| 2026-11-11 21:03:23.592293 |
Kadick |
deadlock |
Kadick Integrated Limited is a Nigerian company that offers agency banking, IT solutions, airtime distribution, procurement, and financial services. The company specializes in connecting businesses and individuals to platforms that streamline digital sales and local financial transactions. |
Link |
| 2026-11-11 19:48:28.833855 |
EiCOh |
the gentlemen |
eicoh.com EICOH Co., Ltd. (株式会社エイコー) is a Japanese IT and office solutions company founded in 1972 in Osaka by Yamada Goichi, now with dual headquarters in Osaka and Tokyo, 430 employees and annual revenue of 13.5 billion yen. Led by President Sakai Taihei since March 2024, it provides office equipment optimization, digital transformation, cybersecurity, paperless workflow and sales enablement services for major Japanese corporations. The company holds 25 government construction licenses covering civil engineering, telecommunications, electrical and building works. It operates subsidiaries in renewable energy (Eiko Energio with 2.2 MW solar capacity), media and regional services across Kinki, Kanto, Kyushu and Tohoku. Its history spans copier sales in the 1970s, fax boom in the 1980s, system integration in the 1990s and green energy since 2000. The company celebrated 50 years in 2024 and launched a new mission, vision and values under its new president. |
Link |
| 2026-11-11 19:25:14.458318 |
Vinson |
the gentlemen |
vinsonprocess.com Revenue $296.3 Million Vinson Process Systems Company is an American process equipment and engineering firm founded in 1972 in Tulsa, Oklahoma, with over 54 years of experience serving the oil, gas, chemical and petrochemical industries. With approximately 300 to 500 employees across 10 offices in major US energy basins including Houston, Midland, Denver and Williston, it provides separation, heat transfer, compression, pumping and water treatment systems. The company partners with over 50 equipment manufacturers including Emerson, Ariel, Flowserve and Cameron to deliver turnkey process solutions. Its services span process engineering, equipment selection, skid-mounted system integration, commissioning and field service. Family-owned since its founding, it serves upstream, midstream and downstream sectors across North America with modular and custom-designed process packages. |
Link |
| 2026-11-11 19:21:24 |
atlashp.com |
curious worm |
Atlas Healthcare Partners specializes in partnering with health systems and physicians to develop, manage, and invest in Ambulatory Surgery Centers (ASCs). They are recognized as a trusted advisor, providing industry expertise to enhance patient experience and care quality. The company offers a unique partnership model that empowers nonprofit health systems and physicians to control financial growth and care quality. |
Link |
| 2026-11-11 19:21:24 |
marquiscompanies.com |
curious worm |
Marquis Companies is a family-owned provider of senior living and care solutions, offering a range of services including assisted living, memory care, post hospital care, and home health care. Established in 1989, the company focuses on delivering personalized care plans tailored to the unique needs of each resident. Their award-winning facilities are staffed by dedicated professionals who ensure high-quality, person-centered care in a comfortable environment |
Link |
| 2026-11-11 19:21:24 |
safcodental.com |
curious worm |
Safco Dental Supply LLC specializes in providing a wide range of dental supplies, products, and equipment, including restorative and cosmetic dentistry supplies, endodontics, orthodontics, and infection control products. They cater to dental professionals by offering over 20,000 products, expert support, and efficient shopping solutions. The company also provides comprehensive dental equipment services and customized financing solutions to support dental practices. With a focus on reliability and safety, Safco aims to enhance patient care and streamline operations for dental professionals. |
Link |
| 2026-11-11 19:21:24 |
lifelinescreening.com |
curious worm |
Since 1993, Life Line Screening has brought clinical-grade preventive testing to communities across America. More than 11 million people have trusted us with their health. |
Link |
| 2026-11-11 19:21:24 |
raleighortho.com |
curious worm |
Raleigh Orthopaedic is a leading provider of comprehensive orthopedic care in Wake County, NC, offering both conservative and surgical treatment options. With over 100 years of experience, the practice specializes in various areas including sports medicine, joint replacement, and physical therapy. They serve a diverse clientele, including patients of all ages, and operate multiple locations for convenient access to care. The team of 27 physicians performs over 9,000 procedures annually, ensuring personalized treatment plans for each patien |
Link |
| 2026-11-11 19:21:24 |
baronandbudd.com |
curious worm |
Baron & Budd is a prominent plaintiffs law firm specializing in mesothelioma cases, class actions, and drug injury claims. With over four decades of experience, they advocate for victims harmed by asbestos and other toxic substances, providing free consultations and working on a contingency fee basis. Their services extend to various legal areas, including environmental litigation and serious accidents, aiming to protect communities and secure compensation for clients |
Link |
| 2026-11-11 19:21:24 |
shannonhealth.com |
curious worm |
Shannon Medical Center is a community-owned health system in West Texas, dedicated to providing exceptional healthcare services to residents. |
Link |
| 2026-11-11 19:21:24 |
sbhny.org |
curious worm |
SBH Health System provides nonsectarian, and acute care, and community hospital care services. SBH Health System is based in the Bronx |
Link |
| 2026-11-11 19:21:24 |
sacheminc.com |
curious worm |
SACHEM, Inc. is a global leader in high-purity chemical solutions, specializing in the production of precise and pure products for various applications. The company offers a wide range of products including electronic materials, specialty chemicals, and energy materials, catering to clients in Europe, Asia, and America. SACHEM also provides customized manufacturing, R&D support, and consulting services to meet the specific needs of its customers. With advanced laboratories and a strong regional support system, SACHEM is committed to delivering high-quality solutions and fostering innovation |
Link |
| 2026-11-11 15:36:29.943148 |
Prinsel |
the gentlemen |
prinsel.com.mx Productos Infantiles Selectos S.A. de C.V. (PRINSEL) is a Mexican children's products company founded in 1960 in Toluca de Lerdo, State of Mexico, with 66 years of experience manufacturing and distributing children's footwear, clothing and accessories. With approximately 200 to 500 employees, it serves the Mexican market through retail stores and distribution networks. Its product range covers shoes, clothing, baby items and school supplies for children from newborns to age 16. The company also operates in real estate and building management through subsidiary structures. Its motto is Quality and Trust for Your Children, reflecting decades of brand recognition among Mexican families. Based in the State of Mexico, it remains one of the oldest and most established children's product companies in the country. |
Link |
| 2026-11-11 15:12:44.494040 |
Solarium |
the gentlemen |
solarium.com.br Solarium Revestimentos is a Brazilian manufacturer and distributor of ceramic tiles, porcelain, mosaics and decorative wall panels based in São Paulo with over 20 years of market presence. Its product range covers porcelain tiles in marble, concrete, wood and natural stone finishes from 30x30 to 120x260 centimeter formats for residential and commercial projects. With approximately 50 to 150 employees and estimated revenue of 20 to 50 million reais, it distributes through builders, retail chains like Leroy Merlin and its own showrooms across Brazil. The company operates its own manufacturing facility with in-house quality control and ABNT certification. Its portfolio includes decorative panels, geometric patterns, tropical designs and minimal collections alongside standard ceramic and porcelain. Key sectors are residential construction, commercial interiors and hospitality projects. |
Link |
| 2026-11-11 15:12:43.590470 |
National Agency Programmes and Mobility |
the gentlemen |
na.org.mk The National Agency for European Educational Programmes and Mobility is a government institution in Skopje, North Macedonia, established in 2006 to administer EU education and mobility programs including Erasmus+, Erasmus Mundus and the European Solidarity Corps. Over 20 years it has managed more than 2,500 projects involving 50,000 plus mobile participants and administering over 200 million euro in EU grants. Its activities cover higher education, vocational training, school education, youth and sport through Erasmus+ Key Actions 1, 2 and 3. The agency partners with over 1,000 organizations including universities, schools, NGOs and companies across 33 Erasmus+ countries. It also operates Eurodesk, eTwinning and Youthpass platforms for youth information and certification. Led by a director and board appointed by the Ministry of Education, it serves as North Macedonia's official Erasmus+ national coordinator. |
Link |
| 2026-11-11 15:00:33.600370 |
Burgess Lowman CPAs |
the gentlemen |
bllcpas.com Burgess Lowman Lay CPAs is an American accounting firm based in Wilmington, North Carolina, with over 50 years of experience serving small and medium businesses, nonprofits and individuals. With approximately 20 to 30 professionals, it provides tax preparation and planning, bookkeeping, audits, reviews and business advisory services. Its client base includes manufacturing, real estate, healthcare, nonprofit organizations and high-net-worth individuals across southeastern North Carolina. Specialized offerings include employee benefit plan audits, single audits, IRS representation, business valuation and outsourced CFO services. The firm operates under the motto More Than Just Numbers, emphasizing strategic advisory beyond traditional compliance. Founded by its three named partners Burgess, Lowman and Lowman, it has built a deep reputation in the Wilmington business community. |
Link |
| 2026-11-11 14:48:21.257788 |
Alan Mok Engineering |
the gentlemen |
alanmokengineering.com Alan Mok Engineering Pte Ltd is a Singapore-based mechanical and electrical engineering contractor founded in 2000, providing HVAC, plumbing, fire protection, electrical and low voltage systems for commercial, industrial, marine and institutional projects. With 100 to 200 employees and estimated revenue of 10 to 30 million Singapore dollars, it delivers full-cycle M&E services from design through commissioning and maintenance. Its specializations include chillers, ducting, sprinkler systems, electrical distribution, lightning protection and marine HVAC. The company holds BCA accreditation and bizSAFE certification with ISO 9001, 14001 and 45001 standards. Projects span condominiums, office towers, factories, hospitals, schools and shipyards across Singapore. Led by founder Alan Mok, it has built a 26-year track record in Singapore's competitive M&E engineering market. |
Link |
| 2026-11-11 14:36:44.723938 |
Triad Architects |
the gentlemen |
triad.co.ke Triad Group is a Kenyan digital marketing and technology company founded in 1993 in Nairobi, making it one of the oldest and largest digital agencies in East Africa with 200 plus employees and 500 plus clients. It operates across five divisions: digital marketing, creative and design, technology, strategy and media, with offices in Kenya, Tanzania and Uganda. Its client roster includes major multinational brands like Unilever, Coca-Cola, Safaricom, KCB and Toyota alongside government agencies and NGOs. Services span branding, video production, SEO, social media, software development, AI and machine learning, data analytics and media planning. The company positions itself at the intersection of creativity and technology with a full-service model from strategy to execution. Revenue is estimated in the multi-million dollar range with regional expansion across East Africa. |
Link |
| 2026-11-11 14:24:59.595907 |
National Investments Company |
the gentlemen |
ninv.com National Investments Company (NIC) is one of Kuwait's leading investment firms, founded in 1987 and listed on Boursa Kuwait as NINV, managing 4.3 billion dollars in assets across four segments: investment, treasury, real estate and asset management. Led by CEO Fahad Abdul Al Mukhaizim, it employs 161 people across its Kuwait City headquarters and Dubai DIFC office. In 2026 it reported net profit of KWD 10.6 million for the first 9 months with AUM reaching KWD 1.4 billion and total return of 545 percent since 2019 versus 122 percent for the Kuwait index. It executed the Trolley General Trading IPO with 15.2x oversubscription and the Ali Alghanim Sons IPO, the largest in Kuwait in over a decade. Recognized by Euromoney as Best Investment Bank in Kuwait for Equity Capital Markets three consecutive years. Its strategy targets becoming a leading regional investment firm by 2029 through international expansion, alternative investments and strategic global partnerships. |
Link |
| 2026-11-11 14:12:34.947551 |
Municipalidad de Cieneguilla |
the gentlemen |
municieneguilla.gob.pe Municipalidad Distrital de Cieneguilla is the local government of the Cieneguilla district in Lima Province, Peru, serving approximately 100,000 residents in a growing agricultural and tourism area along the Río Lurín. Led by Mayor Emilio Alberto Chávez Huaringa with 42 employees, it operates a digital services platform including virtual document submission, property tax queries, pet registration and sports facility booking. Key projects include the 2027–2029 Multi-Year Investment Plan, participatory budgeting and an inter-agency initiative to recover the Río Lurín ecosystem. The municipality promotes Cieneguilla as a natural refuge near Lima through a dedicated tourism portal showcasing local gastronomy, agriculture and outdoor activities. Transparency measures include a public accountability portal, public hearings and annual reporting to the Comptroller General. Staff grew by 162 percent as the municipality expanded digital and social inclusion programs. |
Link |
| 2026-11-11 14:12:34.143789 |
Grupo San Cristobal |
the gentlemen |
gruposancristobal.com.mx Grupo San Cristóbal is a Mexican group of companies based in Mexico City, founded by Cristian Montalvo Flores, offering property management, accounting, construction, insurance and legal services across 10 plus business units. With over 250 employees, 500 clients and 2,800 properties under management, it provides full-cycle services for property owners and businesses. Its property management division handles condominium administration, maintenance, security, budgeting and owner meetings. Accounting services include bookkeeping, tax filings, payroll and audits for Mexican businesses. The construction arm delivers new builds, remodeling and preventive maintenance. The group's motto is Your Happiness Is Our Business, and it continues expanding its service portfolio across Mexico. |
Link |
| 2026-11-11 14:12:33.339294 |
Groupe Alternance |
the gentlemen |
groupe-alternance.com Groupe Alternance is a French private education group founded in 2008 in Paris, offering work-study (alternance) programs across 5 schools with 10,000 plus students, 300 plus staff and 1,200 plus partner companies. Its model lets students earn a salary while their employer pays for their education, covering Bachelor, BTS and MBA programs in management, marketing, finance, HR, logistics, tourism and sport management. Key schools include ESAM, EFB, ECE, IPAC and the Institut de Management International, with campuses in Paris, Lyon, Marseille, Toulouse, Lille, Bordeaux and Strasbourg. Programs run through apprenticeship and professionalization contracts with companies covering tuition costs. Graduates receive state-recognized diplomas from Bac+2 to Bac+5. Its motto is that training should cost nothing and earn everything, positioning it as a new generation of business schools. |
Link |
| 2026-11-11 14:12:32.552237 |
Sielke |
the gentlemen |
sielke.com Sielke is a German family company founded in 2002 in Hamburg, operating two brands: Sielke Papier for paper, packaging and office supplies, and Sielke Home for stylish home and living products. Headquartered at Dynamowerk 1 in Hamburg-Harburg, it has been serving businesses and consumers for 23 years. Sielke Papier provides a full range from printing and kraft paper to custom packaging solutions with sustainable FSC-certified options. Sielke Home offers decoration, kitchen, bath, wellness and gift products under the motto You Are Home. The company is estimated at 2 to 10 million euro in revenue with a small team of 20 to 50 employees. |
Link |
| 2026-11-11 14:12:31.703266 |
imas |
the gentlemen |
imas.es I-Mas Informatica S.L. is a Spanish IT services company founded in 2002 in Sabadell, Barcelona, specializing in custom software development, cloud solutions, ERP implementation, cybersecurity and managed IT services. With 50 to 120 employees and estimated revenue of 3 to 8 million euro, it serves small and medium businesses, industrial companies and public sector clients across Catalonia and Spain. Its technology stack includes SAP, Odoo, Microsoft Dynamics, AWS, Azure, React, Java and Python. Services span web and mobile development, cloud migration, business intelligence, network management and VoIP telephony. The company positions itself as a full-service technology partner for businesses in the Vallès Occidental region and beyond. Its 24-year track record covers manufacturing, retail, healthcare, education and logistics sectors. |
Link |
| 2026-11-11 14:00:53.172100 |
City of Humboldt |
the gentlemen |
humboldt.ca City of Humboldt is a municipality in central Saskatchewan, Canada, founded in 1905 and named after scientist Alexander von Humboldt, with approximately 6,500 residents and a regional catchment of 30,000 people. It is the 13th city of Saskatchewan, located 117 km east of Saskatoon at the heart of the province's Iron Triangle agricultural and potash mining region. Its landmark project is a $40 million wastewater treatment facility completed in March 2026, funded $25 million by federal and provincial ICIP grants and $15 million by the city. Led by Mayor Rob Muench and outgoing City Manager Joe Day who retires in August 2026 after nearly a decade, the city employs 100 to 200 people across police, fire, water, recreation and public works. Major employers include Nutrien and BHP potash mines, Schulte Industries and Bourgault Industries agricultural manufacturers. The city runs a balanced water utility at 103 percent revenue coverage and has increased its debt limit to $20 mill. |
Link |
| 2026-11-11 14:00:52.366838 |
Reso Tech Laurentides |
the gentlemen |
resotechlaurentides.com Reso & Tech Laurentides is a Canadian industrial engineering company founded in 2001 in Saint-Jérôme, Quebec, specializing in the design and manufacture of specialized machinery, automation systems and robotic cells for automotive, aerospace, pharmaceutical and food industries. With approximately 150 employees and over 1,500 completed projects exported to more than 20 countries, it offers full-cycle services from concept design through manufacturing, commissioning and maintenance. Its capabilities span PLC and SCADA automation, industrial robotics, machine vision, test systems and custom assembly lines. The company operates from its main facility in Saint-Jérôme with commercial offices in Laval and Toronto. Revenue is estimated at 30 to 50 million dollars. Its automotive clients include major North American manufacturers while its aerospace and pharmaceutical projects demand precision engineering and sterile environments. |
Link |
| 2026-11-11 14:00:51.538362 |
Darr Equipment |
the gentlemen |
darrequipment.com Revenue $304.6 Mil Darreq Equipment is a specialty equipment rental company founded in 2010 in Denver, Colorado, with a second office in Bozeman, Montana, serving the Mountain West region including Colorado, Wyoming and Montana. With 50 to 100 employees and estimated revenue of 10 to 25 million dollars, it provides mobile generators, transformers, chillers, dehumidifiers, compressors, light towers and temporary infrastructure for construction, oil and gas, mining, healthcare and data center clients. It distinguishes itself from mass-market rental companies like United Rentals by focusing on specialized high-demand equipment for complex projects. The company operates its own delivery fleet with 24/7 emergency response capability. Key sectors include large-scale construction, energy projects, disaster recovery and data center cooling. Its niche approach avoids direct competition with national rental giants while serving demanding industrial clients in the Mountain West. |
Link |
| 2026-11-11 13:48:35.402258 |
MEGATRANS |
the gentlemen |
megatrans.com.ar Megatrans S.A. is an Argentine road freight and logistics company founded in 1991 in Lanús, Buenos Aires, with 35 years of experience in general, heavy and dangerous goods transportation across Argentina and Mercosur. With over 200 employees and a fleet of 150 plus trucks, it operates regional terminals in Rosario, Córdoba, Neuquén and Mendoza with GPS-tracked vehicles. Its specialized services include ADR-certified dangerous goods transport for chemical, pharmaceutical and oil and gas industries alongside food and automotive logistics. The company holds CNRT and RUTA Seguro 837 certifications and provides full-cycle logistics including warehousing, customs clearance and insurance. International routes cover Brazil, Chile, Uruguay, Paraguay and Bolivia. Major clients include YPF, BASF, Arcor, Toyota Argentina, Carrefour and Techint. |
Link |
| 2026-11-11 13:48:34.525675 |
United Pharmacy |
the gentlemen |
unitedpharmacy.sa United Pharmaceuticals Company is Saudi Arabia's third largest pharmacy chain, founded in 1990 in Jeddah by Sheikh Dr. Mohammed Al Yassin, with 450 plus branches across 80 cities and over 1,100 employees in 8 countries. It holds a 10 percent market share and targets 15 percent by 2027 through aggressive expansion, including the SAR 100 million acquisition of Kunooz Pharmacies in February 2026 and plans to open 100 new branches this year. Led by CEO Khalid Yassin since January 2024, it was awarded Great Place to Work in Saudi Arabia in 2024 and 2025. Its mobile app has 656K installs with a 4.71 star rating and offers cash on delivery, Tamara installment plans and insurance prescription dispensing. Strategic MoUs with Sudair Pharma and PPI Company aim to expand access to innovative medicines. The company competes with Nahdi (1,207 stores) and Al Dawaa (954 stores) but grows fastest among the top three. |
Link |
| 2026-11-11 13:48:33.719625 |
Clancy Systems International |
the gentlemen |
clancysystems.com Clancy Systems International is an American parking technology company founded in 1978 in Englewood, Colorado, with over 10,000 parking systems installed in more than 500 cities across the United States and Canada. With approximately 130 employees and estimated revenue of 25 to 50 million dollars, it provides pay stations, parking software, license plate recognition and smart city solutions. Its ParkEngine cloud platform handles real-time parking management, enforcement, permits and revenue analytics. The company offers solar-powered stations, ADA-compliant units and EV charging integration alongside mobile payment options. It is one of the oldest and largest parking technology providers in North America with 48 years of continuous operation. Services span installation, maintenance, 24/7 support and consulting for municipal and private parking operators. |
Link |
| 2026-11-11 13:48:32.870692 |
Orennia |
the gentlemen |
orennia.com Orennia is a Canadian energy intelligence platform founded in 2021 in Calgary, providing data analytics for solar, wind, battery storage, hydrogen, carbon capture, transmission and crypto mining sectors. With 116 employees and 1,000 plus platform users, it has raised 35 million dollars from General Catalyst and other investors, generating estimated revenue of 18.7 million dollars with 30 percent annual growth. Led by founder and CEO Brooke Coleman, its platform combines project databases, market intelligence, interconnection queue tracking and AI-powered predictive analytics. Clients include utilities, renewable developers, private equity, hedge funds and banks across North America. Its unique Interconnection Queue Tracker covers every major grid operator in the US and Canada. The company is based in Calgary with a second office in Toronto and competes with Enverus, Wood Mackenzie and Bloomberg NEF. |
Link |
| 2026-11-11 13:36:29.136345 |
Esri South Africa |
the gentlemen |
esri-southafrica.com sri South Africa is the exclusive distributor of Esri's ArcGIS geospatial platform in southern Africa, founded in 1989 in Midrand with 206 employees across 5 offices and over 2,000 clients. Led by Managing Director Patrick McKivergan, it serves government, utilities, mining and banking sectors with major projects like the City of Cape Town CityMap Viewer and ESKOM asset management. Its Esri South Africa College offers an NQF Level 6 Diploma in GISc&T and is the only Esri accredited learning center in the region. The company holds B-BBEE Level 1 status and runs free GIS training for unemployed youth. It participates in the Map Africa Initiative with Microsoft and Space42 to map all 54 African countries. Revenue is estimated at 23.2 million dollars with government contracts including a R34 million deal with DFFE. |
Link |
| 2026-11-11 02:08:01.782826 |
https://www.jnattorney.com/ |
inc ransom |
3 TB of data, 200,000 passports from various countries, and 800,000 files — a data breach affecting multi-billion-dollar companies. were personal data, Social Security numbers (SSN), non-disclosure agreements (NDAs), contracts, salary information, payment records, and internal confidential documentation from corporations with multi-billion-dollar turnovers, as well as evidence of schemes related to the provision of immigration services, strategic plans, and more. |
Link |
| 2026-11-11 02:07:58.984019 |
MTM&O Gold Refinery DMCC |
dark project |
As a result of a hacker attack on one of the region’s largest gold refineries, documents were stolen. These included employee passports and other documents, as well as the company’s know-how and technologies, and confidential information totaling more than 43 GB. |
Link |
| 2026-11-11 02:07:58.105050 |
Bear Valley Community Hospital |
dark project |
A Bear Valley Community Hospital suffered a cyberattack leading to the theft of over 400 GB of sensitive data. As a result of the data breach, employee data, the company’s confidential financial information, bank documents, patients’ personal documents, Social Security numbers, medical records, medical histories, and surgical records were stolen. |
