-metrics.json). 13,190 orders were charged above the quoted rate, 1,812 above 2 percentage points. The server’s internal policy charges up to 10% where the public disclosure says 2% (fee-policy-server.json vs fee-public-disclosure.txt, fee-policy-feeds.json, fee-overcharge-summary.json). Worst cases are itemized in fee-top100-overcharged.csv, e.g. order RMNCMB: $3.17M swap, quoted 0.02, charged 0.08, $190,092 stolen (fee-order-RMNCMB.json).\n\nEvidence to support this can be found below:”, “discovered”: “2026-10-28T02:10:42.771753+00:00”, “domain”: “wagyu.xyz”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/d2FneXUueHl6IHVuZmFpcm5lc3NAV2hpdGVhcm1vcg==”, “victim”: “wagyu.xyz unfairness” }, { “activity”: “Education”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=154a3a0f-3971-40a7-a580-b1160d47318b”, “country”: “ES”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-29T15:12:32.517480+00:00”, “domain”: “www.udima.es”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/206f96aad2e8b0aa4d0010d287277bdc.png”, “url”: “https:\/\/www.ransomware.live\/id\/VWRpbWFAcWlsaW4=”, “victim”: “Udima” }, { “activity”: “Technology”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=0af51c9d-f95f-49a2-afc0-b07c5f5b1a21”, “country”: “GB”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-29T15:11:36.387843+00:00”, “domain”: “www.w-interactive.com”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/899b01178069611b1664fb774d4d7cef.png”, “url”: “https:\/\/www.ransomware.live\/id\/VyBJbnRlcmFjdGl2ZUBxaWxpbg==”, “victim”: “W Interactive” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “http:\/\/pnzruro7syvwvefx5mpo2fhzi4jftgquynsqf3vy5x3no57yp2iz4nyd.onion\/company\/pqe-group”, “country”: “IT”, “data_size”: null, “description”: “Founded in 1998, PQE Group provides technology solutions and compliance consulting services to the Life Sciences industry. The company is headquartered in Reggello, Florence. Note : The Full Data volume is coming as duplicati (dindex.zip.aes), Our Team with our Affiliates will try to enum the PassPhrase From the Target Network and Crack it with a Custom Pass lists and custom tools, We Also Gonna Share the Guide to how you as a hacker can get the hash with aescrypt2hashcat.pl and Crack it using hashcat, The Rest will depend on your Crack process to see the full data volume, We also available to Recover the data to the company when they contact us via official channels and stop the leak process, Thank you.”, “discovered”: “2026-10-28T18:26:50.917009+00:00”, “domain”: “”, “group”: “Panzer”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/57a526244c9841feb4eab4983ad2cd62.png”, “url”: “https:\/\/www.ransomware.live\/id\/UFFFIEdyb3VwQFBhbnplcg==”, “victim”: “PQE Group” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Trulife is an internationally recognized company with over 60 years of experience in the develo\npment and manufacture of specialized healthcare and consumer products. Their extensive product \nrange includes breastcare solutions, orthotics, lower limb prosthetics, walking aids, and press\nure care products.\n\nWe will upload 68gb of corporate data soon. Detailed employee information (passport scans, DLs,\nmedical certs, birth certs), contracts and agreements, confidential files (employee violations\n, terminations and so on), financials, NDA, etc.\n”, “discovered”: “2026-10-28T13:37:58.825942+00:00”, “domain”: “trulife.com”, “group”: “akira”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VHJ1bGlmZUBha2lyYQ==”, “victim”: “Trulife” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “RCS is a full-service engineering firm specializing in Construction Materials Testing, Construc\ntion Engineering and Inspection (CEI), and QA\/QC services, founded in 2013. With over 60 years \nof combined FDOT experience, RCS provides high-quality professional services to clients in road\nway and bridge construction projects throughout Central Florida.\n\nWe will upload 28gb of corporate data soon. Detailed employee information (passport scans, DLs,\nSSN), contracts and agreements, client information, financials, NDA, etc.\n”, “discovered”: “2026-10-28T13:37:39.134708+00:00”, “domain”: “jsrconsulting.com”, “group”: “akira”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Um9iZXJ0cyBDb25zdWx0aW5nIFNlcnZpY2VzQGFraXJh”, “victim”: “Roberts Consulting Services” }, { “activity”: “Other”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “http:\/\/u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion\/blog\/ewm-group-b175f7dc”, “country”: “GB”, “data_size”: null, “description”: “[fashion] EWM Group \u2014 the parent group behind Bonmarch\u00e9, Edinburgh Woollen Mill, and Peacocks, three of the UK’s best-known value fashion chains.\n\nThe exposed material includes:\n\n503,878 loyalty programme member records \u2014 full name, home address, date of birth, phone, mobile, email, loyalty card number, and transaction history spanning 2000\u20132026.