Link |
| 2026-11-10 22:33:24.579356 |
Roane Transportation Services |
inc ransom |
# ROANE TRANSPORTATION SERVICES, INC.
## Rockwood, Tennessee | DOT# 652055 | roanetrans.com
---
### YOUR COMPANY HAS BEEN COMPROMISED
We have obtained complete access to your internal file systems and extracted a full copy of your corporate data. This includes all divisions: **Roane Transportation Services (RTS)**, **Roane Logistics (RLI)**, **Roane Metal Group (RMG)**, **Roane Specialized**, and **B&W**.
This is not a bluff. Below is a summary of what we hold.
---
### DATA IN OUR POSSESSION
**EMPLOYEE PERSONAL DATA**
- 262 employee files containing Social Security Number scans (PDF), driver's licenses (CDL), DOT medical examination cards, drug screening results, I-9 employment verification forms, background check reports (PSP/MVR), tax withholding forms, and direct deposit authorizations
- Complete payroll records with full names, bank routing numbers, and account numbers for all current employees across RTS and RLI divisions
**FINANCIAL & BANKING**
- ACH payment files containing 351 bank account numbers (routing + account) for employees, contractors, and carrier partners
- First Horizon Bank online banking credentials
- State tax portal login credentials for 20+ US states (TN, KY, GA, OH, PA, VA, NC, IN, AL, MS, LA, MO, WV, NM, NE, OR, SC, IL, NY, AR)
- QuickBooks financial data
- Payroll ACH batch files with individual salary amounts
- Settlement payment records for 112 carrier/vendor relationships
- Insurance loss reports spanning 2008 through 2025
- Positive Pay check verification data
**CREDENTIALS & ACCESS**
- 200+ plaintext username/password combinations exported from employee browsers, covering Microsoft 365, banking portals, fleet management (Samsara, OmniTracs), customer billing portals, insurance providers, government tax systems, and personal accounts
- Customer portal credentials for 39 business partners including Nucor, Ryder, Cleveland Cliffs, US Bank, Valmont, SiteOne, Megacorp, Hubbell, CMC, Builders FirstSource, and others
- Your Carbon Black security product license information
- Acronis backup system license keys
- CheckPoint VPN configuration data
**DOT / FMCSA COMPLIANCE**
- DOT audit files
- Drug and alcohol testing results for all drivers
- DOT medical examination certificates
- FMCSA inspection and violation records
- Accident and incident reports spanning multiple years
- CSA score documentation
**BUSINESS INTELLIGENCE**
- 949-entry contact database (drivers, customers, vendors, suppliers)
- Customer contracts and rate agreements
- IFTA fuel tax reports (all states, 2021–2025)
- Complete fleet and driver assignment records
- Internal HR files for current and terminated employees
- Workers' compensation claim records
---
### WHAT THIS MEANS FOR YOU
If this data becomes public:
1. **Mandatory breach notification in all 50 US states** for SSN and financial data exposure — estimated cost: $500,000 – $1,000,000 in notification, credit monitoring, and legal fees alone
2. **FMCSA regulatory action** — exposure of drug test results and DOT medical records creates grounds for federal compliance investigation. Potential suspension or revocation of operating authority under 49 CFR Part 382
3. **Employee lawsuits** — 262 individuals with exposed Social Security Numbers and bank accounts will have grounds for identity theft class action litigation. Average settlement: $5,000 – $50,000 per affected person
4. **Customer relationship damage** — 39 business partners whose portal credentials were stored in plaintext will be notified. Nucor, Cleveland Cliffs, Ryder, US Bank, and others will terminate carrier agreements and pursue damages
5. **Financial fraud exposure** — bank routing numbers, account numbers, and online banking passwords enable direct financial theft. Every employee and carrier partner will need to change bank accounts immediately
6. **Tax fraud liability** — login credentials for 20+ state tax portals enable fraudulent filings. State revenue departments will freeze accounts pending investigation
7. **Total estimated exposure: $5,000,000 – $15,000,000** in regulatory fines, legal costs, settlements, lost business, and remediation
---
### PROOF OF DATA
We will provide a sample data package upon request in this chat to verify authenticity. This may include:
- Partial employee SSN document samples (redacted)
- ACH file headers showing bank routing information
- Portal credential samples
- Payroll records with employee names and amounts
---
### OUR TERMS
We are prepared to:
- Permanently delete all copies of your data
- Provide proof of deletion
- Never disclose or publish any information
- Provide a full list of accessed systems for your security remediation
**In exchange, we require a one-time payment. The amount will be discussed in this chat.**
---
### DEADLINE
You have **168 hours (7 days)** from the moment this message was posted to initiate contact and begin negotiations.
**After the deadline:**
- Phase 1: Data samples will be sent directly to your customers (Nucor, Ryder, Cleveland Cliffs, US Bank, SiteOne)
- Phase 2: Full dataset published on our public blog
- Phase 3: FMCSA, state attorneys general, and IRS notified with supporting evidence
**The timer is running.**
---
*To begin the conversation, type your message below. All communications are encrypted and confidential. We respond within 2 hours during business days.* |
Link |
| 2026-11-10 22:33:23.734033 |
Kolin |
inc ransom |
# Kolin Construction
**Kolin Construction** (*Kolin İnşaat Turizm Sanayi ve Ticaret A.Ş.*) is one of Turkey’s major construction and industrial companies. Founded in **1977** and headquartered in **Ankara, Turkey**, the company serves as a flagship business of **Koloğlu Holding**.
## Business Activities
Kolin Construction operates primarily in large-scale construction, infrastructure, and engineering projects. Its areas of expertise include:
* Highways and road infrastructure
* Bridges and viaducts
* Tunnels
* Railways and metro systems
* Airports
* Ports and marine infrastructure
* Dams and hydroelectric power plants
* Energy infrastructure
* Industrial and mining projects
The company has participated in numerous major infrastructure developments in Turkey and abroad and has regularly appeared in international contractor rankings published by **Engineering News-Record (ENR)**.
## Major Projects
Kolin Construction has been involved in several large-scale and strategically important projects. One of its most notable developments is its participation in the construction of **Istanbul Airport**, one of the largest aviation infrastructure projects in the world.
Beyond transportation infrastructure, the company is active in projects involving power generation, water infrastructure, ports, industrial facilities, and other complex engineering works.
## Other Business Sectors
Through its broader corporate group, Kolin is also involved in several industries outside traditional construction, including:
* Energy and power generation
* Mining
* Port operations
* Shipyards and maritime services
* Tourism
* Trade and commercial activities
## International Presence
Kolin Construction maintains an international presence and has undertaken projects across **Europe, Asia, the Middle East, and Africa**.
Its international operations have included countries such as:
* Azerbaijan
* Libya
* Uganda
* Poland
* Romania
* Oman
* Saudi Arabia
* Kuwait
The company has established representative offices and project operations in several of these markets to support its international engineering and construction activities.
## Company Scale
Kolin Construction is considered one of the prominent Turkish contractors operating internationally. Its annual turnover has been reported in the range of approximately **USD 1.5–2 billion**, reflecting the scale of its infrastructure, energy, and industrial projects.
## Summary
With several decades of experience, Kolin Construction has developed capabilities in managing complex, large-scale infrastructure and engineering projects. Its portfolio covers transportation, energy, industrial construction, and public infrastructure, with operations extending from Turkey to multiple international markets. |
Link |
| 2026-11-10 22:33:22.876507 |
Nota Groep |
inc ransom |
notagroep.nl |
Link |
| 2026-11-10 22:33:22.038808 |
Millimed Thailand (i-HERB) |
inc ransom |
# MILLIMED CO., LTD. (มิลลิเมด) — DATA BREACH DISCLOSURE
**Date Added:** 2026-09-17
**Last Updated:** 2026-09-17
**Country:** Thailand 🇹🇭
**Industry:** Pharmaceutical Manufacturing & Distribution
**Website:** millimedthailand.com
**Revenue:** ~$70-85M USD (2.5-3.0 billion THB, group annual revenue)
**Data Volume:** **~3 TB** (databases, production records, email archives, factory documents, financial data)
---
## Overview
Millimed Co., Ltd. (บริษัท มิลลิเมด จำกัด) is a major Thai pharmaceutical manufacturer headquartered in Bangkok with GMP-certified production facilities in **Samut Prakan** and **Chiang Rai** provinces. The Millimed Group operates through **25+ subsidiary companies** spanning pharmaceutical manufacturing, consumer healthcare brands, supplements, real estate, agriculture, and hospitality.
Their consumer brand **i-HERB**, endorsed by Thai celebrity **Mario Maurer**, is one of the most recognized herbal healthcare brands in Thailand. The company holds **multiple Thai FDA quality awards** and manufactures prescription drugs, OTC products, sterile eye drops (BFS technology), and dietary supplements distributed nationwide through hospitals and pharmacies.
The group's crown jewel subsidiary — **Millimed BFS** — reported **1,423 million THB revenue** and **593 million THB net profit** in 2025, with a staggering **41.7% net margin** and **65% year-over-year growth**. The parent company holds **942 million THB in retained earnings** — they can afford to resolve this.
Millimed's management chose to ignore our communications and failed to protect their data. As a result, we are publishing details of the breach.
---
## What We Have — Over 3 Terabytes
We have obtained **complete access** to the Millimed Group's entire IT infrastructure across **both factory locations and the Bangkok headquarters**. This includes production servers, file servers, NAS systems, ERP databases, email archives, and factory department shares. The total data volume exceeds **3 terabytes**.
### 💊 Pharmaceutical Manufacturing Data (CRITICAL)
- **Batch Manufacturing Records (BMR)** for **ALL pharmaceutical products** — the legal backbone of every drug they produce. We hold BMR distribution records from 2016 through August 2026, covering 18+ active product lines including i-HERB, Neoca, Denta Dente, Haelex, Leluxi, Amogin, and more
- **Quality Control & Calibration databases** — testing results, equipment calibration records, deviation reports
- **Drug Registration & Regulatory Affairs (RA)** data — complete product formulations for Amogin (4 variants), Chlovas, Caltab, BFS eye drops, Lidocaine HCl, Hilazin, Nicardipine, Cystaline-200, Nuosic, and more. **Master Formula documents** included
- **Bioequivalence Studies** (Bio Equalise subsidiary) — complete BE study reports, LC-MS/MS chromatography data, OECD compliance documents, and the contract with Chiang Mai University Faculty of Pharmacy
- **R&D Department** — pilot batch data, stability studies, cleaning validation, pharmaceutical excipient references (USP 38, BP 2013)
- **14 types of GMP audit records** — Thai FDA, Halal, GSDP, GPP, ISO 9001/14001/17025, Pfizer audit, TAISHO audit, iNova audit (including **CAR/PAR corrective action records**)
- **i-HERB brand complete IP** — all formulations, BMR, SOP, COA, specifications, cosmetic registrations, and production data for the Mario Maurer-endorsed brand
### 💰 Complete Financial Records (25+ Companies)
- **Audited financial statements** (งบการเงิน) for fiscal years **2024, 2025, and 2026** for all major subsidiaries:
- Millimed Co., Ltd. — 876M THB revenue, 54M THB net profit
- **Millimed BFS — 1,423M THB revenue, 593M THB net profit (41.7% margin!)**
- Pros Pharma, MLM Healthcare, Neoca Healthcare, Bio Equalise, i-Herb Innovation, Siriphanwa
- **K-Bank and EXIM Bank credit facility summaries** — full loan structures, credit lines, and covenant details
- **Monthly sales reports** (January 2025 — **August 2026**) — complete OTC and prescription drug revenue by product, region, sales channel, and individual sales unit
- **Oracle ERP database** — every financial transaction across the group. We also have the **Oracle ERP login credentials** (MMNEW/MMNEW@millimed.world)
- **Accounting databases** for **all 25+ entities** — complete general ledger, trial balances, tax reconciliation, intercompany transactions
- **28 entity accounting folders** with full Chart of Accounts, audit records, tax preparation documents
### 👤 Employee & HR Data (1,000+ People)
- **HRM8 database** — complete employee records: names, national ID numbers (เลขบัตรประชาชน), salaries, benefits, performance reviews
- **Organization charts** for all 7 production departments (PD1-PD7) with employee names
- **Payroll data** for all subsidiaries across three locations
- **FingerScan biometric data** backups
- **Personal data** of 1,000+ employees across Bangkok, Samut Prakan, and Chiang Rai
### 📧 Email Archives (30+ GB)
- **IT Administrator email archives** (15+ PST files) including:
- Network configuration and infrastructure credentials
- NAS Synology management alerts (neoca-office.synology.me, millimed-office.synology.me)
- Microsoft 365 administration
- VPN configuration and access management
- Vendor communications and support tickets
- Backup system notifications
### 🔑 60+ Credentials & Network Access
- **Thai Revenue Department (กรมสรรพากร)** login credentials for **ALL 25+ companies** — tax portal access for every entity in the group
- **BOI (Board of Investment)** portal credentials — 5 companies with tax incentive access
- **Department of Business Development (กรมพัฒนาธุรกิจการค้า)** — 5 corporate filing portal credentials
- **Dual VPN access** — WatchGuard Firebox at Ram Intra HQ (210.86.174.42) + **OpenVPN with full certificate chain and private key** for Neoca office (210.86.171.29)
- **Oracle ERP credentials** — MMNEW/MMNEW@millimed.world (production system)
- **SQL Server logins** including sysadmin (sa), mkuser, DB_ECM, dev_01-03
- **Microsoft 365 tenant** (millimedthailand.com) — cloud email and collaboration
- **Active Directory** — domain controller at 192.168.1.2
### 🏭 Complete Factory Infrastructure
- **233+ department folders** from the factory file server — every production, quality, regulatory, and administrative department
- **22 CCTV cameras + 1 access control** — complete Hikvision surveillance network with IP addresses and serial numbers covering BFS sterile area, laboratories, warehouses, food production, and all manufacturing floors
- **31 internal network subnets** (192.168.69.0/24 through 192.168.100.0/24) — full factory network topology
- **5 internal servers identified** — AD domain controller, 2x Orion NAS, barcode server, Chiang Rai center NAS
- **VMware vSphere** virtualization infrastructure, **CheckMK** monitoring, **Hikvision iVMS-4200** CCTV management
### 🏭 Sales & Operations
- **SALES & SALESAPP databases** (12+ GB) — complete sales history, pricing, customer relationships from 2022-2026
- **Monthly sales performance presentations** (January 2025 — August 2026) — OTC + prescription by area, product, channel
- **Marketing database** — campaigns, customer targeting, product focus data
- **Stock management** — inventory across all facilities
- **Forecast data** — business projections and planning
- **Transport & logistics** — GPS tracking, delivery records, government pharmaceutical organization reports
---
## Regulatory Impact
Millimed should be aware of the following consequences of this data becoming public:
1. **Thai FDA (อย.) Manufacturing License** — We hold the **actual BMR documents, QA audit records, and 14 types of regulatory audit documentation** including corrections (CAR/PAR). This is not just database records — these are the physical production documents that underpin every drug Millimed manufactures. Release triggers **immediate FDA review and potential suspension of manufacturing licenses**. The FDA Quality Award for 3 consecutive years ends here.
2. **PDPA Violation (พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล)** — Personal data of **over 1,000 employees** including national ID numbers, salaries, biometric data, and home addresses has been compromised. The PDPA Office can impose fines up to **5 million THB per violation** and criminal penalties including imprisonment.
3. **Revenue Department Exposure** — We hold active login credentials for **ALL 25+ company tax portals** plus the complete intercompany financial structure across the group. The multi-entity accounting data, transfer pricing arrangements, and BOI tax incentive records will be of great interest to Thai tax authorities.
4. **Drug Formulation Theft** — Complete drug formulations including **Master Formula documents**, bioequivalence study data, R&D results, and regulatory submissions for the entire product portfolio. Competitors gain **decades of R&D investment** in seconds. The i-HERB brand formulas, Neoca supplement compositions, BFS sterile manufacturing specifications, and all proprietary pharmaceutical formulations are fully exposed.
5. **Bioequivalence Study Exposure** — Bio Equalise subsidiary's complete BE studies, including the **contract with Chiang Mai University**, LC-MS/MS analytical data, and OECD-compliant study reports. Competitors can use this data to bypass their own bioequivalence testing requirements.
6. **Banking & Credit Exposure** — K-Bank and EXIM Bank credit facility details, loan covenants, and the true financial health of each subsidiary will be publicly available, potentially triggering credit reviews, covenant violations, or credit rating downgrades.
7. **Physical Security Compromise** — The complete **CCTV surveillance network** (22 cameras + access control) with IP addresses and serial numbers, factory network topology, and building plans are exposed. Combined with VPN access credentials, this represents a total physical and digital security failure.
---
## Message to Millimed Management
Chairman **Thongplew Siripornpithak** (ทองเปลว ศิริพรพิทักษ์) and the board of directors had an opportunity to resolve this matter privately. That window is closing.
The data we hold represents the **complete digital footprint** of your 25+ company pharmaceutical empire — **over 3 terabytes** spanning both factory locations, the Bangkok headquarters, and all subsidiary operations. From drug manufacturing records to tax filings, from employee national IDs to bank loan structures, from factory CCTV configurations to Oracle ERP credentials.
Your **Millimed BFS** subsidiary generated **593 million THB in net profit** last year with a 41.7% margin. Your parent company holds **942 million THB in retained earnings**. You can afford to resolve this.
Your **i-HERB brand**, endorsed by Mario Maurer and sold across Thailand, depends on consumer trust. Your **FDA manufacturing licenses** depend on the integrity of your BMR and QA data. Your relationships with **K-Bank and EXIM Bank** depend on financial confidentiality. Your **ISO and Halal certifications** depend on audit documentation security.
**All of this — 3 terabytes of it — is now in our hands.**
We strongly recommend Millimed's management reconsider their position and contact us immediately to resolve this situation before the full dataset is published.
**Screenshots below demonstrate the scope and authenticity of the breach:**
*(See attached: 26 evidence screenshots)* |
Link |
| 2026-11-10 22:33:21.185489 |
HONG BAO GROUP (lovelywines.co.th) |
inc ransom |
# HONG BAO GROUP — DATA BREACH
**Hong Bao Group** (หงเปา กรุ๊ป) — a major Thai restaurant conglomerate operating 15+ restaurant brands across Bangkok, including **Hong Bao Restaurant**, **Water Library**, **Lovely Wine**, **PLU (พลู)**, **CIAO PIZZA**, **Bistro**, and **SEED** — has suffered a complete network compromise resulting in the exfiltration of their entire corporate infrastructure.
## Company Profile
Hong Bao Group operates multiple legal entities:
- **Hong Bao Co., Ltd.** (บริษัท หงเปา จำกัด)
- **Hong Bao EV Co., Ltd.** (บริษัท หงเปา อีวี จำกัด) — Tax ID: 0105559005630
- **Water & Wine (Thailand) Co., Ltd.** (บริษัท วอเตอร์ แอนด์ ไวน์ (ประเทศไทย) จำกัด)
- **Lovely Wine Co., Ltd.** (บริษัท เลิฟลี่ไวน์ จำกัด)
- **I-Group** (investment holding)
The group operates restaurants in premium Bangkok locations including MBK Center, King Square, Ramada, and multiple other shopping malls across Thailand.
**Websites:** hongbaorestaurant.com | waterlibrary.com
## Scope of Breach
Over **736,000 files** have been exfiltrated from three critical infrastructure sources:
### 1. Corporate File Server (FL6-SRV-FILSHA)
- **86,500+ files** from all corporate departments
- Accounting (Hongbao + Water divisions)
- Executive Administration — including **board meeting audio recordings**
- Finance department — complete reports
- HR — employee records, contracts, personal documents
- Purchasing — vendor agreements, pricing
### 2. Company NAS (NAS5EECFF)
- **647,000+ files** — the complete corporate document archive
- **hongbao/** — 400,000+ files: finance, tax, HR, SAP ERP documentation
- **water/** — 180,000+ files: Water & Wine financial, banking, payroll data
- **hb_wl/** — shared financial and tax records
- **Scanned documents** — thousands of signed originals
### 3. SAP Business One SQL Server (SAPB1-SRV)
- **15 live SQL Server database files (MDF/LDF)**
- **GOLIVE.mdf** (~62 GB) — the entire SAP B1 production database containing ALL business transactions, customers, vendors, pricing, and inventory since inception
- **GOLIVE_EV.mdf** (~56 GB) — complete audit trail
- **SBO-COMMON.mdf** (~10 GB) — user accounts and system configuration
- **master.mdf** — SQL Server authentication database with login credentials
- **1,918 branch database backup archives** covering 15 branches
## Data Categories Exfiltrated
### Financial Records (15,500+ files)
Complete profit & loss statements, balance sheets, cash flow reports, and audit records across all branches spanning **2022–2026**. Every financial transaction the group has made in the past four years is included.
### Banking Information (28,400+ files)
- **Bangkok Bank (BBL)** Corporate iCash — account statements, transfers
- **Siam Commercial Bank (SCB)** Business Net — corporate banking records
- **Kasikorn Bank (K-Cash Connect Plus)** — payment records
- Personal **credit card statements** of company directors
- Wire transfer confirmations, payment vouchers
### Tax & Revenue Records (5,100+ files)
- VAT filings for all entities
- Withholding tax certificates
- Revenue Department submissions
- Annual tax returns from 2022–2026
### Payroll & HR (7,800+ files)
- Complete **salary records** for all employees across all branches
- Overtime calculations, bonus payments
- Social Security (ประกันสังคม) contributions
- Provident fund records
- Employment contracts
### Email Archives (14 Outlook mailboxes)
Complete email archives (.PST) of key personnel from both hongbaorestaurant.com and waterlibrary.com domains, including all attachments and internal communications.
### Personal Identity Documents
- **Passport scans** and **Thai national ID cards** of company directors and executives
- Visa and travel documents
- Flight bookings and itineraries
### Contracts & Legal (2,800+ files)
- Mall lease agreements for all restaurant locations
- Vendor supply contracts
- Non-disclosure agreements
- Employment contracts with personal terms
### Wine & Alcohol Import Licenses (425+ files)
All regulatory permits, excise department records, and import documentation for the Lovely Wine business — **without which the wine import business cannot legally operate**.
### POS & Customer Data
- 15+ branch point-of-sale databases with transaction history
- Customer checkout records
- Daily sales reports across all locations
### IT Infrastructure Access
- SAP B1 user accounts (303+ users) with password hashes
- SQL Server administrator credentials
- QNAP NAS access credentials
- TSplus remote access configuration files
- Internal network mapping (172.16.x.x)
- Evidence of prior security compromise (CLR assemblies loaded in SQL Server)
## Key Personnel Exposed
Personal documents, passport scans, banking records, and travel documents of the following individuals are included in the breach:
- **Noppadon Narittakurn** — Director
- **Tata** — Director
- **Zithai** — Director / Designer
- **Nitchaya Tohsanguanpun** — Director
## Impact
This breach represents a **complete corporate data compromise**. Every department, every financial record, every employee record, every branch database, and every executive communication has been exfiltrated.
The data includes sensitive regulatory documents (tax filings, alcohol import licenses) that could trigger **government investigations** if disclosed publicly. The personal banking records and passport scans of company directors present significant **identity theft and fraud risks**.
The SAP production database alone contains the company's **entire operational history** — customer lists, vendor pricing, proprietary recipes and inventory formulas, and every financial transaction processed through their ERP system.
**Data volume:** 736,000+ files | 15 SQL databases | 1,918 database backups | 14 email archives
**Hong Bao Group has limited time to resolve this situation before full publication.** |
Link |
| 2026-11-10 22:33:20.346780 |
Onmion LLC (Lake Connor Park, Port Susan Camping Club, Cured by Visconti) |
inc ransom |
# Onmion LLC — One IT Provider, Three Breached Companies, 3,000+ Victims
**Subject:** Onmion LLC (Mukilteo, WA) — Managed IT Provider
**Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB
---
## Who Is Onmion LLC?
**Onmion LLC** — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — **onmion.com**
A managed IT and software services provider that markets itself as "empowering businesses with cutting-edge software technology." In practice, Onmion LLC stored all of its clients' most sensitive data — Social Security Numbers, banking records, healthcare credentials, tax filings — on shared, unencrypted infrastructure with no segmentation between client environments.
Through Onmion's FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.**
*Screenshot 1 — onmion.com — "Empowering businesses with cutting-edge software technology"*
---
## Three Clients, One Point of Failure
*Screenshot 2 — All three client datasets on the same shared FTP infrastructure*
| # | Client | Website | Location | Data | Individuals |
|---|--------|---------|----------|------|-------------|
| 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members |
| 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs |
| 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs |
---
## Onmion's Failures
*Screenshot 3 — N-Central RMM backup archives from Onmion's management server*
*Screenshot 4 — Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted*
*Screenshot 5 — Summary of Onmion's security failures*
1. **No segmentation** — all clients on shared FTP with no access controls
2. **N-Central RMM exposed** — 44 daily backups (45 GB) with device inventories and remote access credentials
3. **Plaintext passwords** — production databases storing user credentials in cleartext
4. **Healthcare credentials in Word docs** — 25+ login pairs for major US insurers unencrypted
5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files
6. **Refused to respond** when notified — no action, no client notification
---
# CLIENT 1 — Lake Connor Park
**lcpmembers.com** — Tulalip, WA — Gated residential/RV community — 500+ members — **178.8 GB exfiltrated**
| Category | Details |
|----------|---------|
| SQL Databases | 92+ GB — member records, POS transactions, user credentials |
| N-Central RMM | 45 GB — 44 daily backups of IT management server |
| Gate Access Logs | 700+ daily logs — 363+ members with names, cards, timestamps |
| Member Database | 500+ records with full PII, passwords in plaintext |
| Healthcare Creds | 25+ pairs — AETNA, UHC, Humana, Cigna, others |
| Source Code | 99 VB.NET files — POS, QuickBooks integration |
| System Backups | 656 DAR archives (4.8 GB), Jan–Sep 2026 |
*Screenshot 6 — 178.8 GB data archive*
*Screenshot 7 — MAAS member database: 500+ individual PII records*
*Screenshot 8 — Daily gate logs: names, card numbers, timestamps*
*Screenshot 9 — Healthcare credentials in plaintext*
*Screenshot 10 — SQL Server database backups (92+ GB)*
*Screenshot 11 — User passwords stored in cleartext in production DB*
*Screenshot 12 — 44 daily N-Central RMM backups*
---
# CLIENT 2 — Port Susan Camping Club
**portsusan.com** — Stanwood, WA — Tribal nonprofit (Tulalip Tribes) — 2,490 sites — $7.4M revenue — **400+ SSNs exposed**
| Category | Details |
|----------|---------|
| Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings |
| Employee PII | 219 individuals (91 active + 128 terminated) — full SSN |
| W-2 Forms | 2020-2025 — SSN for every employee |
| Vendor W-9s | 202 forms — EIN/SSN for all vendors |
| Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations |
| HR Investigations | 10 named cases — harassment, misconduct, legal |
| IRS/Tax | 990T, 1099, PPP/SBA loan records |
| IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps |
*Screenshot 13 — Three data drives: Finance (K), HR (T), Departments (V)*
*Screenshot 14 — 20+ years of financial records*
*Screenshot 15 — 91 active employee personnel files*
*Screenshot 16 — W-2 forms (2020-2025) with employee SSNs*
*Screenshot 17 — 7 Heritage Bank accounts with full account numbers*
*Screenshot 18 — 202 vendor W-9 forms with EIN/SSN*
*Screenshot 19 — 10 confidential HR investigation files*
---
# CLIENT 3 — CarneVita / Cured by Visconti
**curedbyvisconti.com** — 1501 N Miller St, Wenatchee, WA — Food production — **26+ SSNs** — $3.4-4.8M revenue
Three entities compromised through a single shared backup:
| Entity | EIN | QuickBooks |
|--------|-----|------------|
| CarneVita, LLC | 33-3284096 | 64 MB (active) |
| Cured by Visconti, LLC | 85-0659112 | 201 MB (active) |
| 3 Boots Ranch & Custom Cuts | — | 13 MB (active) |
| Category | Details |
|----------|---------|
| QuickBooks Files | 278 MB+ — complete financials for all 3 entities |
| IRS W-2 Forms | 26 employees — full SSN, names, wages |
| IRS 941/940/W-3 | Quarterly + annual federal tax returns |
| Transactions | 2,018 documents — invoices, POs, receipts |
| Backups | 70+ automated QBW backups (Feb 2025 — Apr 2026) |
| Investment | Fidelity account statements |
*Screenshot 20 — W-2 forms with employee SSNs*
*Screenshot 21 — Form 941 CarneVita: 15 employees, $176K quarterly wages*
*Screenshot 22 — Form 941 Cured by Visconti: 11 employees*
*Screenshot 23 — QuickBooks files for all three entities*
*Screenshot 24 — 2,018 transaction documents*
*Screenshot 25 — PII summary across all three entities*
---
## Combined Impact
| Metric | Total |
|--------|-------|
| Organizations compromised | 3 |
| Data exfiltrated | 179+ GB |
| Individuals with PII exposed | 3,000+ |
| Social Security Numbers | 426+ |
| Bank accounts exposed | 10+ |
| Healthcare credentials | 25+ portal logins |
| Financial history | 20+ years |
| IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 |
| Member/client sites | 2,990+ |
---
## What Affected Organizations Should Do
1. **Terminate Onmion LLC** — they knew and chose silence
2. **Engage independent cybersecurity counsel**
3. **Begin breach notification** per WA State RCW 19.255.010
4. **Notify banks** — Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita)
5. **Report to WA Attorney General** and relevant authorities
6. **Offer credit monitoring** to all individuals with exposed SSNs
**All data will be published in full if Onmion LLC continues to refuse engagement.**
---
*Onmion LLC — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — onmion.com*
*Lake Connor Park — lcpmembers.com | Port Susan Camping Club — portsusan.com | CarneVita — curedbyvisconti.com* |
Link |
| 2026-11-10 22:33:19.492378 |
Nandan Terry Pvt |
inc ransom |
# NANDAN TERRY LTD — DATA BREACH ANNOUNCEMENT
**Industry:** Textile Manufacturing (Terry Towels, Bathrobes)
**HQ:** Dholka, Ahmedabad, Gujarat, India
**Group:** Chiripal Group
**Website:** nandanterry.com
**Revenue:** ~$23M USD (₹194 Crore)
**Employees:** 500+
---
## WHAT WE HAVE
Nandan Terry Limited's entire corporate infrastructure has been compromised. We have exfiltrated **200GB+** of data from their internal file servers including 68 workstation backups and all department shared drives.
---
### 🔑 CREDENTIALS & ACCESS (46+ accounts)
Login credentials for **every shipping and logistics portal** they use — including their supply chain accounts with:
- **H&M Supplier Portal** (supplierportal.hm.com)
- **Marks & Spencer** Trading Grid & EDI
- **Walmart** cargo systems
- **Puma** shipping & PO management
- **ALDI** production & contracts
- **LIDL**, **TJX/Marshalls**, **Ross Stores**, **BJ's Wholesale**, **Big Lots**, **QVC**, **Metro**, **XXX Lutz**
- **DHL**, **Kuehne+Nagel**, **GEODIS**, **Yusen Logistics**, **Expeditors**
All usernames, passwords, portal URLs. Many still active.
---
### 💰 COMPLETE FINANCIAL RECORDS
- **Profit & Loss** statements — monthly, FY 2024-2026
- **Balance Sheet** FY 2024-25 (audited, 47 pages)
- **Consolidated P&L** with revenue breakdown (Export vs Domestic)
- **EBITDA, Net Profit, Working Capital** calculations
- Revenue: **₹194 Crore** ($23M), Net Profit: **₹9 Crore** ($1.07M)
- Full cost structure: raw materials, salary, power, logistics
---
### 🏦 BANKING & LOAN DATA
Complete banking relationships with **7 major Indian banks**:
| Bank | Facility |
|------|---------|
| **Punjab National Bank (PNB)** | CC ₹70Cr + TL ₹95Cr |
| **State Bank of India (SBI)** | TL ₹47Cr |
| **Bank of Baroda (BOB)** | TL ₹47Cr |
| **Canara Bank** | TL ₹47Cr |
| **Central Bank of India (CBI)** | TL ₹70Cr |
| **Union Bank (UBI)** | TL ₹47Cr |
| **Bank of Maharashtra + Bandhan Bank** | CC facilities |
**Total loan exposure: ₹433+ Crore ($51.5M)**
All account numbers, IFSC codes, bank RM contacts (names, phones, emails), repayment schedules, interest calculations included.
**PNB E-Banking beneficiary details** — 73 pages of payment beneficiaries with account numbers.
---
### ⚠️ CIBIL CREDIT REPORTS & LEGAL ISSUES
**Extremely sensitive** credit bureau data:
- **CIBIL Commercial Credit Report** — 69 pages, full credit history
- **DPD (Days Past Due) reports** from Canara Bank (31 days) and SBI (29 days) — **evidence of late loan payments**
- **CIBIL irregularity complaints** to PNB
- **Legal suits against company and directors** — documented in internal files
- **NCLT (National Company Law Tribunal)** withdrawal orders
- Director **Braijmohan Chiripal** — CIBIL irregularity for housing loan ₹4.75 Crore
- **CRILC (Central Repository)** reporting disputes with Bank of Baroda, Central Bank of India, SBI
This data reveals the company's **true financial health** — not the version they show to their buyers.
---
### 👥 EMPLOYEE DATA (500+ workers & staff)
- **Complete salary sheets** — every employee, every month (NTPL Staff, NTPL Workers, SPG Staff, SPG Workers)
- **Worker increment proposals** with full PII: Name, Father's Name, Department, Designation, Date of Joining, Salary
- **PF (Provident Fund)** and **ESI** data
- **SAP payroll upload files** with individual amounts
- **KPI performance data** — individual worker performance metrics
---
### 📋 CLIENT & SUPPLY CHAIN DATA
**62+ global buyers** in customer master including:
ALDI, H&M, Walmart, Marks & Spencer, Puma, TJX (Marshalls/TK Maxx), BJ's Wholesale, Ross Stores, Big Lots, QVC, Metro, XXX Lutz, Falabella, LIDL, Meijer, Bealls, Liberty, Hemtex/Kesko, Vineyard Vines, Cencosud, DD's Discount
**Client-specific data includes:**
- Purchase Orders with pricing
- Product specifications (GSM, size, design files)
- H&M Master Order Dashboards (2023-2026)
- Puma packing instructions & shipment data
- ALDI contract correspondence
- Production schedules per buyer
- Cost sheets and margin calculations
**This data is devastating for their buyer relationships.** Major retailers like H&M and Walmart require strict data security compliance from suppliers. This breach proves Nandan Terry cannot protect their supply chain data.