\n~21,000 employee records \u2014 salary, National Insurance number (via P11D), bank sort code and account number (WAGESTRANSFER database), home address, emergency contacts, maternity\/paternity data, sickness absence, accident reports with injury details.\n\n\n\n\n\n100+ GB of Outlook PST email archives \u2014 complete email histories for named staff members spanning years of business operations.\n313+ SQL Server database backups across 122 unique databases \u2014 the entire digital brain of the retail operation.\n83 GB of e-commerce transaction data \u2014 every online order from January 2021 to August 2026.”, “discovered”: “2026-10-28T13:00:09.407449+00:00”, “domain”: “EWM Group”, “group”: “aurora”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/9998bca1dc1e7e0a9fa61a6f9e90b1df.png”, “url”: “https:\/\/www.ransomware.live\/id\/RVdNIEdyb3VwQGF1cm9yYQ==”, “victim”: “EWM Group” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “CHAT Insurance offers a comprehensive range of insurance products including commercial, home, a\nuto, and travel insurance. Established in 2015, the company has expanded to 10 offices and serv\nes over 20,000 policyholders across Ontario.\n\nWe will upload 112gb of corporate data soon. Employee information (passports, DLs, birth certs \nand other personal docs), projects (client personal information and other documents (~250 perso\nns (DL numbers, name, addresses, phones and so on)), contracts and agreements, NDA, etc.\n”, “discovered”: “2026-10-28T12:58:43.776859+00:00”, “domain”: “”, “group”: “akira”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/SW5zdXJhbmNlIFNlcnZpY2VzQGFraXJh”, “victim”: “Insurance Services” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-28T00:00:00+00:00”, “claim_url”: “http:\/\/u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion\/blog\/meleghy-automotive-cie-gmbh-63e4f811”, “country”: “DE”, “data_size”: null, “description”: “[automotive] The exposed material includes:\n\nPassport\/visa\/student-admission dossiers\nTesla Model Y\/Opal tooling, CAD and DFM tree\nEmployee contract and HR folders\n\nMEB\/BMW NCAR metrology and plant-layout trees\nPLC\/SPS\/robot backups and cross-reference DBs\nTISAX\/IATF audit and corrective-action records\nRestricted management meeting\/WLAN record\n\nBrowser profile SQLite databases”, “discovered”: “2026-10-28T10:05:41.800988+00:00”, “domain”: “Meleghy Automotive & Cie. GmbH”, “group”: “aurora”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/3deb64246e2c2e102752d2e733720ebe.png”, “url”: “https:\/\/www.ransomware.live\/id\/TWVsZWdoeSBBdXRvbW90aXZlICYgQ2llLiBHbWJIQGF1cm9yYQ==”, “victim”: “Meleghy Automotive & Cie. GmbH” }, { “activity”: “Transportation”, “attackdate”: “2026-10-27T22:26:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “US”, “data_size”: null, “description”: “Ryder is a Fortune 500 transportation and supply chain management company providing fleet management, dedicated transportation, and logistics solutions.\n\nWhat we hold: 18.75M rows, 328 CSVs, consumer names, phones, emails, driver\/associate PII, cleartext API keys, LMS credentials, FTP\/telematics configs from RyderView, RLM, EFT.\n\nOur demand is only $20M in BTC… i swear.\n\nSamples can be found below.\n\nEmails with instructions will be sent to Ryder shortly, and no we did not buy access from ‘shadowbyte’ or whatever the niggas name is on pwnforums.\n\nContact if you do not receive the instructions:\n\nSession: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67\nEmail: whitearmorrxd@proton.me”, “discovered”: “2026-10-28T01:09:16.806823+00:00”, “domain”: “”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/UnlkZXJAV2hpdGVhcm1vcg==”, “victim”: “Ryder” }, { “activity”: “Not Found”, “attackdate”: “2026-10-27T20:12:00+00:00”, “claim_url”: “http:\/\/emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion\/post\/twice-srl\/”, “country”: “”, “data_size”: null, “description”: “\u0421ompany from the Republic of San Marino,\nassociated with the production and sale of fashion clothing and accessories.\nArchived personal and corporate data of employees and customers. [Sector: Manufacturing, Finance]”, “discovered”: “2026-10-27T21:22:05.818826+00:00”, “domain”: “”, “group”: “emperador”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/15a6cd21caee8f8ceca5743d7e22fca7.png”, “url”: “https:\/\/www.ransomware.live\/id\/VFdJQ0UgU1JMQGVtcGVyYWRvcg==”, “victim”: “TWICE SRL” }, { “activity”: “Transportation”, “attackdate”: “2026-10-27T19:51:22.790774+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=XDFkRi0valQYZp”, “country”: “DK”, “data_size”: null, “description”: “Belgium”, “discovered”: “2026-10-27T19:51:56.059899+00:00”, “domain”: “www.tailormade-logistics.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VGFpbG9ybWFkZSBMb2dpc3RpY3NAcGxheQ==”, “victim”: “Tailormade Logistics” }, { “activity”: “Retail & E-Commerce”, “attackdate”: “2026-10-27T19:50:27.533407+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=cYy0Rb02SQe6Tn”, “country”: “US”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T19:51:00.885314+00:00”, “domain”: “www.c2cescrow.