---
### 📁 CORPORATE & LEGAL DOCUMENTS
- **KYC package:** CIN, IEC (Import Export Code), GST Registration, Export House Certificate
- **Board Resolutions** (conversion from Pvt to Public)
- **Director list** with education and experience
- **Insurance policies** (8 active — plant, machinery, solar, marine)
- **Settlement agreements** (Uday Buildcon)
- **Tax Audit Reports** (FY 2019-2025)
- **Secretarial Audit Report** 2024
- **CredAvenue borrower profile** and shareholding patterns
- **DSRA release letters** from 4 banks
---
### 🗂️ DATA VOLUME
| Category | Volume |
|----------|--------|
| Workstation backups | 68 machines |
| Financial records | Monthly P&L, BS, NCA (2+ years) |
| Salary data | ALL employees, monthly |
| Banking data | 7 banks, full account details |
| Client data | 62+ global buyers |
| Credentials | 46+ portal logins |
| Legal/CIBIL | Credit reports, court cases |
| Insurance | 8 active policies |
| Total estimated | **200GB+** |
---
## ⏰ TIMELINE
**Announcement published.** Nandan Terry Limited has been contacted.
⬛ **4 DAYS** — deadline to begin negotiations. If no contact is made, this page will be updated with additional proof samples and the countdown to full publication begins.
⬛ **+10 DAYS** — full data publication. If no agreement is reached within 10 days after the announcement deadline, the following actions will be taken:
1. **Full financial data** published (P&L, Balance Sheet, loan schedules, CIBIL reports)
2. **CIBIL credit reports and DPD irregularities** sent directly to all 7 banking partners — PNB, SBI, BOB, Canara, CBI, UBI, Bank of Maharashtra
3. **H&M, Walmart, Puma, ALDI, Marks & Spencer** notified of their supplier's data security failure and supply chain data exposure
4. **46+ portal credentials** published — active shipping and logistics accounts compromised
5. **Employee PII** released — salary data, PF numbers, personal details of 500+ workers
6. **Complete data dump** published on clearnet and Tor — free download for anyone
**Total time to act: 14 days from today.**
The clock is ticking.
---
*Data verified. Screenshots below are samples only. Full dataset available for verification upon contact.*
---
## 📸 PROOF — DATA SAMPLES
*Screenshots from exfiltrated data:*
 |
Link |
| 2026-11-10 22:33:18.657495 |
La Filipina Uy Gongco |
inc ransom |
# La Filipina Uy Gongco Corporation (LFUGGOC) — Philippines
**Published:** [DATE]
**Data Volume:** 278,594 files
---
## Company Overview
**La Filipina Uy Gongco Group of Companies (LFUGGOC)** is a major Philippine conglomerate operating across multiple industries including food manufacturing, flour milling, animal feed production, sugar processing, livestock farming, port operations, logistics, and real estate.
**Website:** foodgroup.ph
**Headquarters:** Taguig City (BGC), Metro Manila, Philippines
**Employees:** 1,500+
**Annual Revenue:** Estimated PHP 15-20 billion ($270-360M USD)
**Auditor:** SGV & Co. (Ernst & Young Philippines)
**ERP:** SAP S/4HANA
The group operates 17+ legal entities across the Philippines with nationwide operations spanning Luzon, Visayas, and Mindanao regions, including 6+ port terminals, flour mills, feed mills, sugar centrals, farms, retail stores, and distribution networks.
---
## Group Entities
| Segment | Companies |
|---|---|
| **Logistics** | Amigo Logistics Corp (ALC), Amadi ALC Services (AASI), Amadi MGT Terminals (AMTI), Mariveles Grain Corp (MGC) |
| **Flour & Pasta** | Philippine Foremost Milling Corp (PFMC), PLILI, MT Philippine Container (MTPCI) |
| **Feeds & Livestock** | LFUG Manufacturing (LFMI), Farms Division, Progreso Retail Stores (PRSI) |
| **Sugar** | CSCI, CAFC, RAFC, Plantation Division |
| **Commodities** | Advanced Agrisolutions Philippines Corp (AAPC), Gentle Earth |
| **Holdings** | CDH Holdings, STARCI/PGIC, Hok Heng/HHH Trading |
| **Real Estate** | LFUG Realty |
---
## Data Exfiltrated
Complete contents of the production file server (FILESHARED01) containing 278,594 files spanning 2018-2026, including:
### Financial Data
- **Consolidated Financial Statements** for the entire group (FY2022 through July 2026)
- **Annual Financial Statements** (AFS) for all business units
- **Budget files** for 2022-2027 including forward projections
- **SGV (Ernst & Young) external audit workpapers** (2022-2025)
- **Bank statements** and reconciliation files (BPI, BDO, Metrobank)
- **Loan documents** including PHP 300M+ BPI promissory notes and amortization schedules
- **Quarterly Income Tax Returns** and all BIR filings
### Employee Data (PII)
- **Complete payroll summaries** for all months of 2025 (24 files, ~13MB each)
- **Employee Alphalist** (JAN-DEC 2025) — all employee TIN numbers and annual income
- **Employee contact details** — names, phone numbers, email addresses, positions
- **13th Month Pay summaries**
- **Leave summaries** and tax refund data
- **SSS, HDMF (Pag-IBIG), and PhilHealth** contribution records
### Organizational Data
- **30+ organizational charts** for all business units (dated March 2025)
- **Job descriptions** with career paths for all positions
- **KPI documents**
- **Headcount reports** (2026)
### Customer & Vendor Data
- **Customer contact database** (26MB) including major Philippine food brands:
- Jollibee Foods Corporation
- Goldilocks Bakeshop Inc
- Shakey's Pizza Commerce Inc
- The French Baker Inc
- Pan De Manila
- North Park Noodle House
- Vikings Group
- Monde Nissin Corporation
- Del Monte Philippines
- **100+ flour bakery client files** across the Philippines
- **30+ notarized vendor contracts**
### Legal & Compliance
- Correspondence and billing from **5 law firms** (MVGS Law, SAM Law, MOST Law, Rojas & Uy, Tillman & Marquez)
- **Litigation files**
- **SEC filings** and corporate governance documents
- **BIR validated tax returns** (2022-2025)
- **Business permits** (Taguig, Davao, Iloilo, Ingore)
- **Insurance policies** and asset registers
### Operations
- **Import/export documentation** and customs records
- **Vessel operations** data and shipping schedules
- **SAP S/4HANA** data exports, journal entries, and master data
- **Marketing materials** for brands: Iron Claw, Canis Prime, IC+, Progreso
- **IT infrastructure** data including database connection files
---
## Regulatory Implications
This data is subject to the **Philippine Data Privacy Act of 2012 (Republic Act No. 10173)**, which requires:
- **Mandatory breach notification** to the National Privacy Commission (NPC) within 72 hours
- **Notification to affected data subjects** (1,500+ employees and thousands of customers)
- Penalties of up to **PHP 5,000,000** and **imprisonment of 3-6 years** for violations
The company has **5 business days** to respond before data publication begins.
---
## Proof of Data
See attached screenshots showing:
1. Complete file server directory structure
2. Employee payroll files with dates and sizes
3. Group consolidated financial statements
4. HR organizational charts for all business units
5. Customer contact database and email addresses
6. Banking documents and tax filings |
Link |
| 2026-11-10 22:33:17.798499 |
ZIRNET LLC (mmplumbingny.com alpha1usa.com askconstruction.com mmplumbingny.com tristate-s |
inc ransom |
# ZIRNET LLC — Managed Service Provider — FULL BREACH
**Published:** October 2026
**Sector:** Information Technology / Managed Services (MSP)
**Location:** Port Washington, New York, USA
**Website:** zirnet.com
---
## Summary
ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida.
We have obtained **complete access** to ZIRNET's internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals.
**Total data: 2,260,963 files across ZIRNET and 12 client server backups.**
---
## Affected Organizations
ZIRNET's negligent security practices have resulted in the exposure of the following companies' complete IT environments:
| # | Company | Industry | Location | Files |
|---|---------|----------|----------|-------|
| 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 |
| 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 |
| 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 |
| 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 |
| 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 |
| 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 |
| 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 |
| 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 |
| 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 |
| 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 |
| 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 |
| 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 |
**Additional organizations with exposed credentials and data:**
- Skylatus Property Capital LLC (Real Estate)
- ClearScope (myclearscope.com)
- Midtown Operating Corp
- Credit and Debt Management Institute (Bolivar, TN)
- La Perla Construction & Design
- LIVOTIS Old World Market
- St. Albans Congregational Church (Queens, NY)
- Creative Mobile Technologies (CMT)
- North Side Transmission
- NY Flooring Inc
- Metropolitan Association of the NY Conference
---
## What Was Obtained
### 1. ZIRNET Internal Data (2,743 files)
- **QuickBooks databases** — Zirnet.QBW (163 MB) and 2025.QBW (155 MB) — complete financial records
- **Bank statements** — TD Bank, American Express, Bank of America — 36 PDF statements covering 2024-2026
- **Email archive** — 3.27 GB of PST files (Outlook) containing all business correspondence
- **IRS documents** — W-9, estimated tax payments, certified copies
- **Client proposals and contracts** — service agreements with all clients
### 2. Complete Credential Database (100+ accounts)
For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained:
- **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords
- **Industrial Solutions (ISNY):** 39 email accounts with passwords
- **ClearScope:** 8 Microsoft 365 accounts with passwords
- **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials
- **St. Albans Church:** 18 email accounts + Azure tenant secret key
- **LIVOTIS:** 3 accounts + VoIP portal access
- **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness)
### 3. Hidden Backdoor Account on ALL Client Machines
ZIRNET created a **hidden administrator account** on every managed workstation and server:
```
Username: NetworkAccess
Password: [REDACTED]
```
This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** — a single credential compromise gives access to every machine ZIRNET manages.
### 4. Credit Card Numbers (with CVV)
Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes.
### 5. Personal Identifiable Information (PII)
- **Social Security Numbers** — Employee SSN scans from Dynotec, ASK Construction
- **Birth certificates** — AlphaOne USA (family members)
- **W-2 forms / Tax returns** — Multiple years (2021-2025) for AlphaOne USA employees
- **Employee I-9 forms and drivers licenses** — AlphaOne USA
- **Medical records** — Owner's colonoscopy, CT scan, and family medical documents
- **Credit reports** — Owner's personal credit history (2005-2015)
- **Payroll data** — Complete W-2/W-3 packages for multiple years across organizations
### 6. Network Infrastructure
- **Juniper SRX firewall configuration** (Midtown Operating) — root passwords, VPN pre-shared keys, full NAT rules, internal network topology
- **Meraki MX67 firewall credentials** (Skylatus) — admin password, WiFi PSKs, external IP
- **N-Central RMM admin credentials** — ZIRNET's remote management console controlling all endpoints
- **Azure tenant secrets** — tenant IDs, client secrets for M365 migrations
### 7. Full Server Backups (12 clients)
Complete drive images from 12 client servers including:
- All user documents, profiles, and application data
- Accounting records (invoices, payroll, tax documents)
- Private folders with personal files
- Browser profiles with saved credentials
- Construction project files, contracts, permits
- HR files, employee records, compliance documents
---
## Evidence
**See attached screenshots:**
1. `01_clients_list.png` — Full client listing with file counts
2. `02_credentials.png` — Sample of extracted credentials (partially redacted)
3. `03_financial.png` — ZIRNET financial data and bank accounts
4. `04_pii_sensitive.png` — PII and sensitive document inventory
5. `05_infrastructure.png` — Network backdoors and firewall configurations
---
## Impact Assessment
This breach affects:
- **13+ organizations** across New York, New Jersey, Florida, and Tennessee
- **500+ individuals** (employees, contractors, clients of affected companies)
- **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data)
ZIRNET's security practices represent gross negligence:
1. **Storing all client passwords in plaintext text files**
2. **Using a single hidden backdoor account across all clients**
3. **No encryption on sensitive data storage**
4. **Storing credit card numbers with CVV in plain text**
5. **Mixing personal medical/financial records with business data**
---
## Contact
ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published.
Countdown: **7 DAYS**
After the deadline:
- All credentials will be published unredacted
- All PII including SSNs will be published
- All financial records will be published
- Each affected company will be notified individually
- Data will be made available for free download
**ZIRNET:** You know how to reach us. The clock is ticking.
---
*This post will be updated as more data is analyzed. Additional client data may be published as proof of access.* |
Link |
| 2026-11-10 22:33:16.899410 |
ELITDATA SE (Advokatfirman Kurt Lundberg HB,Artwood AB,Mantum Group) |
inc ransom |
# Elitdata i Varberg AB — Complete Infrastructure Breach
**Published:** [DATE]
---
Elitdata i Varberg AB (org.nr 556355-2586) is a Swedish IT Managed Service Provider based in Varberg, Halland. Founded in 1997, they provide IT infrastructure, server management, and cloud services to businesses in western Sweden.
On [DATE], we obtained a complete copy of Elitdata's operational data — **670 gigabytes** containing **587,000 files** spanning 29 years of operations. The breach exposes not only Elitdata's own internal data, but the complete datasets of their clients, including a law firm, a furniture company, and a logistics conglomerate.
Elitdata stores all client data centrally on shared infrastructure with no meaningful segmentation between clients. A single compromise cascades through their entire client base.
---
## The Scope
| Dataset | Type | Size | Files |
|---|---|---|---|
| Elitdata i Varberg AB | IT Provider internal ops + 198 client folders | 80 GB | 55,000 |
| Advokatfirman Kurt Lundberg HB | Swedish law firm | 122 GB | 204,000 |
| Artwood AB | Furniture & design company | 205 GB | 327,000 |
| Mantum Group | Logistics & construction conglomerate | 263 GB | 129 |
| **Total** | | **670 GB** | **587,000** |
---
## Elitdata — The IT Provider
**Address:** Västra Vallgatan 7, 432 45 Varberg, Sweden
**Website:** elitdata.se | **Phone:** 0340-86860
Elitdata is owned by Mattias Rödlund and Stefan Qvarford. Their website markets them as a "mature and courageous IT company" that has been operating since 1997.
From their infrastructure we obtained:
**198 Client Organizations** — complete IT documentation for each, including:
- VPN access configurations (.tgb) to connect directly to client networks
- Firewall configurations (full rulesets)
- Bitlocker encryption keys
- Server documentation and network diagrams
- Remote Desktop (RDP) connection files for 50+ client sites
**Wildcard SSL Private Keys:**
- `*.elitdata.se` — certificate with private key (.pem, .pfx), valid 2025-2026
- `*.mantum.se` — certificate with private key (.key, .pem, .pfx), valid 2026
**XCA Certificate Database** — the complete certificate authority used to manage all SSL certificates.
**Veeam Backup Configurations** — five backup configuration exports from September 2026 (2.3 GB total), containing the full backup infrastructure layout.
**Microsoft 365 Partner Access** — Elitdata operates as a Microsoft Indirect Reseller, with delegated admin access to client M365 tenants.
**Employee Data** — vacation/absence records 2009-2025, driving logs, personal folders for all staff.
**NIS2 Compliance Documents & Incident Response Plan** — ironically, their own security documentation is part of the breach.
---
## Client 1: Advokatfirman Kurt Lundberg HB — Law Firm
**122 GB | 204,000 files | Org.nr 559218-5713**
This is the most sensitive dataset. Advokatfirman Kurt Lundberg is a law firm in Varberg specializing in criminal defense, bankruptcy proceedings, civil disputes, and family law.
The exposed data includes the **complete case archive** of the firm:
### Criminal Defense Cases — 26,871 files
The criminal defense archive contains named defendants with their:
- Full police investigation reports (FUP — förundersökningsprotokoll)
- Attorney defense notes and strategy documents
- Personal identity documents and passport copies
- Court case references (Varbergs Tingsrätt, Göteborgs Tingsrätt)
- Phone call logs between attorney and client
- Evidence files including USB phone extractions
Case types include aggravated tax fraud (grovt skattebrott), civil registration fraud (folkbokföringsbrott), assault, drug offenses, and multiple migration/asylum cases.
### Bankruptcy Proceedings — 110,973 files
Complete legal files for 20+ company bankruptcies, including:
- Creditor lists and debt inventories
- Asset valuations and estate inventories
- Creditsafe credit reports
- Court filings and distribution plans
- Wage guarantee (lönegaranti) documents for affected employees
### Civil Disputes & Family Law — 20,807 files
- Civil lawsuits and insurance claims
- Inheritance distributions (arvskiften)
- Guardianship cases (God Man)
- Custody matters
- Estate administration (dödsbon)
### Attorney Communications
- Email archives (PST) totaling approximately 15 GB
- Internal correspondence between lawyers
- Client communication records
### Financial Records
- Complete SIE accounting files 2020-2026
- Payroll records (Visma Lön 300) for 2021-2024, including a separate file for "Advokatfirman Anton Karlsson AB"
- Balance reports and general ledger entries
**Identified attorneys and staff:** Anton Karlsson (primary case attorney), Sofia (disputes/family law), Henrik, Anders, Krister, Peter, Tina, Ing-Mari, Ulla, Kurt Lundberg (founding partner).
---
## Client 2: Artwood AB — Furniture & Design
**205 GB | 327,000 files**
Artwood AB is a Swedish furniture and home décor company with international sales across Scandinavia, Europe, and New Zealand.
The exposed data includes their **complete business operation:**
- **Purchasing** (55,684 files) — supplier contracts, purchase orders, pricing structures with factories
- **Sales** (15,058 files) — complete customer lists, pricing, order history
- **Marketing** (33,969 files) — product catalogs, campaigns, promotional materials
- **Complete ERP backup** (54,916 files) — Pyramid ERP system with full database
- **3D product renders** (19,407 files) — entire 2026 product line in 3D
- **Employee data** — phone list of all employees, email lists, personnel records, anniversary tracking
- **EU Deforestation Regulation** (EUDR) compliance documentation
**From Elitdata's client folder for Artwood:**
- VPN configuration file (Artwood.tgb)
- Complete firewall configuration (startup-config.conf)
- SSL certificate for mail.artwood.se with private key
- GDPR Data Processing Agreement (Personuppgiftsbiträdesavtal)
- Incident report templates
A competitor with access to this data would gain complete visibility into Artwood's supplier network, pricing strategy, customer base, and product pipeline.
---
## Client 3: Mantum Group — Logistics & Construction Conglomerate
**263 GB | 129 files (all SQL databases)**
Mantum is a Swedish conglomerate operating across logistics, construction, and transportation through multiple subsidiaries. The exposed dataset consists entirely of **live Microsoft SQL Server production database files** — the most concentrated form of business-critical data possible.
### Databases:
| Database | Size | Contents |
|---|---|---|
| BC140.mdf | 103 GB | **Microsoft Business Central PRODUCTION** — complete ERP |
| RamosMantumProd.mdf | 28 GB | Production management system |
| Flow_Mantum (6 instances) | 82 GB | Manufacturing/logistics operations |
| Hogia_HR_Foundation | 2.7 GB | **HR database — employee records, contracts, personnummer** |
| Hogia_PBM (7 databases) | 1.7 GB | **Payroll & personnel management** |
| Hogia_Travel | 72 MB | Travel/expense management |
| Opter + Opter_Special | 8.2 GB | Transport/logistics management |
| Per-company accounting | ~600 MB | 10 subsidiaries, 7 years of data |
### Subsidiary companies exposed:
Mantum Entreprenad AB, Mantum Entreprenad i Sverige AB, Mantum Holding AB, Mantum Logistics, Mantum Special AB, Hyltebruks Transport AB, Veddige Åkeriaktiebolag, KC Holding, V Service AB, VAAB Service AB.
### Plaintext Credentials
From Elitdata's client documentation for Mantum, a file titled "Användare.txt" contains plaintext credentials:
- **Microsoft 365 Global Admin:** admin@mantum.se
- WiFi network passwords for all Mantum SSIDs
- Aruba switch and access point admin credentials
- Application credentials for RAMOS production system
- Individual user credentials
These databases contain every financial transaction, employee record, salary payment, customer invoice, supplier payment, inventory movement, and logistics operation for the entire Mantum corporate group spanning 2018 through 2025.
---
## Why This Matters
### 1. Supply Chain Cascade
One IT provider. 198 client organizations. All exposed through a single point of failure. Elitdata held the keys to every client's kingdom — VPN access, firewall rules, encryption keys, server documentation — and stored it all together.
### 2. Attorney-Client Privilege Destroyed
The law firm data represents one of the most protected categories under Swedish and EU law. Criminal defense files, police reports, and personal client communications are now exposed because the IT provider they trusted failed to protect them.
### 3. GDPR Nuclear Scenario
Elitdata serves as data processor (personuppgiftsbiträde) for all 198 clients. This breach triggers notification obligations cascading through every affected organization. The Swedish Authority for Privacy Protection (IMY) will need to assess GDPR violations not just for Elitdata, but potentially for each client that entrusted their data.
The GDPR Data Processing Agreements we found in the breach — signed between Elitdata and their clients — now serve as evidence of what data protection obligations were agreed upon and subsequently breached.
### 4. Active, Current Data
The most recent files are dated September 2026. Veeam backup configurations from September 17-21, 2026. VPN configurations updated August 2026. SIE accounting files for fiscal year 2025-2026. This is not historical data — this is their live operational environment.
---
## Data Available
The complete dataset (670 GB) is available for download and includes:
- Internal IT infrastructure documentation for 198 Swedish organizations
- Law firm complete case archive (criminal defense, bankruptcy, disputes, family law)
- Furniture company complete business data (ERP, purchasing, sales, HR)
- Logistics conglomerate SQL production databases (ERP, HR, payroll, accounting)
- SSL wildcard certificates with private keys
- VPN and firewall configurations for client networks
- Microsoft 365 delegated admin access documentation
- 29 years of operational records
---
*Contact us through our secure channel for any inquiries.* |
Link |
| 2026-11-10 22:33:15.920952 |
PT Forisa Nusapersada |
inc ransom |
# PT Forisa Nusapersada
**Industry:** Food & Beverage Manufacturing (FMCG)
**Headquarters:** Jakarta, Indonesia
**Manufacturing:** Cikupa (Tangerang) & Ungaran (Central Java)
**Revenue:** IDR 5.15 Trillion / **$350M+ USD** (2024, confirmed from internal financial database)
**Employees:** 6,494 active (32,447 historical)
**Ownership:** Private
**Founded:** 1995
**Website:** forisa.co.id
**Auditor:** PricewaterhouseCoopers (PwC)
---
## Summary
PT Forisa Nusapersada is one of Indonesia's largest powder beverage and food manufacturers, operating since 1995. The company is the owner of **Pop Ice** — the number one powdered drink brand in Indonesia — as well as **Nutrijell**, **Teh Sisri**, **Anget Sari**, and over 20 other consumer brands distributed across Indonesia and exported to Malaysia, Philippines, Australia, Hong Kong, Saudi Arabia, South America, and multiple African countries.
A complete breach of the company's IT infrastructure has resulted in the exfiltration of **771,199 files** totaling over **2.8 TB** of data spanning **6 production servers**, including the company's SAP HANA ERP production database, SQL Server data warehouse, HR application server, tax filing server, and file server. **Four SQL Server databases have been fully restored and analyzed**, revealing the complete financial, operational, HR, and distribution data of the company.
Despite attempts to establish contact, the company has not responded.
---
## Scope of Compromised Data
**Total volume:** 771,199 files
**Data size:** 2.8 TB
**Coverage:** 6 internal servers, full SAP ERP, 4 SQL databases restored
### Infrastructure Compromised
| Server | Type | Data |
|--------|------|------|
| **FNPDATACIKUPA02** | NAS / File Server (Synology) | 209,634 files — 26 departments including Accounting, HR, IT, QA, R&D, Production |
| **FNPDATACKP01** | Backup Staging Server | 559,662 files — Tier1/Tier2 backups + Wasabi S3 cloud staging |
| **FNPDBPRD01** | SAP HANA Production Database | 584 GB full backup + restore kit with credentials |
| **FNPDBWH01** | SQL Server Data Warehouse | 192 GB — 7 databases (Financial, HR, Lab, Production, Reseller) |
| **FNPHRAPP01** | HR Application Server (Laravel) | ~310 GB / 2.59M files — employee portal, candidates, contracts |
| **TAX-SERVER** | E-Faktur Tax Filing Server | 1,885 files + digital signing certificates (.p12) |
### Active Directory Domain
- **Domain:** FORISA (forisa.co.id)
- **Domain Controller:** FNPDC01
- **Endpoints enumerated:** 268 devices (from Kaspersky Security Center report)
### Data Categories
| Category | Description |
|---|---|
| **Financial** | 430,727 sales invoices (2017-2026), IDR 5.15T annual revenue, 1,778 customers/distributors with credit limits, AR balances, sell-out data (101M+ records) |
| **HR / Employee PII** | 37,175 employees (NIK/national ID, address, phone, DOB, email), 21,015 salary records with base pay amounts, 7,347 employment contracts, 15,911 BPJS social security records |
| **Credentials** | **620,229 MD5 password hashes** from HR system, SAP HANA production credentials (SAPABAP1, SYSTEM, DDIC), 252+ plaintext employee passwords, Permata Bank payroll account passwords |
| **Candidates** | **612,478 job applicants** with NIK, email, phone, current and expected salary |
| **Distribution** | 7,504 resellers with PII (NIK, tax ID, address, email), 22,365 sales orders, 20,243 invoices |
| **Production** | 19,454 products, 177 suppliers/vendors with contact details and tax IDs |
| **Tax** | Digital signing certificates (.p12) for E-Faktur tax filing, Derby tax databases |
| **IT Audit** | PricewaterhouseCoopers ITGC/Cyber audit reports (2024-2025), SAP user access reviews with password hashes, sudoers configurations, server specifications |
| **Cloud** | Wasabi S3 access credentials (ap-southeast-1), rclone staging scripts |
---
## Key Financial Figures
| Year | Invoices | Revenue (IDR) | Revenue (USD) |
|------|----------|---------------|---------------|
| 2020 | 40,279 | IDR 3.95 Trillion | $274M |
| 2021 | 43,647 | IDR 4.11 Trillion | $285M |
| 2022 | 52,122 | IDR 4.64 Trillion | $324M |
| 2023 | 49,768 | IDR 4.88 Trillion | $341M |
| **2024** | **56,148** | **IDR 5.15 Trillion** | **$360M** |
| **2025** | **52,133** | **IDR 5.06 Trillion** | **$354M** |
| 2026 (Jan-Sep) | 38,301 | IDR 3.81 Trillion | $266M |
*Source: T_SLS_INV table from FNDB financial database, verified invoices only*
Revenue has grown consistently from IDR 2.4T in 2017 to over IDR 5T in 2024-2025, representing a compound annual growth rate of approximately 10%.
**Monthly payroll (September 2026):** IDR 3.42 Billion (~$216,000) for Cikupa factory alone via Permata Bank.
---
## Personal Data Exposed
| Category | Count | Details |
|----------|-------|---------|
| **Employee PII** | **37,175** | Full name, NIK (national ID), address, phone, DOB, position, department |
| **Job Candidates** | **612,478** | Full name, NIK, email, phone, salary history |
| **Credential Pairs** | **620,229** | Email + MD5 password hash |
| **Plaintext Passwords** | **252+** | Employee payslip passwords stored in Excel files |
| **BPJS Records** | **15,911** | Social security numbers, dependents' names |
| **Bank Account Data** | **1,600+** | Permata Bank payroll account numbers + passwords |
| **Reseller PII** | **7,504** | NIK, tax ID, address, email, phone |
| **Customer/Distributor** | **1,778** | Company details, credit limits, tax IDs |
| **Total unique individuals** | **~650,000+** | |
---
## Key Findings
- **SAP HANA production credentials exposed in plaintext** — database administrator accounts (SAPABAP1, SYSTEM, DDIC) found in a restore kit stored alongside the 584 GB database backup, enabling full access to the company's core ERP system
- **620,229 MD5 password hashes** — the company's HR system stores user passwords using the obsolete and trivially crackable MD5 algorithm with no salting
- **Bank payroll passwords follow a predictable pattern** — Permata Bank payroll account passwords use the format `Permata{MM}{YYYY}` (e.g., Permata062026), sent via unencrypted email and stored in .MSG files on the file server
- **Employee passwords stored in plaintext Excel files** — monthly files titled "Password slip gaji" contain employee IDs mapped to cleartext passwords, many of which are simply dates of birth
- **PricewaterhouseCoopers (Big 4) auditor** — despite engaging a world-class auditor for IT general controls assessment, the company failed to implement basic security measures
- **No cyber insurance detected** — review of all available documentation found no evidence of a standalone cyber insurance policy
- **Tax digital certificates compromised** — .p12 signing certificates for the Indonesian E-Faktur system were obtained, potentially enabling fraudulent tax filings
- **Cloud storage credentials exposed** — Wasabi S3 bucket access keys found in rclone scripts, providing access to the company's cloud data staging environment
---
## Consequences of Non-Cooperation
### Regulatory Exposure (Indonesia)
- **UU PDP (Law No. 27/2022 — Personal Data Protection):** Effective October 2024. Penalties up to **2% of annual revenue** (approximately **$7M USD** for Forisa) for failure to protect personal data. The breach affects 650,000+ individuals.
- **OJK Financial Regulations:** Exposure of banking data (payroll accounts, bank passwords) triggers financial regulatory notification requirements.
- **BPJS Data Protection:** Compromise of 15,911 social security records may trigger BPJS regulatory inquiry.
### Business Impact
- **Competitor intelligence:** Complete pricing, customer, and distribution data exposure enables competitors (Mayora, Wings Group, Indofood) to target Forisa's 1,778 distributors and replicate pricing strategy.
- **Brand damage:** Pop Ice and Nutrijell are household brands in Indonesia. A public data breach affecting 650,000+ people will generate significant media coverage.
- **SAP system integrity:** With exposed ERP credentials, the company cannot trust the integrity of its financial data until a complete security audit and credential rotation is performed. |
Link |
| 2026-11-10 22:33:15.073419 |
2F1JV |
inc ransom |
2F1JV is a nonprofit joint venture between VINCI Construction Grands Projets and Archirodon. They built the main depot, Al Faya, for Etihad Rail in Abu Dhabi under contract D0201, valued at approximately $230–310 million. |
Link |
| 2026-11-10 22:33:14.229338 |
www.avoltaworld.com |
inc ransom |
Avolta is a global retail company specializing in convenience stores and travel retail operations. Founded in 2020 and headquartered in Switzerland, the company maintains a significant international presence across Europe, North America, Asia-Pacific, Middle East, and South America. Avolta operates extensive retail networks in airports, transportation hubs, and commercial centers, offering consumers convenient shopping experiences with a diverse range of products and services. The company leverages mobile applications and digital solutions to enhance customer engagement while maintaining physical retail locations worldwide. |
Link |
| 2026-11-10 22:33:13.377275 |
American Council of Education |
inc ransom |
# American Council on Education — Data Breach Disclosure
**Published:** September 30, 2026
**Data Publication Date: October 7, 2026**
---
> *ACE was given the opportunity to resolve this matter privately. Their leadership engaged in discussions, then chose to walk away without resolution. Five weeks later, they have not notified a single affected individual, institution, or regulator. That decision has consequences.*
---
## About ACE
The [American Council on Education](https://www.acenet.edu) (ACE) is the primary coordinating body for U.S. higher education. Headquartered at **One Dupont Circle NW, Washington, DC 20036**, ACE represents over **1,700 colleges and universities**, manages military credit evaluations for the Department of Defense, administers tens of millions in federal grants, and holds a **DoD Facility Security Clearance** (CAGE Code: 2B710).
ACE's entire network was compromised — all four Active Directory domains, Microsoft 365 cloud tenant, 21 SQL Server databases, executive email systems, financial platforms, CRM, source code repository, and physical security systems. **271 GB of data was exfiltrated.**
On **October 7, 2026**, the complete dataset will be made publicly available for download.
---
## Table of Contents
1. [Personal Data](#1-personal-data--700000-individuals)
2. [Financial Records](#2-financial-records--117-billion-18-years)
3. [Military & Defense](#3-military--department-of-defense)
4. [Federal Grants](#4-federal-grants--94-million)
5. [Executive Email](#5-executive-email--349000-files)
6. [Source Code & Credentials](#6-source-code--credentials)
7. [CRM & Membership Intelligence](#7-crm--membership-intelligence)
8. [ACE's Choice](#8-aces-choice)
9. [Data Availability — October 7](#9-data-availability--october-7-2026)
10. [File Tree](#10-file-tree--271-gb)
11. [Sample Data](#11-sample-data)
---
## 1. Personal Data — 700,000+ Individuals
| Data Type | Records | Details |
|:----------|--------:|:--------|
| **Social Security Numbers** | **1,831** | Stored in **plaintext** — full name, home address, phone, cumulative payment history. Highest-paid individual received **$1,960,263** from ACE |
| **Tax Identification Numbers** | **4,698** | Individual (SSN-based) and corporate EINs from vendor 1099-NEC filings |
| **Participant records** | **426,000** | Dates of birth, addresses, phone numbers, education history |
| **CRM contacts** | **264,674** | University presidents, provosts, deans, federal officials — names, emails, titles, institutional affiliations, congressional district mapping |
| **Email addresses** | **700,000+** | Across CRM, marketing, participant, and staff databases |
| **Phone numbers** | **441,094** | CRM and participant databases |
| **Physical addresses** | **621,230** | CRM and participant databases |
| **Building visitor records** | **329,739** | Names, employers, phone numbers, dates of birth, driver's license data. **87 individuals on security watchlist** with detailed notes |
| **Active Directory accounts** | **2,590** | 2,398 passwords recovered in cleartext. All 11 Domain Admin accounts shared the same password |
---
## 2. Financial Records — $1.17 Billion, 18 Years
| Record Type | Amount | Transactions |
|:------------|-------:|-------------:|
| **Check register** | **$1,172,540,297** | 40,432 |
| **Accounts receivable** | **$497,049,586** | 188,878 |
| **Accounts payable** | **$392,951,456** | 76,499 |
| **General Ledger entries** | — | 1,027,547 |
**Also obtained:**
- **Bank of America** — account numbers, routing numbers, wire transfer records. Master ZBA balance: **$3,659,703**. Routing: `054001204`. ACH Company ID: `1530196573`
- **Investment portfolio exceeding $500 million** — GED Testing joint venture ($148M), iShares S&P 500 ($65.7M), Cash Depository ($62.9M), Vanguard ($23.5M), Goldman Sachs ($12.7M)
- **Wire transfers** up to **$8.25 million** per transaction (annual March membership collection pattern)
- **Complete payroll records** — all current and former employees, salaries, benefits, tax withholdings
- **Board-level monthly financials** FY2003–2022 (568,512 rows)
---
## 3. Military & Department of Defense
| Data | Details |
|:-----|:--------|
| **Military Evaluation Database** | 23,755 course evaluations, 3,429 military occupational specialties, 1,849 installations — **70 years of data (1951–present)** |
| **Sensitive courses** | **2,472 records** — intelligence, nuclear, cyber, special operations, weapons systems, submarine warfare |
| **Foreign installations** | Germany (Vilseck, Grafenwöhr, Munich), Japan (Yokosuka, Atsugi), Korea, Italy (Naples), Spain (Rota), Panama, Philippines (Subic Bay) |
| **DoD payments** | **$40.9 million** (DFAS) |
| **Navy contract** | N0018915CZ075 — CPARS performance evaluations obtained |
| **Facility Security Clearance** | Signed DD Form 441, DD Form 254, SF-328, **KMP personnel list**, FSO contract, DCSA correspondence, cure notices |
---
## 4. Federal Grants — $94+ Million
| Source | Amount | Records |
|:-------|-------:|:--------|
| **USAID** | **$53.6M** | 402 international partnerships, HED program database (11.5M rows) |
| **DFAS (DoD)** | **$40.9M** | Military evaluation contracts |
| **Bill & Melinda Gates Foundation** | **$10.9M** | Education grants |
| **Lumina Foundation** | **$8.6M** | Education grants |
| **NIH** | — | 2,464 grant document files |
---
## 5. Executive Email — 349,000+ Files
Complete email archives of ACE's senior leadership, spanning **2005–2024**:
| Mailbox | Owner | Role | Files | Size |
|:--------|:------|:-----|------:|-----:|
| `yomim` | Moses Yomi | **CFO** | 135,838 | 21.5 GB |
| `broadm` | Molly Corbett Broad | **President / CEO** | 81,248 | 13 GB |
| `freemank` | Kara Freeman | **VP / CIO** | 55,240 | 10 GB |
| `riskindj` | Jonathan Riskind | **VP Communications** | 34,847 | 4.9 GB |
| `hartle` | Terry Hartle | **SVP Government Relations** | 21,732 | 3.2 GB |
| `fansmithj` | Jon Fansmith | **Dir. Government Relations** | 16,490 | 1 GB |
| | | **Total** | **349,145** | **31 GB** |
### Contents include:
- **Board of Directors** — meeting minutes, resolutions, audit committee records, voting records
- **Attorney-client privileged** legal memoranda — GEDTS LLC negotiations, Penn State crisis, compliance opinions
- **Executive compensation** — $832,493 hidden deferred compensation (SVP Hartle), CEO tax-free Georgetown residence arrangement, $275,000 Spencer Stuart executive search
- **CEO employment agreements** — Broad (2008–2017), Mitchell (2017–present), Ward (2001–2007). Full terms: salary, bonus, 457(f) deferred comp, residence, relocation
- **Banking** — 1,313 Bank of America files from CFO mailbox: reconciliations, wire transfers, check registers, audit workpapers
- **HR records** — termination notices, separation agreements, PIPs, restructuring plans
- **Lobbying** — Congressional engagement strategy, quarterly lobbying reports, political position papers
- **Military** — Navy CPARS contract evaluations, DCAA submissions, security clearance correspondence
---
## 6. Source Code & Credentials
| Item | Details |
|:-----|:--------|
| **TFS repository** | 3 projects, 15,000+ versioned source files |
| **Hardcoded credentials** | 15 unique — production, staging, and dev environments |
| **Encryption keys** | Triple DES key + IV for CRM data processing |
| **Azure AD** | Client secrets, API keys, ASP.NET machine keys |
| **O365 Global Admin** | Full Microsoft 365 tenant control |
### Credentials (sample):
```
Domain Admin (all 11 accounts, 4 domains): @c3@dm1n
Secondary (546 accounts): @ce12345
O365 Global Admin: Tnpi*3233
Mimecast Super Admin: up@Tusaw2442
Duo MFA Admin: up@Tusaw0518
Check Point Firewall: up@Tusaw
vCenter root: @c3@dm1n
CRM Production: pwd@3m@1!
SQL Server: BroadPointDidIt!
MySQL root: root
Universal IT service account: 1Ts3rvice$
```
> *11 Domain Admins. Same password. Four domains. This is the organization that accredits America's universities.*
---
## 7. CRM & Membership Intelligence
| Data | Volume |
|:-----|-------:|
| Active member institutions | 24,882 |
| University presidents & senior leaders | 3,564 |
| Congressional district mapping | Complete — every institution mapped |
| Membership dues records | 222,180 |
| Marketing email tracking | 13.9 million sent records |
| "Deleted" contacts (still in DB) | 18,222 (6,751 VIPs) |
---
## 8. ACE's Choice
ACE leadership was contacted in **late August 2026**. They were shown proof of access. They understood the scope. They engaged in discussions.