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Q29hc3QgMiBDb2FzdEBwbGF5”, “victim”: “Coast 2 Coast” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-27T19:49:34.930278+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=zpo5XDhGpXVCNr”, “country”: “US”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T19:50:08.859781+00:00”, “domain”: “www.vpcbuilders.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VlBDIEJ1aWxkZXJzQHBsYXk=”, “victim”: “VPC Builders” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T18:26:53.307872+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=gaMUWnkyADv5BE”, “country”: “US”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T18:27:11.459416+00:00”, “domain”: “www.hygiena.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/4862fbe3d8097193a33bfad1277872d0.png”, “url”: “https:\/\/www.ransomware.live\/id\/SHlnaWVuYUBwbGF5”, “victim”: “Hygiena” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-27T18:26:00.995714+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=EyDlErT6Tv8eJ”, “country”: “US”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T18:26:34.660553+00:00”, “domain”: “www.moneyconcepts.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TW9uZXkgQ29uY2VwdHMgQ2FwaXRhbEBwbGF5”, “victim”: “Money Concepts Capital” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T17:30:11.870918+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=fRkjty4KKKM8Y7”, “country”: “”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T17:30:26.723125+00:00”, “domain”: “www.microsearch.net”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/01ac653b7fbccd402c00aac7212e342e.png”, “url”: “https:\/\/www.ransomware.live\/id\/TWljcm9TZWFyY2hAcGxheQ==”, “victim”: “MicroSearch” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T17:29:33.776393+00:00”, “claim_url”: “http:\/\/ipi4tiumgzjsym6pyuzrfqrtwskokxokqannmd6sa24shvr7x5kxdvqd.onion\/topic.php?id=1OYPjG4UqkHy”, “country”: “US”, “data_size”: null, “description”: “United States”, “discovered”: “2026-10-27T17:29:53.098004+00:00”, “domain”: “www.qlc-labeling.com”, “group”: “play”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/e41b972106e4721254cce00e553bd644.png”, “url”: “https:\/\/www.ransomware.live\/id\/UUxDQHBsYXk=”, “victim”: “QLC” }, { “activity”: “Retail & E-Commerce”, “attackdate”: “2026-10-27T13:52:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “Wagyu.xyz is a cross-chain swap platform that allows users to exchange cryptocurrencies for native Monero (XMR) without requiring identity verification (KYC) . It routes orders through Hyperliquid’s order book for execution .\n\nWe hold 38,628 orders and 10,139 IPs from wagyu.xyz: wallets, sessions, fingerprints, countries, $907M XMR-heavy volume.\n\nOur demand is only $5,000,000… hehe\n\nSamples can be found below.\n\nSince you do not have any emails for us to contact, surely you will contact us yourselves.\n\nContact Us:\nSession: 0547b7f96d469ecb332e89d0108e71c92df5bacff6c4ed5b9801ab5fffe872ee67\nEmail: whitearmorrxd@proton.me”, “discovered”: “2026-10-27T15:06:27.903414+00:00”, “domain”: “wagyu.xyz”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/d2FneXUueHl6QFdoaXRlYXJtb3I=”, “victim”: “wagyu.xyz” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T13:16:35.308000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Medical Practices Stolen data: 121 GB.”, “discovered”: “2026-10-27T13:51:17.574190+00:00”, “domain”: “www.horizonlaservision.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/SG9yaXpvbiBFeWUgU3BlY2lhbGlzdHMgJiBMQVNJSyBDZW50ZXJAQm9vYmEgUHJvamVjdA==”, “victim”: “Horizon Eye Specialists & LASIK Center” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-27T13:09:05.868000+00:00”, “claim_url”: “http:\/\/direwolfcdkv5whaz2spehizdg22jsuf5aeje4asmetpbt6ri4jnd4qd.onion\/api\/public\/articles\/139”, “country”: “MX”, “data_size”: null, “description”: “Oil and Gas”, “discovered”: “2026-10-27T14:11:50.212201+00:00”, “domain”: “petroil.com.mx”, “group”: “direwolf”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/18f4f9364585ad1f14bf0e46d8a829dc.png”, “url”: “https:\/\/www.ransomware.live\/id\/R1JVUE8gUEVUUk9JTEBkaXJld29sZg==”, “victim”: “GRUPO PETROIL” }, { “activity”: “Education”, “attackdate”: “2026-10-27T13:03:00.530000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Museums, Historical Sites, and Zoos Stolen data: 115 GB.”, “discovered”: “2026-10-27T13:51:38.611490+00:00”, “domain”: “www.hrm.org”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/SHVkc29uIFJpdmVyIE11c2V1bUBCb29iYSBQcm9qZWN0”, “victim”: “Hudson River Museum” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T13:00:11.915000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Medical Practices Stolen data: 100 GB.”, “discovered”: “2026-10-27T13:51:59.761206+00:00”, “domain”: “www.bassmedicalgroup.