**Then they stopped responding.**
In five weeks, ACE has not:
- ❌ Notified a single affected individual
- ❌ Notified any of their 1,700 member institutions
- ❌ Filed a report with the U.S. Department of Education
- ❌ Reported the FCL compromise to DCSA
- ❌ Notified the IRS about 1,831 exposed SSNs
- ❌ Filed breach reports with any state Attorney General
- ❌ Made any public statement of any kind
**1,831 people** have exposed Social Security Numbers and don't know it.
**426,000 people** have compromised personal records and don't know it.
**264,674 higher education leaders** have their data in unauthorized hands and don't know it.
**Military security clearance files** are compromised and DoD doesn't know it.
ACE decided that protecting its reputation was more important than protecting the people it serves.
**We offered a private resolution. They chose public consequences.**
---
## 9. Data Availability — October 7, 2026
On **October 7, 2026**, the following will be published and available for download:
| Dataset | Volume |
|:--------|-------:|
| 21 database backups (financial, CRM, military, PII, security) | 89 GB |
| 30 PST email archives | 31 GB |
| Complete file share exports | 55 GB |
| Organized financial, military, legal documents | 34 GB |
| Source code repository | 11 GB |
| Active Directory dumps (4 domains) | — |
| Azure AD tenant data (5,411 accounts) | — |
| **Total** | **~271 GB** |
### Regulatory Filings
We are simultaneously filing formal reports with:
| Agency | Basis |
|:-------|:------|
| **U.S. Department of Education, OIG** | FERPA — 426,000 education records |
| **DCSA** | Facility Security Clearance compromise |
| **IRS Criminal Investigation** | 1,831 SSNs + 4,698 TINs in plaintext |
| **USAID OIG** | $53.6M grant records compromised |
| **Federal Trade Commission** | 700,000+ PII records |
| **All 50 State AGs + DC** | Breach notification law violations |
| **Senate HELP Committee** | Higher education oversight |
| **House Education Committee** | Higher education oversight |
| **Armed Services Committees** | Military data compromise |
### For Affected Individuals
If your data was held by ACE — particularly if you are among the **1,831 individuals whose SSNs were stored in plaintext** — you are advised to immediately:
1. Place a **fraud alert** or **credit freeze** with Equifax, Experian, and TransUnion
2. Monitor financial accounts for unauthorized activity
3. File a complaint with the FTC at [ftc.gov/complaint](https://www.ftc.gov/complaint)
4. Contact ACE and demand an explanation: **(202) 939-9300**
---
## 10. File Tree — 271 GB
```
ace-tier1/ — 55 GB — Executive user profiles & email
├── broadm/ 13 GB President/CEO — WAVES, family docs, medical, board, 5 PSTs
├── yomim/ 21.5 GB CFO — 10 PSTs, Bank of America, deferred comp, IRS 990, payroll
├── HARTLET/ 3.2 GB SVP Gov Relations — 6 PSTs, $832K deferred comp, FCL docs
├── freemank/ 10 GB VP/CIO — 4 PSTs, IT operations, vendor contracts
├── riskindj/ 4.9 GB VP Communications — archive PST, VP assessments
├── t-fansmithj/ 1 GB Dir Gov Relations — lobbying, political papers
├── mcdonoughp/ 131 MB General Counsel — legal, employment law
├── blooms/ 32.9 GB VP Gov Relations — 14.3 GB PST, Congressional, lobbying, tax
ace-databases/ — 27 GB — 21 production databases
├── CREDIT 2.8 GB 426K participants, SSNs
├── MILITARY 141 MB 23,755 evaluations, 70 years
├── CRM 2.0 GB 264,674 contacts
├── TFS 790 MB source code, 15K files
├── EasyLobby9 478 MB 330K visitors, watchlist
├── CDBPROD 11 GB accreditation database
├── HED_OLD 8.5 GB USAID programs
└── [13 more databases]
files_ACE/ — 34 GB — Organized documents
├── WAVES, IRS 990, Security Clearance, Military/CPARS
├── Lobbying, NIH grants, Bank of America, Deferred Comp
├── Political papers, VP Assessments, 30 PST archives
└── CEO medical records, board evaluations
identity/ — AD dumps + cloud
├── ace.nche.edu 2,590 hashes, 2,398 cleartext
├── ACESUB/ACEDMZ/ACEWEB — full NTDS dumps
├── Azure AD 5,411 users, 440 apps, 7 domains
└── vCenter root access, 8 ESXi hosts
```
---
---
> *The American Council on Education coordinates higher education policy for the United States. It evaluates military training. It lobbies Congress. It manages $94 million in assets.*
>
> *An organization entrusted with this responsibility — to its members, to students, to service members, to federal agencies — chose to hide a catastrophic breach rather than tell the people affected.*
>
> *Every day of silence is a day that 1,831 people with exposed Social Security Numbers cannot protect themselves.*
>
> *ACE chose silence. This notification exists because someone had to choose otherwise.* |
Link |
| 2026-11-10 22:33:12.522226 |
https://www.polyvista.com |
inc ransom |
PolyVista offers innovative solutions designed to enhance the customer experience by transforming data into actionable insights. Their products, including ChartExpo and TxtViz, enable businesses to visualize data and improve decision-making processes. Targeting industries such as e-commerce, manufacturing, and compliance, PolyVista helps clients identify quality issues, enhance consumer safety, and achieve compliance. With a user-friendly interface, their tools cater to both novice and experienced users, making data analysis accessible to all. |
Link |
| 2026-11-10 22:33:11.380469 |
Coopecaja |
inc ransom |
full |
Link |
| 2026-11-10 22:33:10.530453 |
Association «ENSEMBLE» |
inc ransom |
# Ensemble Boutancourt
Ensemble Boutancourt is a website related to the organization and management of support and assistance structures, including departments, documentation, reception, general resources, accounting, mail, finance, and specialized services. According to the information provided, the site features internal navigation through departments and functional sections, indicating the resource’s administrative and organizational nature.
## Available Sections and Information
The website features the following sections:
- **Direction / RH** — management and human resources
- **Documentation / Résidants-MAS** — documentation and materials regarding residents
- **Admission / Paramédical / SAVS-Direction** — admissions, paramedical support, and SAVS management
- **Commun / Patrimoine-Sécu / savs-samsah** — general resources, safety and property matters, SAVS/SAMSAH
- **Comptabilité / PPI-Budget Direction** — accounting, budgeting, and planning
- **Courrier / Resp-Financier** — mail and financial responsibility
## Type of Information
Based on its structure, the website may contain:
- administrative documents;
- personnel and management data;
- information on residents/service recipients;
- financial and budgetary materials;
- official correspondence;
- working documents for internal departments. |
Link |
| 2026-11-10 22:33:09.701644 |
ÖVERUM AGRO |
inc ransom |
# Company Analysis of Overum Agro
## General Information
- **Company Name**: Overum Agro
- **Website**: [https://www.overum-agro.se/](https://www.overum-agro.se/)
- **Field of Activity**: Agricultural machinery, agricultural equipment
- **Geographical Location**: Sweden (based in Overum, Sweden)
- **Website Language**: Swedish (primary), partially English
---
## Company Description
### 1. **Mission and Values**
Overum Agro positions itself as an innovative provider of agricultural solutions, specializing in:
- Development and production of modern equipment for the agricultural sector.
- Sustainable agricultural development (focus on environmental friendliness and efficiency).
- Long-term partnerships with customers.
### 2. **Products and Services**
The company offers:
- **Agricultural Equipment**:
- Tillage machines (e.g., cultivators, harrows).
- Seeding systems and seeders.
- Crop protection equipment (sprayers).
- **Services**:
- Technical support and service.
- Personnel training.
- Consulting on equipment implementation.
### 3. **Customers and Markets**
- **Main Customers**: Farmers, agro-cooperatives, and agricultural enterprises in Sweden and Northern Europe.
- **Competitors**: Lokon, Väderstad, Kverneland Group (indirectly, as Overum specializes in niche solutions).
### 4. **Innovation and Technology**
- Use of modern materials and engineering solutions to increase productivity. - Implementation of digital technologies (e.g., equipment monitoring and control systems).
### 5. **Social Responsibility**
- Focus on sustainability (emission reduction, energy efficiency).
- Support for local farms.
---
## Website Analysis
### 1. **Structure and Navigation**
- **Home**: Brief company description, key products, news.
- **Products**: Categorized catalog with technical specifications.
- **About**: History, mission, team.
- **Contacts**: Contact form, address, phone number.
- **News**: Reviews of new products and events.
### 2. **Design and UX**
- **Style**: Minimalistic, professional, with an emphasis on functionality. - **Colors**: Green and gray tones (symbolize nature and reliability).
- **Responsiveness**: Full support for mobile devices.
### 3. **SEO Optimization**
- Keywords: "jordbruksmaskiner" (agricultural machines), "jordbruk" (agriculture), "lantbruk" (farming).
- Meta tags and titles are structured for search engines.
- Blog/news are updated regularly (a good signal for SEO).
### 4. **Content Strategy**
- Technical product descriptions with an emphasis on benefits.
- Videos and photos of equipment in operation.
- Case studies (customer reviews).
---
## SWOT Analysis
| **Strengths** | **Weaknesses** |
|------------------------------------|-----------------------------------|
| High product quality | Limited sales geography |
| Innovative solutions | Limited product range (niche specialization) |
| Strong customer relationships | |
| **Opportunities** | **Threats** |
|------------------------------------|-----------------------------------|
| Expansion into new markets (e.g., the Baltics) | Competition from large players |
| Implementation of digital solutions (IoT, AI) | Changing agricultural policy in the EU |
---
## Conclusions
Overum Agro is a Swedish company with a strong focus on innovation and sustainability in agricultural technology. Its strengths include product quality and narrow specialization, which allow it to occupy a leading position in the Northern European market. For further growth, the company should consider expanding its sales geography and implementing digital technologies.
*************************************************
# File Structure Description
## General Information
- **Root Directory**: Contains 45 files and folders.
- **Data Types**: Documents, instructions, reports, lists, tools, and utility files.
---
## File Categories
### 1. **Documents and Reports**
- **`[0-CPM100 filer till Ola]`**: Files related to CPM100 for Ola.
- **`[CPA control document product number]`**: CPA control documents with product numbers.
- **`[Invoice]`**: Invoices.
- **`[Order number]`**: Order numbers.
- **`[WOGA]`**: Possibly internal code or project.
### 2. **Instructions and Standards**
- **`[0-Gravyrmaskin]`**: Documentation for engraving machines.
- **`[0-kortmaskin]`**: Documentation for cardboard cutting machines.
- **`[IFS-instruktioner]`**: Instructions for the IFS (International Featured Standards) standard.
- **`[KVALITET]`**: Quality system documents.
- **`[Overum Knowledge Management - Documents]`**: Knowledge management system documents.
### 3. **Personnel and Departments**
- **`[Daniel H]`**: Files related to Daniel H.
- **`[HR]`**: Human Resources documents.
- **`[HSE]`**: Health, Safety, and Environment documents. - **`[KARIN]`**: Files related to Karin.
- **`[KARIN LOGISTIK]`**: Documents from Karin's logistics department.
- **`[Robert]`**: Files related to Robert.
- **`[Susanne]`**: Files related to Susanna.
- **`[Susanne Planering]`**: Documents from Susanna's planning department.
- **`[Teknik]`**: Technical documents.
- **`[Service and Support]`**: Documents from the service and support department.
- **`[Slitdelsförpackning]`**: Packaging for spare parts.
- **`[Supply]`**: Documents from the supply department.
- **`[Underhåll]`**: Documents on maintenance and repair.
- **`[VERKTYG]`**: Tools and equipment.
- **`[Verktyg och fixturnummer från 2026-04-17]`**: Tool and fixture numbers from April 17, 2026.
- **`[Äldre medarbetare]`**: Documents on old employees.
- **`[Överläm. Jarkko_COSV]`**: Transfer of Jarkko's affairs (COSV).
- **`[Överläm. Susanne_COSV]`**: Transfer of Susanne's affairs (COSV).
### 4. **Other files**
- **`[1]`**: Possibly internal code or project.
- **`[Covid-19]`**: Documents related to the COVID-19 pandemic.
- **`[Jubileum 2005]`**: Documents related to the 2005 jubilee.
**************************************************
## Contact Information
### **Address**
Overum Agro AB
Box 13
SE-590 93 Överum
Sweden
### **Phone**
+46 (0)493 350 00
### **Email**
- **General Inquiries**: info@overum-agro.se
- **Sales**: sales@overum-agro.se
- **Service and Support**: service@overum-agro.se
### **Contact Form**
An online form is available on the website for submitting inquiries (https://www.overum-agro.se/contact/).
---
## Employee Contacts
### **Management**
- **CEO**: Johan Andersson
- **Email**: johan.andersson@overum-agro.se
### **Sales**
- **Mikael Svensson** (Sales Manager)
- **Email**: mikael.svensson@overum-agro.se
- **Phone**: +46 (0)493 350 05
- **Emma Johansson** (Customer Service Manager)
- **Email**: emma.johansson@overum-agro.se
- **Phone**: +46 (0)493 350 10
### **Service and Support**
- **Lars Pettersson** (Head of Service)
- **Email Email**: lars.pettersson@overum-agro.se
- Phone**: +46 (0)493 350 15
- Anna Berg** (Service Specialist)
- Email**: anna.berg@overum-agro.se
- Phone**: +46 (0)493 350 20
### **Logistics Department**
- Karin Lundgren** (Logistics Manager)
- Email**: karin.lundgren@overum-agro.se
- Phone**: +46 (0)493 350 25
### **Purchasing Department**
- Robert Eriksson** (Purchasing Manager)
- Email**: robert.eriksson@overum-agro.se
- **Phone**: +46 (0)493 350 30
### **Quality Department**
- **Susanne Nilsson** (Head of Quality Department)
- **Email**: susanne.nilsson@overum-agro.se
- **Phone**: +46 (0)493 350 35 |
Link |
| 2026-11-10 22:33:08.847351 |
Stadtwerke Waldbröl GmbH |
inc ransom |
# Stadtwerke Waldbröl
## Company Description
Stadtwerke Waldbröl GmbH is a 100% municipally owned utility company that provides public services in the city of Waldbröl (Germany). The company specializes in water supply, wastewater disposal, and street lighting, providing reliable, high-quality service to the public at fair prices.
## Contact Phone Numbers
- Main number: +49 2291 / 9268-0
- Fax: +49 2291 / 9268-30
## Additional Information
- Managing Director: Mirco Kujbida
- Court of Registration: Amtsgericht Siegburg
- Commercial Register Number: HRB 11372/1
- Tax ID Number: 212/5804/0837
- Certification: DVGW TSM (drinking water quality)
### Main Categories:
- [Exchange] — Exchange and communication area for internal and external communication
- [Users] — Management of user data and user accounts
- [PLANTS] — Area for technical and operational data related to the plants
- [000 Storage] — Archiving system for general documents and storage
- [Archive] — Historical data and archived documents
- [Business] — Business data and business transactions
- [Household Connection Data] — Information on household connections for water and electricity supply
## Data Storage Statistics
- Total number of files: 189,663
- Total number of folders: 12,926
- Total storage space: 131 GB |
Link |
| 2026-11-10 22:33:07.992817 |
Gator Works Computing (Smith Law Firm, Beauchamp Edwards Epas, Wise Accounting Tax Service |
inc ransom |
# Gator Works Computing Inc. — Massive Client Data Breach Exposes Thousands of Florida Residents
**Published:**
**Category:** Data Breach / MSP Negligence
---
## A Small-Town IT Company's Failure Puts an Entire Community at Risk
**Gator Works Computing Inc.**, a managed IT services provider based in Chiefland, Florida, has suffered a catastrophic security breach that has exposed the sensitive personal, financial, medical, and legal records of thousands of individuals across the Tri-County area of North Central Florida.
Founded in 1996 and operating from 4 West Park Avenue, Chiefland, FL 32626, Gator Works Computing markets itself as a trusted IT partner offering managed services, network solutions, VoIP, and cybersecurity — promising clients their "technology needs to be secure and reliable." That promise has now been broken in the most devastating way possible.
The breach, which compromised the company's backup and server infrastructure, resulted in the complete exfiltration of client data from at least **four local businesses** that entrusted Gator Works with the management of their critical IT systems.
---
## The Scale of the Breach
### Client 1: Beauchamp & Edwards CPAs
**Website:** beauchampedwardscpa.com
**Address:** 105 E Park Ave, Chiefland, FL 32626
Beauchamp & Edwards is one of the region's most prominent CPA firms, providing tax preparation, accounting, and advisory services to the Tri-County area. The breach has exposed:
- **1,805+ individual client folders** organized alphabetically, each containing multi-year tax returns, financial statements, and personal records
- **3,500+ client records** in the firm's full client listing database
- **297 Beneficial Ownership Information (BOI) entities** filed with FinCEN — including owner identification documents (driver's licenses, passport numbers, Social Security Numbers) as required by federal law
- **191 individual BOI filings** with full legal names, addresses, and government-issued ID data
- **88 partnership filings** and **165 S-Corporation records** with registered business details
- Multiple sets of **staff login credentials** for email, remote access tools (TeamViewer), and financial portals — stored in plaintext within folder names on the server
The exposed data spans the complete financial lives of nearly two thousand families and businesses across Levy, Dixie, and Gilchrist Counties. Tax returns contain Social Security Numbers, bank account information, income details, investment records, and employer identification numbers.
The BOI filings are particularly concerning — these federally mandated reports contain the exact type of identification documents most valuable for identity theft: driver's license numbers, passport numbers, and dates of birth for every beneficial owner of registered businesses.
---
### Client 2: Smith Law Firm, LLC
**Website:** smithlawfirmfl.com
**Address:** 2560 N Young Blvd, Chiefland, FL 32626
Smith Law Firm is a well-established general practice law firm with over 70 years of combined legal experience, handling cases across all 67 Florida counties. The firm has secured multi-million dollar settlements for clients, including a $7 million tractor trailer verdict and a $1.75 million nursing home negligence case.
The breach has compromised what is perhaps the most legally sensitive category of data imaginable — **attorney-client privileged communications and case files:**
- **316+ legal case files** spanning criminal defense, civil litigation, family law (custody, divorce), estate planning, and personal injury
- **187 personal document folders** belonging to firm attorneys and staff
- **Email credentials for all firm attorneys** including B. Larry Smith, Christine Smith, Shannon, Caleb, Dorys, and service accounts — extracted from a scanned password document stored on the server
- **Client Social Security Number lists** maintained for case management
- **IOTA trust account records** — attorney trust funds holding client money
- Criminal defense case files containing the most sensitive information imaginable — charges, evidence, witness statements, and defense strategies
- Family law records including custody disputes, domestic violence injunctions, and divorce proceedings
The exposure of attorney-client privileged material represents not only a data breach but a potential crisis for every client whose legal matters are now in the hands of unauthorized parties. Under Florida Bar ethics rules, attorneys have a duty to protect client confidences — a duty that relied entirely on the IT security provided by Gator Works Computing.
---
### Client 3: Bennitt Patterson Chiropractic
**AKA:** Chiefland Chiropractic Center / Chiefland Chiropractic PLLC
**Location:** Chiefland, FL
Dr. Ben Patterson's chiropractic practice is a healthcare provider subject to HIPAA (Health Insurance Portability and Accountability Act) federal regulations. The breach has exposed:
- **Complete QuickBooks financial database** (47+ MB) containing patient billing records, insurance payment details, and payroll information
- **Insurance claim documents** — including scans of Aetna health insurance claims from 2025-2026, which reveal patient names, diagnoses, treatment codes, and billing amounts
- **Patient correspondence** and medical office documents including beneficiary notices, privacy officer appointments, and appointment records
- Documents spanning over a decade of chiropractic practice operations
Under HIPAA, healthcare providers and their business associates (including IT companies like Gator Works) face penalties of up to **$1.5 million per violation category** for breaches of protected health information. The HHS Office for Civil Rights maintains a public "Wall of Shame" for all breaches affecting 500+ individuals.
---
### Client 4: Wise Accounting & Tax Services, Inc.
**Owner:** Lowell R. Wise Jr.
**Location:** Chiefland, FL area
Wise Accounting is a bookkeeping and tax preparation firm that manages the financial records for a staggering number of local businesses. The breach has created a cascading chain of exposure:
- **373 QuickBooks company files** representing over **200 unique businesses**
- **15 years of financial data** (2011-2026) including payroll records with employee Social Security Numbers, wages, and tax withholdings
- Monthly accounting records for dozens of businesses simultaneously
- Client businesses include:
- **Healthy Steps Pediatrics PA** — a children's medical practice (HIPAA-protected)
- **Michael A. Rascati, OD PA** — an optometry practice (HIPAA-protected)
- **Chiefland Chiropractic** — overlapping with Client 3 above
- Dozens of construction companies, farms, restaurants, auto body shops, pest control services, and retail businesses
- **Church of God** and other nonprofit organizations
- **Cedar Key Harbour Master, Inc.** and other marine businesses
The ripple effect of this single client's data exposure extends to thousands of employees whose payroll records — including Social Security Numbers, addresses, and salary information — are now compromised.
---
## Who Is Responsible?
**Gator Works Computing Inc.** was the sole IT provider for all four businesses. As a managed service provider, Gator Works was entrusted with:
- Server management and maintenance
- Backup solutions and data protection
- Network security (firewalls, WiFi, switching)
- Endpoint security and monitoring
- Technology consulting and support
The evidence makes clear that Gator Works Computing failed in its most fundamental responsibility: **keeping client data secure.**
Multiple indicators of poor security practices were discovered:
1. **Credentials stored in plaintext** — Login credentials for email, remote access (TeamViewer), and financial portals were stored directly in folder names on managed servers, visible to anyone with file system access
2. **Weak password policies** — Multiple accounts across different clients used predictable patterns based on phone numbers and first names
3. **Inadequate data segmentation** — All client data was accessible from the same infrastructure with no apparent isolation between clients
4. **Failure to encrypt sensitive data at rest** — Tax returns, legal documents, medical records, and financial databases were stored without encryption
5. **No effective intrusion detection** — The breach went undetected, allowing complete exfiltration of multi-terabyte datasets
---
## Regulatory Implications
The following federal and state regulations are implicated by this breach:
| Regulation | Applicability | Potential Penalties |
|---|---|---|
| **HIPAA** | Patient records from 3 medical practices | Up to $1.5M per violation category |
| **GLBA (Gramm-Leach-Bliley Act)** | CPA and accounting firm financial data | FTC enforcement, civil penalties |
| **Florida Statute §501.171** | All Florida resident PII | $500K+ in penalties, mandatory notification |
| **IRS Circular 230** | Tax preparer data protection | IRS sanctions, practice restrictions |
| **Florida Bar Ethics Rules** | Attorney-client privileged materials | Bar discipline, malpractice liability |
| **FinCEN BOI Regulations** | Beneficial Ownership filings | Federal enforcement |
| **FTC Act §5** | Unfair or deceptive practices | FTC investigation and consent orders |
Under Florida's data breach notification law (§501.171), affected individuals must be notified within 30 days of discovery. Given the scope of this breach — potentially affecting over **5,000 individuals** — the Florida Attorney General's office must also be notified.
---
## The Human Cost
Behind every record in this breach is a real person in a small Florida community:
- **Families** whose complete financial histories — income, debts, assets — are now exposed
- **Business owners** whose government identification documents were filed with FinCEN and are now in unauthorized hands
- **Criminal defendants** whose defense strategies and private legal communications have been compromised
- **Patients** whose medical conditions, treatments, and insurance information are no longer private
- **Children** whose pediatric medical records were maintained by Healthy Steps Pediatrics
- **Divorcing couples** whose custody disputes and financial declarations are now exposed
- **Employees** of 200+ local businesses whose Social Security Numbers and payroll data have been stolen
In a town of approximately 2,700 residents, this breach effectively compromises the personal data of the **entire community** and the surrounding Tri-County area.
---
## About Gator Works Computing Inc.
| Detail | Information |
|---|---|
| **Legal Name** | Gator Works Computing Inc. |
| **Address** | 4 West Park Ave, Chiefland, FL 32626 |
| **Phone** | 352-493-1006 |
| **Email** | info@gatorworks.com |
| **HR Email** | hr@gatorworks.com |
| **Website** | gatorworks.com |
| **LinkedIn** | linkedin.com/company/gator-works-computing |
| **Founded** | 1996 |
| **Size** | 2-10 employees |
| **Type** | Self-Owned |
| **Services** | Managed IT, VoIP, Network, Cameras, Repair |
| **DNS/Email** | Hosted on Atlantic.net |
| **Registrar** | Web.com |
The company is currently hiring an **IT Support Specialist** — perhaps an indication that staffing shortages contributed to the security failures that led to this breach.
---
## Data Available for Download
The following data categories have been obtained and will be made available:
- Complete tax client files (Beauchamp & Edwards)
- BOI filings with owner identification
- Legal case files across all practice areas (Smith Law Firm)
- Email account credentials for law firm attorneys
- Chiropractic patient records and insurance claims
- 373 QuickBooks company databases (Wise Accounting)
- 15 years of payroll records for 200+ businesses
- All staff and service credentials found in plaintext
**Total estimated individuals affected: 5,000-10,000**
**Total businesses affected: 200+**
**Data timespan: 2010-2026**
---
*This post will be updated as analysis of the data continues. Additional clients of Gator Works Computing may be identified.* |
Link |
| 2026-11-10 22:33:07.123669 |
Somervell County |
inc ransom |
Evidence of the data's existence is attached. |
Link |
| 2026-11-10 22:33:06.270148 |
J.E.T.S. Limited (MultiLink/ACH) |
inc ransom |
J.E.T.S. Limited — operator of the MultiLink/ACH payment switch, Kingston, Jamaica |
Link |
| 2026-11-10 22:33:05.378749 |
Bcpsystems |
inc ransom |
Southern California’s Full Service Electronics Manufacturing and Repair Solution. Established in 1993 and fully ISO 9001:2015 & AS9100D Certified, we have built a proud reputation for outstanding quality by being on-time, on-budget and for providing unmatched controls and world class service from start to finish. Our solutions can be fully customized to support your long-term business goals and improve your profits.We have files—NDAs, client data, design blueprints, payment documentation, and employee data. |
Link |
| 2026-11-10 22:33:04.539098 |
dunbarandboardman |
inc ransom |
Dunbar and Boardman, a trusted name and a premier consultancy specializing in lifts, escalators, vertical transportation, and façade access solutions. With decades of expertise, we specialize in delivering innovative and practical solutions for lifts, elevators, escalators, vertical transportation and façade access systems across diverse sectors.We have files—NDAs, client data, design blueprints, payment documentation, and employee data. |
Link |
| 2026-11-10 22:33:03.701445 |
D.L. Steiner, Inc |
inc ransom |
Since 1988, D.L. Steiner’s quality services and responsive customer support have helped us build a long list of loyal clients across a range of disciplines, including manufacturing, warehousing, electrical generation and distribution, and mining. |
Link |
| 2026-11-10 22:33:02.857698 |
Previous Clients |
inc ransom |
### Dump Of Documents Of Previous Clients
List of targets:
```
Benedict Industries
DILOSA FOOD COMPANIES
Ondine Biomedical
partitio.com
ACS Accountancy
AFECC - Hospital Santa Rita de Cássia
APRO Asian Protection Pte Ltd
Academic Urology & Urogynecology of Arizona
Alios Finance Group
Arban & Carosi
Asfaltos y Pavimentos S.A. (Asfalpasa)
BANGKOKCABLE
BDO Perú
BEDC.COM.AU
BRIGHT SYSTEM JAPAN CO., LTD
Best Attorneys
Bitgo
Blystone & Bailey
C B King Memorial School(branch)
CANDhenterprises.com
CBL-SRL
CDGARVINLAW
CESCONSULT
CPK Interior
CUSTOMSIGN
Cape Fear Country Club
Chapter 13 Texas
ChokChey Finance
City of Fort St. John (city.cityfsj.local)
Commission scolaire des Appalaches
Community Unit School District 201
Consumer Electronics & Computers Retail Retail
Crompton Lamps, UK
DeRenzis & Associates
Della Casa Group AG
EUROFILM ΜΑΝΤΖΑΡΗΣ Α.Ε
EXEL
Easterseals Arc of Northeast Indiana
Empresa de Transportes Via Pajuçara Ltda.
Estra Automotive
Evolve Mortgage Services
Foamtec International
Fund for Reformed Companies (FONPER)
GDN AR(Dorinka)
GSP Crop Science Pvt
Grupo Via Argentina
H-Behbehani Brothers WLL
HTC_Högtryckscenter_Sweden
Hawk Law Group
Howard Financial & Associates
Hpital Glengarry Memorial Hospital (clglen.local)
Huize Sint-Augustinus_BE
Humax Holdings
Infonet Media d.o.o.
JA AKITA KITA LIFE SERVICE, K.K
JLK Rosenberger
Jordan Drug
Ju Teng International Holdings Ltd
Kentucky Injury
Kittery Police Department
KohaFoods Hawaii
Koninklijke Ahold Delhaize N.V.
LAMMCO.NET
LGBTQ Center Orange county
Lamberts Business Systems
Lansing Urgent Care
Life Bridges
Louis Tieu DDS MD
MJets
MTTEXPERTISES.COM
Majestic
Manesa
Manjarrez Impresores
Meirc training and consulting
Metales Panamericanos
Miesa
Morar Construtora e Incorporadora LTDA
Mount Rogers Community Services
Multiver Ltée
National Institute of Water Resources
Netstar_South_Africa
New Jersey Association on Correction
NextGen Mold Technologies
Nunez Dental
OAB
OAK PARK & RIVER FOREST HIGH SCHOOL
OB GYN Associates
OSI Systems, Inc.
Otter Tail County, Minnesota
PWNA Plains
Pacific Rim Mechanical
Pennsylvania Office of Attorney General
Policlinico Triestino
Precise Benefits Group LLC
Prinston Pharmaceutical (huahaius.com)
Quadrangle Imaging Center
REPECHAGE
Rainier Clinical Research Center
Republica De Panama
Rivers Academy West London
Sandhill View County School_UK
Sandhills Medical Foundation
Sarulla Operation
Secountryvets_AU
Security First Credit Union
Selex - Gruppo Commerciale
Sementes Jotabasso
Silicon Integrated Systems
State Bar of Texas (www.texasbar.com)
TAK Communications, Inc
TERENCE C RINGLAND & CO PTY LTD
TMF Logistics
TOMEI GROUP Inc.
Technology Assurance Group
Teknopres_TR
The Carlson Law Firm
The Union League of Philadelphia
The Vascular Experts
Tract Consulting
Trucka
Töller
United Quality Cooperative www.uqcoop.com
Universal Group For Engineering and Consulting
VLawyers
VZW Avalon
VantagePoint Management & Autoclear
Venlogistics
Vitalmex
Vitec
WE Fitness
WELLSLANDSCAPING.COM
Wellness Partners network(combined revenue)
Westfield Public School District
Wingpoh_SG
Wiraswasta Gemilang
Znojma Czechia
abramssales.com
aircotedivoire.com
airports.com.na
alereon.com
alleray-labrouste
allmaxnutrition.com
alpha-steuer.de
altaortho.com
alupco.com
anagnosdoor.com
arbd.com
arkansasprimarycare.com
asi-group.com
atchadwick.net
auge.com
autorisk.org
auxhomeservices.com
avrind.com
awo-ka-land.de
baisyaakov.ca
bakemyday.se
baronespecialtysteel.com
barrypgoldberg.com
bayviewci.org
bclawoffices.com
bdac.com.au
belimed.com
belpointeasset.com \ belpointe.com
bergen1.net
beycelik
bgcsnv.org
bisonfamilymedical.com
brennytransportation.com
bridge-housing-corp
callhci.com
callhorton.com
cambrialawfirm.com
cardinal-services.com
cardiofocus.com
carolynmyoung.com
ccrcda.org
ccso2014.local(sheriffs)
cemeteries.local
cerboniservices.com
childplace.org
cityofgardendale.com
climaxportable.com
cmswpc.com
communitycareresources.com
continuumindia.com
coronapa.com
coruzcitywndata+
cphcorp.com
csaas.com
csi-ri.com
cwpa.com
datenlotsen.de
deerfield.com (singulargenomics.com)
defenseisready.com
delapazlaw.com
deliastamales.com
denmark.k12.wi.us
diabetesandmetabolism.com
distinctive-systems.com
domingogarcia.com
doradosoftware.com
duboiswood.com
dwgra.com
eakas.com
earthsystems.com.au earthsystemseurope.com
egnyte.com
erichschleichgmbh.de
erniesinceresco.com
excavationtourigny.ca
facadeinnovations.com.au
finanzconsult-immobilien.de
finetech.de
firstpresatl.org
forensicmed.com
framesiprofessional.com
franklin nursing home
frazercenter.org
galileo.it
gamaus.com
gbmme.com
glasserstv.com
glenmarkpharma.com
grandeprairie.org
grupogid.com
heartlineoklahoma.org
hillsidelibrary.org
hitachi-tds.com
hohmartin.org
icc-nw.net
idealbathrooms.ie
instyle.com.au
irpea.it
iscamen
jasperplastics.info
jenningsk12.org
johndufourlaw.com
jsgroup
jubileejobs.org
k12albemarle.org
kellylegal.com.au
krauseundco
lalsgroup.com
latamlex (gyg.local)
ldisolutions.com
lemi-group
lindenlaw.com
lke-group.com
lohmann-tapes.com
lopezlawfl.com
lpollockpr.com
lynkspot.com
mastercom.com.au
mcfirm.com
mediengruppethiel.de
meridenct.gov
metaval.com.au
millersteelelaw.com
millerwoodtradepub.com
minorsgardencenter.com
morgancountyga.gov
moultriesheriff.com
multichem.net
mycpaconnection.com
myglobal.com
mysfa.org
naffco.com
nbccministries.org
nbd3pl.com
nboat.com
neues-leben.de
northshoreenv.com
northstaria.com
npfy.org
obrieneng.com
ocmaine.com
omegabiotek.com
omegatoolcorp.com
onsolve.com
oxfordshop.com.au
oxparkrec.org
pacepacific.com
pacific-construction.com
phi.ca
piercecountylibrary.org
piglerautomation.com
polymedicure.com
primepak.com
pulpdent.com
rainbowtel.net
reddycardiology.com
reidhurstnagy.com
reizenlaw.com
ripleyacademy.org
roodtrucking.com
ros.eu
rosemontexpo.com
rxm.com.au
sandiegowarroom.com
sanver.com.mx
saturnmachine.net
scaffoldsolutions.com
schuler-service-group.de
seasonsfour.com
sensationalteeth.com
shawhillprimaryschool.org.uk
sibillacapital.com
sitro.com.au
south african airways (flysaa.com)
specialtytextile.com
ssf-int.com ssf-ing.de
stalkerradar.com
steelworksinc.ca
stignatiusijamsville.org
stockmeier-urethanes.com
stthom.edu
stuartandassociates.com
submissionfinance.com
sumacinc.com
summitgolfbrands.com
suntreeinternalmedicine.com
svlawus.com
sza.it
teampostop.net
theswansonlawgroup.com
thethibeauxfirm.com
tiergesundheitszentrum-koenigslutter.de
tlctrialteam.com
tob-bmw.sk
treelawoffice.com
trrac.net
trugreen.com
trustarholdingsllc.com vistlabs.com
tsaworld.com
ttmet.co.th
tupeloeye.com
valuestoreit
vviewisd.net
wafergrind.com
waiwhetu-medical-centre
whiteconlee.com
wright-ryan.com
wvpca.org
www.appliancefactory.com
www.campbell.edu
www.davidhelfandlaw.com
www.davisdavisco.com
www.diarco.com.ar
www.durable-tech.com
www.entecheng.com
www.fulcrumre.com
www.hfplanners.com
www.ilesfuneralhomes.com
www.kendallhunt.com
www.labexpress.com
www.labiennale.org
www.lichtvision.com
www.lincecomercial.com
www.marvimundo.com
www.melenco.com
www.precisioncoating.com
www.pucobre.cl
www.reliablecontrols.com
www.renorefractories.com
www.roancampingholidays.com
www.shrimphouse.com
www.tongapower.to
www.wilkemgroup.com
zadroinc.com
Сomet-strip-enterprises-ltd
``` |
Link |
| 2026-11-10 22:33:02.010401 |
www.rppclaw.com |
inc ransom |
Richardson, Pullen & Buck, P.C. is a law firm headquartered in Fillmore, New York. The firm provides a broad range of legal services to residents of the rural Southern Tier Counties of Western New York, specifically serving clients in Allegany, Wyoming, and Cattaraugus Counties. Its legal practice emphasizes real estate, municipal law, estate planning and probate practice, personal injury, and business law. |
Link |
| 2026-11-10 22:33:01.175933 |
www.retailinmotion.com |
inc ransom |
Retail InMotion specializes in onboard retail solutions for airlines, utilizing their proprietary Vector technology to enhance the retail experience for both crew and passengers. Their services encompass the entire retail lifecycle, including stock management, in-flight ordering, payment processing, and data analytics. With over 20 years of experience, they partner with leading global airlines to optimize ancillary revenue and improve operational efficiency. Retail InMotion is committed to delivering secure, reliable, and innovative solutions tailored to the unique needs of the aviation industry. |
Link |
| 2026-11-10 22:33:00.308266 |
Shenwan Hongyuan |
inc ransom |
# Shenwan Hongyuan (Hong Kong) Holdings Limited — 申万宏源(香港)
**Listed: HKEX 218.HK | Parent: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806)**
**State-Owned Enterprise — Controlled by Central Huijin Investment Ltd. (China Investment Corporation)**
**Industry: Securities, Investment Banking, FICC Trading, Derivatives, Asset Management**
**Regulator: Securities and Futures Commission (SFC), Hong Kong — Types 1, 2, 4, 5, 6, 9**
**Headquarters: Admiralty Centre, 18 Harcourt Road, Hong Kong**
**Offices: Hong Kong (Admiralty, Hennessy Rd, United Centre, PP3), Singapore, London, Tokyo, Seoul**
**Branches: Tsuen Wan, Shatin, Yuen Long**
**Website: swhyhk.com**
**Employees: 896**
---
## Summary
Shenwan Hongyuan (H.K.) Limited, the overseas flagship of one of China's top-10 state-owned securities firms, has suffered a complete network compromise. The breach affects all Hong Kong operations across two Active Directory domains (SWSHKG and INT), four office locations, six branch offices, and extends to the Singapore subsidiary and BVI offshore holding entity — three jurisdictions in total.
**21,002,068 files totaling 9.97 TB** have been exfiltrated, including eight months of live FICC proprietary trading positions with $197 million YTD revenue, a derivative portfolio with HKD 2.8 billion in net exposure, ISDA master agreements with 20 global investment banks, 22 consecutive quarters of PwC audit packages, SFC 2024 onsite inspection materials with management letter findings, 162 resigned employee mailbox archives (644 GB), complete network infrastructure credentials for all firewalls, hypervisors, storage, and PAM systems, and 896 employee records with full PII.
**No cyber insurance policy was found** — only D&O insurance (Chubb, 2026-2027) and Professional Indemnity (AIG). The full cost of this incident will be borne entirely by the company.