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QkFTUyBNZWRpY2FsIEdyb3VwQEJvb2JhIFByb2plY3Q=”, “victim”: “BASS Medical Group” }, { “activity”: “Other”, “attackdate”: “2026-10-27T12:57:41.960000+00:00”, “claim_url”: “”, “country”: “BE”, “data_size”: null, “description”: “Hospitals and Health Care Stolen data: 10 GB.”, “discovered”: “2026-10-27T13:52:20.590995+00:00”, “domain”: “www.althus.be”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/S2VyY2tzdGVkZSB2endAQm9vYmEgUHJvamVjdA==”, “victim”: “Kerckstede vzw” }, { “activity”: “Education”, “attackdate”: “2026-10-27T12:50:13.128000+00:00”, “claim_url”: “”, “country”: “CA”, “data_size”: null, “description”: “Hospitals and Health Care Stolen data: 1 GB.”, “discovered”: “2026-10-27T13:52:40.373871+00:00”, “domain”: “www.rcoa.ca”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/UkNPQS0gUmVnZW50IENocmlzdGlhbiBPbmxpbmUgQWNhZGVteUBCb29iYSBQcm9qZWN0”, “victim”: “RCOA- Regent Christian Online Academy” }, { “activity”: “Education”, “attackdate”: “2026-10-27T12:50:13.128000+00:00”, “claim_url”: “”, “country”: “CA”, “data_size”: null, “description”: “Hospitals and Health Care Stolen data: 26 GB.”, “discovered”: “2026-10-27T12:50:26.974988+00:00”, “domain”: “www.rcoa.ca”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/UmVnZW50IENocmlzdGlhbiBPbmxpbmUgQWNhZGVteUBCb29iYSBQcm9qZWN0”, “victim”: “Regent Christian Online Academy” }, { “activity”: “Government & Defense”, “attackdate”: “2026-10-27T12:44:03.674000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Government Administration Stolen data: 155 GB.”, “discovered”: “2026-10-27T12:50:48.028915+00:00”, “domain”: “www.commercetwp.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Q2hhcnRlciBUb3duc2hpcCBvZiBDb21tZXJjZUBCb29iYSBQcm9qZWN0”, “victim”: “Charter Township of Commerce” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T12:41:26.792000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Hospitals and Health Care Stolen data: 67 GB.”, “discovered”: “2026-10-27T12:51:09.045105+00:00”, “domain”: “www.kingfamilymedical.net”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/S0lORyBGQU1JTFkgTUVESUNBTEBCb29iYSBQcm9qZWN0”, “victim”: “KING FAMILY MEDICAL” }, { “activity”: “Government & Defense”, “attackdate”: “2026-10-27T12:37:28.841000+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “Government Administration Stolen data: 151 GB.”, “discovered”: “2026-10-27T12:51:29.935495+00:00”, “domain”: “www.mybigspring.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/Q2l0eSBvZiBCaWcgU3ByaW5nQEJvb2JhIFByb2plY3Q=”, “victim”: “City of Big Spring” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T12:33:59.756000+00:00”, “claim_url”: “”, “country”: “PK”, “data_size”: null, “description”: “Medical Practices Stolen data: 22GB.”, “discovered”: “2026-10-27T12:51:50.936194+00:00”, “domain”: “www.asc-psd.com”, “group”: “Booba Project”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QWVzdGhldGljIFNwZWNpYWx0eSBDZW50cmVAQm9vYmEgUHJvamVjdA==”, “victim”: “Aesthetic Specialty Centre” }, { “activity”: “Government & Defense”, “attackdate”: “2026-10-27T11:05:08+00:00”, “claim_url”: “”, “country”: “GB”, “data_size”: null, “description”: “Bristol City Council is the local authority for Bristol, England. It provides public services for residents, businesses, and visitors, including council tax and benefits, housing, schools, social care, waste and recycling, transport, planning, parks, and libraries”, “discovered”: “2026-10-27T12:08:39.264584+00:00”, “domain”: “”, “group”: “Wallstreet”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QnJpc3RvbCBDaXR5IENvdW5jaWxAV2FsbHN0cmVldA==”, “victim”: “Bristol City Council” }, { “activity”: “Not Found”, “attackdate”: “2026-10-27T06:23:55.131861+00:00”, “claim_url”: “http:\/\/nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion”, “country”: “AE”, “data_size”: null, “description”: “retail and facility services \u00b7 United Arab Emirates | [PENDING EXPOSURE: \u00b7 The complete payroll ledger, employee records and identity document archive of a UAE services group are held.]”, “discovered”: “2026-10-27T06:24:08.482951+00:00”, “domain”: “”, “group”: “N0n”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/cd9319ce146401b8763e0b86ae1f7407.png”, “url”: “https:\/\/www.ransomware.live\/id\/Q29tcGFueSAjMTExQE4wbg==”, “victim”: “Company #111” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T04:34:32.471503+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/or-technology”, “country”: “”, “data_size”: null, “description”: “[AI generated] N\/A”, “discovered”: “2026-10-27T05:54:22.393869+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/64f93b925dcfd0a6dc595fd7add48416.png”, “url”: “https:\/\/www.ransomware.live\/id\/T1IgVGVjaG5vbG9neUBldmVyZXN0”, “victim”: “OR Technology” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T04:11:16.976476+00:00”, “claim_url”: “”, “country”: “PH”, “data_size”: null, “description”: “Once the timer reaches zero, all exfiltrated data will be published in full.”, “discovered”: “2026-10-27T04:11:17.674706+00:00”, “domain”: “datem.com.ph”, “group”: “crypto24”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/REFURU0sIEluYy5AY3J5cHRvMjQ=”, “victim”: “DATEM, Inc.” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/burris-macomber”, “country”: “”, “data_size”: null, “description”: “[AI generated] N\/A\n\nI don’t have reliable, verifiable information about a company called \”Burris & MacOmber.\” I’m not able to confirm its existence, industry, operations, or location, and providing fabricated details would be inaccurate and potentially misleading for threat intelligence purposes. If you have additional context or source material about this entity, I’d be glad to help analyze it.”, “discovered”: “2026-10-27T04:33:27.978594+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/c8c7606c7a3d0a6177fd5fe395e43928.png”, “url”: “https:\/\/www.ransomware.live\/id\/QnVycmlzICYgTWFjT21iZXJAZXZlcmVzdA==”, “victim”: “Burris & MacOmber” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/energy-storage-terminal-in-singapore”, “country”: “SG”, “data_size”: null, “description”: “[AI generated] N\/A”, “discovered”: “2026-10-27T04:32:51.124991+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/bab7871971bcb13214489ea40dee1269.png”, “url”: “https:\/\/www.ransomware.live\/id\/RW5lcmd5IFN0b3JhZ2UgVGVybWluYWwgaW4gU2luZ2Fwb3JlQGV2ZXJlc3Q=”, “victim”: “Energy Storage Terminal in Singapore” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/point-robotics”, “country”: “”, “data_size”: null, “description”: “[AI generated] N\/A\n\nI don’t have verified, reliable information about a company specifically named \”Point Robotics\” to confidently describe its operations, industry focus, or country of headquarters. Providing details without solid confirmation could result in inaccurate threat intelligence. If you have additional context\u2014such as a sector, location, or related aliases\u2014I can try again.”, “discovered”: “2026-10-27T04:32:17.013209+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/da428dad870d8b9bc674037eaa48620d.png”, “url”: “https:\/\/www.ransomware.live\/id\/UG9pbnQgUm9ib3RpY3NAZXZlcmVzdA==”, “victim”: “Point Robotics” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/natuzzi”, “country”: “IT”, “data_size”: null, “description”: “[AI generated] Natuzzi S.p.A. is an Italian manufacturer and distributor of furniture, specializing in leather and fabric upholstered sofas, chairs, and home furnishings. Founded in 1959 and headquartered in Santeramo in Colle, Italy, the company operates in the home furniture and interior design industry. Natuzzi designs, produces, and markets its products globally, selling through its own branded stores and third-party retailers across multiple countries.”, “discovered”: “2026-10-27T04:31:41.695092+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/83156c4bed385961b2e82713c22f7fd6.png”, “url”: “https:\/\/www.ransomware.live\/id\/TmF0dXp6aUBldmVyZXN0”, “victim”: “Natuzzi” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/tecna-ice”, “country”: “IT”, “data_size”: null, “description”: “[AI generated] N\/A”, “discovered”: “2026-10-27T04:31:06.242991+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/7a987e3c1e9f79576bca398cea05a9d5.png”, “url”: “https:\/\/www.ransomware.live\/id\/VEVDTkEgSUNFQGV2ZXJlc3Q=”, “victim”: “TECNA ICE” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/medisolution”, “country”: “”, “data_size”: null, “description”: “[AI generated] MediSolution was a Canadian software company based in Montreal, Quebec, specializing in enterprise resource planning and management software solutions for the public sector, including healthcare, local government, and education institutions. It provided financial management, human resources, and payroll software systems. The company operated in the enterprise software and information technology industry before being acquired and integrated into Harris Computer Systems.”, “discovered”: “2026-10-27T04:30:31.961924+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/285289e4a7b458f1d82f88889dd729b3.png”, “url”: “https:\/\/www.ransomware.live\/id\/TWVkaVNvbHV0aW9uQGV2ZXJlc3Q=”, “victim”: “MediSolution” }, { “activity”: “Healthcare”, “attackdate”: “2026-10-27T02:31:57.451543+00:00”, “claim_url”: “http:\/\/everestndkvzcibcje2cqxhre2hmmybl3rn2gwzwsblz7gx6uryn5rad.onion\/news\/sleepex-labretriever”, “country”: “”, “data_size”: null, “description”: “[AI generated] N\/A\n\nI don’t have reliable information about a company called \”SleepEx LabRetriever.\” This does not correspond to any organization I can verify, and the name’s unusual construction suggests it may be fictional, a test query, or a misspelling. I’d rather report this than fabricate details about its industry, operations, or country.”, “discovered”: “2026-10-27T04:29:56.461196+00:00”, “domain”: “”, “group”: “everest”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/e68a10c63ca76f982c48f7762eeb02b0.png”, “url”: “https:\/\/www.ransomware.live\/id\/U2xlZXBFeCBMYWJSZXRyaWV2ZXJAZXZlcmVzdA==”, “victim”: “SleepEx LabRetriever” }, { “activity”: “Retail & E-Commerce”, “attackdate”: “2026-10-27T01:35:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “Verification for Gamblinglore.com”, “discovered”: “2026-10-27T04:05:36.281691+00:00”, “domain”: “”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/Z2FtYmxpbmdsb3JlQFdoaXRlYXJtb3I=”, “victim”: “gamblinglore” }, { “activity”: “Technology”, “attackdate”: “2026-10-27T01:35:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “Verification for Gamblinglore.com”, “discovered”: “2026-10-27T03:07:40.796568+00:00”, “domain”: “”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/VmVyaWZpY2F0aW9uQFdoaXRlYXJtb3I=”, “victim”: “Verification” }, { “activity”: “Not Found”, “attackdate”: “2026-10-27T01:08:40.959377+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Country: c | Status: Sale”, “discovered”: “2026-10-27T01:08:42.042582+00:00”, “domain”: “”, “group”: “ULose”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/enpxLXRlc3RAVUxvc2U=”, “victim”: “zzq-test” }, { “activity”: “Not Found”, “attackdate”: “2026-10-27T01:08:20.994184+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “Country: zz | Status: Public”, “discovered”: “2026-10-27T01:08:22.327260+00:00”, “domain”: “”, “group”: “ULose”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/cHJvYmUtMDExNjM3Y2FiYmY5NDA3Ni1AVUxvc2U=”, “victim”: “probe-011637cabbf94076-” }, { “activity”: “Other”, “attackdate”: “2026-10-27T00:00:00+00:00”, “claim_url”: “http:\/\/genesis6ixpb5mcy4kudybtw5op2wqlrkocfogbnenz3c647ibqixiad.onion\/588a61e90b5fb4080fb6\/”, “country”: “US”, “data_size”: null, “description”: “Provides Laboratory Services.”, “discovered”: “2026-10-28T20:53:55.445216+00:00”, “domain”: “ablabs.com”, “group”: “genesis”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/fc37f44c451e351737df262f563e617a.png”, “url”: “https:\/\/www.ransomware.live\/id\/QSZCIExhYkBnZW5lc2lz”, “victim”: “A&B Lab” }, { “activity”: “Education”, “attackdate”: “2026-10-27T00:00:00+00:00”, “claim_url”: “”, “country”: “”, “data_size”: null, “description”: “We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That’s the whole reason why we came about and we plan to keep it that way.”, “discovered”: “2026-10-27T18:50:58.721566+00:00”, “domain”: “”, “group”: “BYOD”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VVBEQVRFOiBVTk1AQllPRA==”, “victim”: “UPDATE: UNM” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-27T00:00:00+00:00”, “claim_url”: “http:\/\/u6lieui2dakbctcjea2bz4r4q32r7t36nwljovqbv7mxs6o2smgxixid.onion\/blog\/greenbergfarrow-36210065”, “country”: “”, “data_size”: null, “description”: “[architecture] GreenbergFarrow \u2014 a respected ESOP-owned architecture firm headquartered in Atlanta, Georgia with offices in Charlotte, Dallas, Los Angeles, New York, Myrtle Beach, and international operations in Mexico, Colombia, India, and Canada.\n\nThe dataset spans three major divisions:\n\nClient Libraries (152 client folders, A\u2013F): Proprietary architectural designs, prototypes, and specifications for major retail chains, banks, and restaurant brands including Circle K, Capital One, 7-Eleven, Chase Bank, Chipotle, Comcast, Bath & Body Works, and DSW.\nCorporate Library: The entire institutional memory \u2014 24 years of accounting (invoicing, cleared checks, budgets from 2002\u20132026), administration (7 acquisitions, active litigation, ESOP governance, FBI clearance, employment agreements), and 72 GB of proprietary CAD standards.\nDiscipline Libraries (283 GB): Complete architecture reference library.\nThe exposed material includes:\n\n300\u2013650+ individuals’ personal data \u2014 SSNs from three years of payroll tax returns, 57+ W-9 forms, employee censuses with DOBs\/salaries\/home addresses, and an employee’s complete termination package including Medicare enrollment and voicemail recording.\n\n7,450+ cleared check images with routing numbers, account numbers, payee details, and authorised signatures spanning 2014\u20132023.\nComplete active litigation file for GF v. Storm\/RFW (1:25-cv-03532) \u2014 complaint, amended complaint, answers to interrogatories, discovery requests and responses, settlement negotiations, D&O insurer correspondence, and engagement letters. The entire attorney-client privilege chain.\nFBI facility clearance documents \u2014 SF 328 (Certificate Pertaining to Foreign Interests), DD 441 (Facility Clearance), Key Management Personnel lists, and SCIF project architectural drawings acquired through DBI Architects.\nComplete acquisition records for 7 deals (5 completed + 2 in progress) including purchase prices, due diligence materials, certified financial statements, and wire instructions.”, “discovered”: “2026-10-27T12:11:30.054574+00:00”, “domain”: “GreenbergFarrow”, “group”: “aurora”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/05f99de96bbfa124d6f8c2ab26891b8d.png”, “url”: “https:\/\/www.ransomware.live\/id\/R3JlZW5iZXJnRmFycm93QGF1cm9yYQ==”, “victim”: “GreenbergFarrow” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-27T00:00:00+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=72e067c2-9c4e-48b2-8618-0e18161f2d3b”, “country”: “US”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-27T10:38:24.936262+00:00”, “domain”: “www.nuvista.org”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/65c05bd536aae6e1bc2bff5094f86edf.png”, “url”: “https:\/\/www.ransomware.live\/id\/TnVWaXN0YSBGZWRlcmFsIENyZWRpdCBVbmlvbkBxaWxpbg==”, “victim”: “NuVista Federal Credit Union” }, { “activity”: “Financial Services”, “attackdate”: “2026-10-27T00:00:00+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=300a350a-8537-417a-951f-c301e051f9b2”, “country”: “US”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-27T10:37:43.635167+00:00”, “domain”: “www.hlefcu.com”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/SGF3YWlpIExhdyBFbmZvcmNlbWVudCBGZWRyYWwgQ3JlZGl0IFVuaW9uQHFpbGlu”, “victim”: “Hawaii Law Enforcement Fedral Credit Union” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-26T23:07:53.024727+00:00”, “claim_url”: “”, “country”: “US”, “data_size”: null, “description”: “[AI generated] Morrison Cohen LLP is a United States law firm headquartered in New York City. It provides legal services across practice areas including corporate law, litigation, bankruptcy and restructuring, real estate, intellectual property, and white-collar defense. The firm serves corporate clients, financial institutions, and individuals. It operates within the legal services industry, primarily serving businesses in the New York metropolitan area and nationally.”, “discovered”: “2026-10-26T23:07:56.396007+00:00”, “domain”: “”, “group”: “SilentRansomGroup”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TW9ycmlzb24gQ29oZW5AU2lsZW50UmFuc29tR3JvdXA=”, “victim”: “Morrison Cohen” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-26T20:26:45.941160+00:00”, “claim_url”: “http:\/\/rhysidafohrhyy2aszi7bm32tnjat5xri65fopcxkdfxhi4tidsg7cad.onion\/archive.php?company=287”, “country”: “MY”, “data_size”: null, “description”: “MISC Group Incorporated in 1968, MISC Group is a world leading provider of international energy-related maritime solutions and services.29,841 files , 28.4 GBComplete command workstations: Master, Chief Officer and Bridge user folders – 16,918 files \/ 15.5 GB, including PST mail archives;Crew personal data (PDPA breach): IMO FAL Form 5 crew lists for ~30 seafarers with passport numbers (Malaysia\/Philippines\/Indonesia\/India), Seafarer Employment Agreements with DOB, home addresses and salaries, a full scan of the 4th Officer’s PRC passport;Every ship’s password: ECDIS, CCTV, AIS, fire & gas alarm panels, door access codes, the Ship Security Plan (ISPS) password, NS5\/Dualog mail accounts, domain admin credentials, OCIMF\/SIRE web account;Internal investigations: complaint against the Chief Engineer (on-board assault\/harassment, 25.08.2026), FR-HR25 investigative report;Incidents: vessel listing during (de-)ballasting – twice, one incident not reported to the flag state; a series of near-misses (VDR sensor failure, radar misuse during collision avoidance);Compliance gap: ~20 internal ISM non-conformities (rusted cargo pipelines, HV gloves expired since 2021) vs ‘clean’ statutory ABS audits of 17.10.2025; Japan PSC deficiency (Himeji, 09.12.2025) + Statements of Fact from 4 officers;Drydock & charter documentation: repair specs (SQLite MSL), ExxonMobil\/APLNG delivery & redelivery certificates, CTMS custody-transfer data, full e-docs and ship plans More”, “discovered”: “2026-10-26T20:27:18.651315+00:00”, “domain”: “”, “group”: “rhysida”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/TUlTQyBHcm91cEByaHlzaWRh”, “victim”: “MISC Group” }, { “activity”: “Retail & E-Commerce”, “attackdate”: “2026-10-26T20:14:00+00:00”, “claim_url”: “http:\/\/emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion\/post\/afflelou\/”, “country”: “FR”, “data_size”: null, “description”: “Alain Afflelou is a leading European franchisor of optical and hearing aid products, founded in France in 1972. The company operates a robust network of over 1,500 stores across 20 countries, driven by aggressive marketing innovations like its famous \”Tchin-Tchin\” multi-pair offer.\n\nKey Figures\n\n\u2022 Network Revenue: \u20ac1.13 billion (TTC) for the fiscal year ending July 2025\n\u2022 Corporate Revenue: \u20ac447.3 million (excl. taxes), generated from corporate stores and franchise fees.\n\u2022 Core Segments: Eyewear and audioprosthetics. [Sector: Retail]”, “discovered”: “2026-10-26T21:52:29.796720+00:00”, “domain”: “”, “group”: “emperador”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/55b6a580bfa769197c5c3ba3651d16f4.png”, “url”: “https:\/\/www.ransomware.live\/id\/QWZmbGVsb3VAZW1wZXJhZG9y”, “victim”: “Afflelou” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-26T18:56:53.931744+00:00”, “claim_url”: “http:\/\/nongzecboljwv3yfndkggsybsglfrkffw7bvk2zemuteoxe6etpusnad.onion#v-ingelectus”, “country”: “ES”, “data_size”: null, “description”: “smart grid engineering firm \u00b7 Spain | Live electrical telemetry sampled from the plant control network, with voltage, current and energy readings recorded on 23 October 2026; Complete inventory of 49 network devices including substation switches, remote terminal units, power meters and server management controllers, with locations and firmware details; Full maps of the internal control network segments and message broker metrics that carry the plant data | [NOT PAID \u2014 EXPOSED]”, “discovered”: “2026-10-26T18:57:11.389460+00:00”, “domain”: “”, “group”: “N0n”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/b3eae9ab84f99feeb8a1c3db2ae5b12e.png”, “url”: “https:\/\/www.ransomware.live\/id\/SW5nZWxlY3R1cyBJbm5vdmF0aXZlIEVsZWN0cmljYWwgU29sdXRpb25zIFMuTC5ATjBu”, “victim”: “Ingelectus Innovative Electrical Solutions S.L.” }, { “activity”: “Professional Services”, “attackdate”: “2026-10-26T16:53:26.015814+00:00”, “claim_url”: “http:\/\/i7loab6thvz4lb7jdr3qoeumbvilwhbgnwsctnlfmvsv7g5s3vsiw6yd.onion\/downloads\/beasleyallen.7z”, “country”: “US”, “data_size”: null, “description”: “Plaintiff litigation law firm – Our 214 GB extraction includes executed agreements, final settlement participation agreements, court-signed stipulations regarding net worth, privileged internal memos, detailed litigation strategies, rough trial transcripts, comprehensive staff FAQs and much more.”, “discovered”: “2026-10-26T16:54:28.340940+00:00”, “domain”: “”, “group”: “Falcon”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QmVhc2xleSBBbGxlbiBMYXcgRmlybUBGYWxjb24=”, “victim”: “Beasley Allen Law Firm” }, { “activity”: “Other”, “attackdate”: “2026-10-26T16:45:00+00:00”, “claim_url”: “http:\/\/whitearz6uvtfdefgsc4r3mzmyswtte65k5umcmv6cu6zhi4l5k4irad.onion”, “country”: “”, “data_size”: null, “description”: “Gamdom is an unregulated crypto casino and sportsbook founded in 2016. It recently suffered a hot-wallet breach, with founder Felix Romer reporting over $3 million in losses, though on-chain analysts estimate the damage closer to $4.2 million.\n\nWe hold Gamdom’s full user database, 15,420,003 accounts with 146 columns, with Gamdom’s total combined profit value exceeding $1 billion.\n\nThe way in was something internal, a machine account that was already sitting in their admin side (Metawin). \nIssued years back, nobody ever rotated it. Never meant to leave the building. \nIt had admin reach, and everything after that was their own stuff anyway, their control panels and secret stores.\n\nAbout your provably fair: what it promised and what it delivered were never the same thing.\n\nWe demand $15,000,000 in BTC.\n\nEmails with instructions will be sent to you directly.\n\nTo verify, a sample can be found below.”, “discovered”: “2026-10-26T18:00:10.433408+00:00”, “domain”: “”, “group”: “Whitearmor”, “press”: null, “ransom”: null, “screenshot”: “https:\/\/images.ransomware.live\/victims\/716108c3c9ba2b1421f15ec8afef3956.png”, “url”: “https:\/\/www.ransomware.live\/id\/R2FtZG9tQFdoaXRlYXJtb3I=”, “victim”: “Gamdom” }, { “activity”: “Energy & Utilities”, “attackdate”: “2026-10-26T12:03:24.836597+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=c054af1f-76e8-4498-a937-7b0b8b7a1869”, “country”: “US”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-26T12:03:57.071068+00:00”, “domain”: “www.deltaepa.com”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/RGVsdGEgRWxlY3RyaWMgUG93ZXIgQXNzb2NpYXRpb25AcWlsaW4=”, “victim”: “Delta Electric Power Association” }, { “activity”: “Manufacturing”, “attackdate”: “2026-10-26T12:02:31.273225+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=ccf753d0-cb74-4b6c-ba5d-fffb06b082bc”, “country”: “GB”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-26T12:03:03.384731+00:00”, “domain”: “www.bangorwholesalelaminates.com”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/QmFuZ29yIFdob2xlc2FsZSBMYW1pbmF0ZXNAcWlsaW4=”, “victim”: “Bangor Wholesale Laminates” }, { “activity”: “Technology”, “attackdate”: “2026-10-26T12:01:29.082696+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=d5152f36-9281-4b50-9136-837e59866db4”, “country”: “ES”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-26T12:02:01.285949+00:00”, “domain”: “www.teletronic.es”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/VGVsZVRyb25pY0BxaWxpbg==”, “victim”: “TeleTronic” }, { “activity”: “Other”, “attackdate”: “2026-10-26T12:00:35.798859+00:00”, “claim_url”: “http:\/\/ijzn3sicrcy7guixkzjkib4ukbiilwc3xhnmby4mcbccnsd7j2rekvqd.onion\/site\/blog?uuid=49e05aaa-52a8-47cb-9d45-7d3bd4d4c1ce”, “country”: “DE”, “data_size”: null, “description”: “N\/A”, “discovered”: “2026-10-26T12:01:07.997083+00:00”, “domain”: “www.appl.de”, “group”: “qilin”, “press”: null, “ransom”: null, “screenshot”: “”, “url”: “https:\/\/www.ransomware.live\/id\/RklSTUVOR1JVUFBFIEFQUEwgSG9sZGluZyBHbWJIQHFpbGlu”, “victim”: “FIRMENGRUPPE APPL Holding GmbH” } ]