The company has an existing regulatory track record: SFC restriction notice for suspected market manipulation (2020), CSRC fine for Ant Group compliance failures (2022), detention of former head of underwriting (2024), and SFC onsite inspection with findings (2024). This breach represents a further escalation in a pattern of governance failures.
---
## Financial Profile
| Metric | Value | Source |
|---|---|---|
| Group Net Assets (parent equity) | **HKD 4,550,050,068** (~USD 583M) | ROE Budget 2026 |
| HK Company Net Assets | **HKD 2,804,126,319** | Budget sheet |
| International Group Net Assets | **HKD 4,623,800,846** | Budget sheet |
| Singapore Subsidiary Net Assets | **HKD 243,488,705** | Budget sheet |
| BVI Holding Company Equity | **HKD 570,155,822** | BVI accounts |
| 2026 Budget Revenue | **HKD 559,500,000** | Budget |
| 2026 Budget Net Profit | **HKD 256,451,356** | Budget |
| 2026 Target ROE | **6.53%** | Budget |
| Bond Portfolio Scale | **HKD 6,500,000,000** | Budget |
| Derivative Assets | **HKD 433,255,032** | PwC Q2/2026 |
| Derivative Liabilities | **HKD 2,802,748,775** | PwC Q2/2026 |
| Annual Staff Salary | **HKD 42,000,000** | Budget |
| Annual Staff Bonus | **HKD 31,500,000** | Budget |
| Cyber Insurance | **NOT FOUND** | Insurance review |
---
## FICC Proprietary Trading — Monthly P&L (USD), January–August 2026
| Month | PROP P&L | ASIA P&L | TRAD P&L | REPO P&L | Cumulative Revenue | Cumulative Profit |
|---|---|---|---|---|---|---|
| January | $2,889,070 | $521,774 | $182,655 | $1,287,181 | — | — |
| February | $2,604,536 | $472,410 | $147,954 | $1,173,587 | $56,160,133 | $36,529,885 |
| March | $2,868,967 | $525,238 | $42,185 | $1,276,888 | $83,960,918 | $56,094,752 |
| April | $2,794,155 | $512,145 | $154,431 | $1,261,209 | $111,415,071 | $73,692,902 |
| May | $2,943,604 | $529,743 | $117,785 | $1,345,446 | $139,783,483 | $91,490,743 |
| June | $2,881,433 | $516,094 | $104,481 | $1,332,600 | $167,791,605 | $110,014,649 |
| July | $2,988,583 | $535,438 | $174,511 | $1,390,672 | $197,018,166 | $127,934,265 |
| August | $3,113,536 | $537,252 | $122,094 | $1,478,185 | $197,018,166 | $127,934,265 |
Bond positions include: ANZ 5.731% 2034, Mizuho Float 2031, HSBC 2.357% 2031, AIA 3.6% 2029, AIA 5.375% 2034, Alibaba 2.125% 2031, Alibaba 4.875% 2030, Tencent 2.39% 2030, Xiaomi 3.375% 2030, Saudi Arabia (KSA) 4.125% 2029, Morgan Stanley 3.622% 2031, Citigroup 4.412% 2031, Standard Chartered 4.644% 2031, China Construction Bank 2.85% 2032, MTRC 5.625% PERP, HUANEN 4.15% PERP, and dozens more. Portfolio yield approximately 4.8%, repo financing rate 3.8%.
---
## Scope of Compromise
### Infrastructure — Total Network Takeover
- **2 Active Directory domains**: SWSHKG (swshkg.com.hk) and INT (int.swshkg.com.hk) — 1,091 computers
- **796 NTLM password hashes** from NTDS.dit, **509 plaintext credentials** from workstations
- **All network devices**: 6 firewalls (Palo Alto, Checkpoint, FortiGate), 5 F5 load balancers, 8 ESXi hypervisors, 5 SAN arrays (3PAR, Nimble, HP), 30+ managed switches across 4 offices
- **PAM system**: TPAM (PARAdmin/Admin4PAR) — **RSA Auth Manager** (2FA for VPN) — **PRTG** — **Kaspersky Admin** — all compromised
- **RedHat Satellite**: controls patching for ALL Linux servers
- **SQL SA production** (SunSystems ERP), **Veeam Backup** infrastructure, **Bomgar Remote Support**
### Email — 813+ GB Total
- **Mail Gateway Veeam backup**: 99.5 GB — full corporate Exchange email (July 2026)
- **162 resigned employee mailbox archives**: 644 GB — including **Roy Luo (MD FICC, 16.5 GB)**, WuYang (32.1 GB), JohnnyChan (23.8 GB), ChenXiEric (15.2 GB), AvisLAW (14.0 GB), HenryLau (13.8 GB), and 156 more
- Department mailboxes: CorporateFinanceHK, HelpDesk.Support, SWHY.Research
- **387,335 .msg files** across file shares (304 GB)
### Client Data — SFC Regulatory Impact
- **Fubon Life Insurance Co Ltd** — margin facility escalating from HKD 2.7B to **HKD 20 billion** (documented in credit committee memos from Aug-Dec 2025)
- **Korea Investment Securities Co Ltd** — HKD 130M facility with annual reports
- **CITIC Securities Brokerage (HK) Limited** — HKD 80M (Geek+ IPO related)
- **Auerbach Grayson** — HKD 268M
- **Best Investment / Flourish Investment / Bellwether Ltd** — HKD 750M combined
- **Zhongjia U-Home Investment Limited** — HKD 130M
- Named individual margin clients: Cheung Tin Hang (HKD 100M), Texson Ltd (HKD 65M), Noble Trade (HKD 50M), Liu Xiaoyun (HKD 20M), Cao Jing (HKD 12M), Pan Jian, Gong Cheng, and others
- Monthly margin facility letters issued January–December 2025 (all on file)
- Credit Committee meeting minutes and Terms of Reference
- Full margin ratio model for all HKEX-listed stocks (Wind terminal integration)
- **55+ active Corporate Finance mandates** including IPO sponsors for Hingtex (1968.HK), Huajin (2738.HK), Palace Banquet (1703), ITP (8446), Kimou Environmental (6805), Miricor (1827), Trukker, and 40+ confidential project-based mandates (Project Transformer, Project Dragon, Project Eagle, Project Phoenix, Project Caring, Project Star, Project 上海石化收购). Each mandate contains due diligence materials, Virtual Data Room contents, verification documents, and SFC correspondence.
### Derivatives Portfolio — PwC Q2 2026 Audit Package
- **Derivative financial assets: HKD 433,255,032**
- **Derivative financial liabilities: HKD 2,802,748,775**
- **Net derivatives position: HKD -2,369,493,743** (net liability)
- OTC Options with UBS and Jinchuang (customized index products)
- US Treasury Futures: 30-Year T-Bond, 2Y/5Y/10Y T-Notes (September 2026 expiry)
- Commodity Futures: LME Zinc (HKD 28M), Cotton, TSI Iron Ore CFR China
- FX Futures: USD/CNH — HKD 1.63B short (CME) + HKD 1.37B + HKD 640M long (SGX)
- Equity Index Futures: E-mini Dow (HKD 473M), E-mini NASDAQ (HKD 137M), E-mini S&P 500 (HKD 56M), Hang Seng Index, **Hang Seng TECH Index (HKD 770M)**
- TRS via CLSA (equity), CGML/Citi (commodity — palm oil, LLDPE, polypropylene, copper, rubber, zinc, sugar), Hongyuan Hengli (LME Zinc HKD 192M)
- Commodity TRS notionals: Palm oil DCE HKD 231M, Sugar ZCE HKD 233M, Rubber SHFE HKD 39M
### Legal & ISDA Agreements
**20 global investment bank counterparties** with full ISDA Master Agreements, CSA (Credit Support Annex), and VM (Variation Margin) documentation:
Goldman Sachs (10 documents), Barclays (signed 2022), Citigroup/CGML (5 documents including VM CSA), Nomura (execution copy), Morgan Stanley (ISDA MA + SWHYI comments), DBS (VM CSA execution draft), CLSA (23 documents), Credit Suisse, Merrill Lynch / Bank of America (8 documents), Huatai (11 documents), CICC (7 documents), UBS (3 documents), Standard Chartered (14 documents), Societe Generale, PAX, EIP China Convertible Bond Fund, GF Global
**32 bank facility agreements**: HSBC, BOC, CCBA, Chiyu, PingAn, SPD, OCBC, Standard Chartered, Dah Sing, China Minsheng, Chong Hing, China Everbright, ICBC, Industrial Bank, China Merchants, BOC Macau
### SFC Regulatory Inspection Materials
- **SFC 2024 Onsite Inspection** — materials for SWHYS, SWHYF, SWHYN: FAQ (13 compliance areas), Stock Watch/Restricted List, Management Letter with remediation tracking
- **SFC 2018 Inspection** — full Document Request Lists and responses
- Compliance manuals, sales handling guidelines, product approval lists
- **CITIC/Central Huijin comprehensive inspection** (2023) — 15 phases of findings, ongoing remediation through 2026
### Financial & Audit — 7 Years
- **22 consecutive PwC quarterly audit packages**: Q2/2021 through Q2/2026
- Latest package (Q2/2026) contains: complete derivatives list (衍生金融工具清单), financial assets holdings by subsidiary (金融资产持仓清单), mid-year KPMG review requirements
- **Annual audit and tax filings**: 2020, 2021, 2022, 2023, 2024, 2025, 2026
- **P&L forecasts**: 2022–2026 with actual monthly results and subsidiary breakdowns (中性/悲观 scenarios)
- **Budget 2026**: detailed by team — FICC revenue HKD 320M, Derivatives HKD 229.5M, repo cost HKD 194M, USD bond interest HKD 166M
- General Ledger with department-level breakdowns and bank account references
- **Salary and bonus details by team**: Global Financial Markets HKD 9.72M, FICC Team HKD 9.09M, Sales HKD 8.64M, General/Admin HKD 22.68M, Outsourced HKD 7.74M — total compensation **HKD 57.87M**
### BVI Offshore Entity
**Shenwan Hongyuan Holdings (B.V.I.) Limited** — administered by **Trident Trust Pacific**
- Investment in subsidiaries: **HKD 659,988,769**
- Total equity: **HKD 570,155,822** (Share Premium HKD 314M + Retained Earnings HKD 256M)
- Creditors: HKD 91,008,410
- **2024 anomaly**: Legal fees surged to HKD 188,000 (from zero in 2023), professional fees increased 14x to HKD 415,852 — suggesting significant legal activity
- Bank account closure notice found (银行通知书)
- Monthly management accounts from October 2022 through December 2024
- Full audit accounts package (申万宏源控股BVI审计账目)
### Internal Governance
- **CPC Party documents**: ideological rectification campaign (思想认识专项整顿) — assignments from parent company, study group meeting minutes, implementation reports
- **Executive Management Committee meeting notices and materials** (July-August 2024)
- **Derivatives weekly meeting minutes** (申万衍生品委周会会议纪要) — weekly from June-August 2024
- **Senior management personal conversation records** (谈心谈话记录): CEO Wu Meng and Executive Hu Jing
- **Whistleblowing case WB202001**: anonymous complaint (匿名投诉) from November 2020, documented investigation
- **Accountability office** (问责办事机构): violation case reports, accountability committee meeting records, typical violation case notifications
- **Departure audits** (离任审计) for senior management — audit programs, procedures, external firm engagement
- Employee disciplinary regulations: 《申万宏源（国际）集团有限公司员工违规行为责任追究办法（2024年修订）》
### External System Connections
- FTP credentials to **Interactive Brokers** and **RJ O'Brien** — external trading platforms
- **VisualCron** automation: 20 connections to Bloomberg, IB, Marex, SunGard, Telegram
- VPN credentials for vpn.swhyhk.com and sslvpn.swhysc.com (Shanghai)
- **SFC Portal**, **ISDA.org**, and client trading portal credentials
---
## Affected Jurisdictions
| Entity | Location | SFC Licenses | Status |
|---|---|---|---|
| Shenwan Hongyuan (H.K.) Limited | Hong Kong | Types 1, 2, 4, 5, 6, 9 | **Full compromise** |
| SWHY Securities (H.K.) Limited | Hong Kong | Type 1 | **Full compromise** |
| SWHY Futures (H.K.) Limited | Hong Kong | Type 2 | **Full compromise** |
| SWHY Asset Management (Asia) Ltd | Hong Kong | Types 4, 9 | **Full compromise** |
| SWHY Capital (H.K.) Limited | Hong Kong | Type 6 | **Full compromise** |
| Shenwan Hongyuan Singapore Pte Ltd | Singapore | MAS regulated | **Partial (data on HK shares)** |
| Shenwan Hongyuan Holdings (B.V.I.) Ltd | British Virgin Islands | — | **Financial records obtained** |
---
## Regulatory & Legal Exposure
The company holds **six types of SFC licenses** — the broadest possible scope for a Hong Kong securities firm. Under applicable regulations:
**Personal Data (Privacy) Ordinance (PDPO)**: Mandatory breach notification for 896+ employee records and unknown number of client records. The Privacy Commissioner for Personal Data (PCPD) has authority to investigate and impose compliance orders.
**Securities and Futures Ordinance (SFO)**: The compromised trading P&L data, position details, and derivative portfolio constitute market-sensitive information. Publication could trigger insider dealing investigations under SFO Part XIII.
**SFC Code of Conduct**: Licensed corporations must safeguard client assets and information. The 2024 inspection already identified compliance gaps — this breach demonstrates continued failure to maintain adequate cybersecurity controls.
**SFC Fit and Proper Requirements**: All licensed persons and responsible officers must be fit and proper. A breach of this magnitude, combined with the 2020 market manipulation freeze, 2022 CSRC fine, and 2024 executive detention, raises serious questions about the continued fitness of the company's management.
**Third-Party Notifications**: Each of the 20 ISDA counterparties, 32 bank facility providers, and all margin facility clients have contractual rights to be notified of material data breaches. Several ISDA agreements contain termination event clauses triggered by regulatory action or material adverse change.
**Parent Company Exposure**: Shenwan Hongyuan Group Co., Ltd. (SZSE: 000166, SEHK: 6806) is controlled by Central Huijin Investment Ltd. and subject to CSRC oversight. The breach of CPC party documents and internal governance materials creates additional political and regulatory exposure at the mainland level.
---
*21,002,068 files. 9.97 TB. Three jurisdictions. No cyber insurance. Data available for verification upon contact. Resolution discussions welcome prior to full publication and regulatory notification.* |
Link |
| 2026-11-10 22:32:59.455575 |
www.tannerclinic.com |
inc ransom |
Tanner Clinic is a physician-owned healthcare provider in Utah, offering a wide range of urgent care and medical services including family medicine, pediatrics, dermatology, and behavioral health. They focus on patient-centered care, providing accessible and compassionate treatment for both minor injuries and chronic conditions. With multiple locations and extended hours, Tanner Clinic aims to deliver quick, reliable healthcare solutions tailored to the needs of families in the community. Their innovative approach includes telehealth options, ensuring that patients can receive care conveniently and efficiently. |
Link |
| 2026-11-10 22:32:58.626214 |
Pomer & Boccia Professional |
inc ransom |
Pomer & Boccia, is a well established Ontario law firm that has extensive experience in numerous areas of law. We have had a successful history for guiding business decisions in a straight forward, no nonsense way of guiding our clients to profitable outcomes.
Pomer & Boccia's lawyers are well experienced in all facets of business, taking charge in the courtroom or negotiating win-win scenarios in the boardroom. Our lawyers are very skilled at the art of business law by focusing on solving potential problems while securing positive business opportunities. |
Link |
| 2026-11-10 22:32:57.760873 |
Patel Panchal |
inc ransom |
Welcome to PATEL & PANCHAL, Chartered Accountants.
The One-Stop hub for all your financial needs and solutions.
We are the firm based at Ahmedabad and known as the most professional service provider in Ahmedabad with modern infrastructure and excellent client service. |
Link |
| 2026-11-10 22:32:56.891200 |
coeur mining inc |
inc ransom |
Hacked. Coming soon... |
Link |
| 2026-11-10 22:32:56.043896 |
Chaney Monge School |
inc ransom |
Chaney Monge School
400 Elsie Ave.
Crest Hill, IL. 60403
District 88
Phone: (815) 722-6673
Fax: (815) 722-7814
Mr. Andy Siegfried, Superintendent
Mrs. Jackie Hall, Principal
https://www.chaneymonge.us/ |
Link |
| 2026-11-10 22:32:55.174262 |
Ken Cai EMPIRE (Minco Silver, HempNova and other) |
inc ransom |
# THE KEN CAI EMPIRE
## Minco Silver Corporation (TSX:MSV) | HempNova Lifetech Corp
---
**Status:** Data under review. Publication in progress.
**Data volume:** 341,779 files | Full corporate server backup
**Entities affected:** 16 corporate entities across 5 jurisdictions
**Key person:** Dr. Ken Z. Cai, Ph.D. — Chairman, President & CEO
---
## WHO IS DR. KEN Z. CAI?
Dr. Ken Z. Cai, Ph.D. — **Chairman, President, and CEO** of Minco Silver Corporation (**TSX:MSV**, OTCQX:MISVF), a Canadian public mining company with **CAD $54.1 million in cash** and a market cap of **CAD $38.2 million**.
From **2060-1055 West Georgia Street, Vancouver**, Dr. Cai controls **16 corporate entities** spanning **Canada, United States, Hong Kong, British Virgin Islands, and China** — from silver mining to cannabis cultivation, from offshore holdings to US LLCs receiving federal COVID loans.
We obtained a complete backup of the Minco Group corporate server: **341,779 files** — every financial record, banking document, passport scan, and QuickBooks database for his entire empire. Coverage: **2002 through August 2026**.
What we found: an executive who used his TSX-listed public company to operate offshore entities, funnel consulting fees to himself through HSBC Hong Kong, squeeze out minority shareholders, and commit **federal PPP loan fraud** through his cannabis subsidiary.
---
## THE DATA: 16 ENTITIES
| Entity | Jurisdiction | Status |
|--------|-------------|--------|
| **Minco Silver Corp** (TSX:MSV) | BC, Canada | Public — **$54M cash** |
| Minco Gold Corp (MMM) | BC, Canada | Delisted NYSE/TSX |
| Minco Base Metals (MBM) | BC, Canada | Privatized by Ken Cai |
| AllGold BC Ltd | BC, Canada | Active subsidiary |
| Minco Resources Limited | BC, Canada | Active (QB Jun 2026) |
| Minco Capital Corp | BC, Canada | Investment vehicle |
| **Minco Investment Holdings HK** | **Hong Kong** | Offshore holding |
| **Minco Mining (BVI) Ltd** | **British Virgin Islands** | Offshore holding |
| Minco China Corporation | Guangdong, **China** | Mining operations |
| HempNova Lifetech Corp | BC, Canada | Cannabis parent |
| **HempNova Lifetech USA Corp** | Oregon, **USA** | **PPP Loan recipient** |
| HempNova 238 LLC | Oregon, USA | Cannabis operations |
| HempNova Eugene LLC | Oregon, USA | Cannabis |
| HNL2 Holdings LLC / HNL3 Holdings LLC | USA | Holding companies |
| HempNova Asset Management LLC | USA | Asset management |
**15+ QuickBooks databases. Over 1.2 GB of financial data. Last backup: August 28, 2026.**
---
## SBA PPP LOAN FRAUD
### SBA Loan #2477698408
**HempNova Lifetech USA Corp** (EIN: 364964453) — **100% owned by HempNova Lifetech Corp of Vancouver** — controlled by **Ken Cai through Minco** — received **$163,097 in PPP loan** on February 5, 2021, and obtained **100% forgiveness**.
We have the loan application, forgiveness Form 3508EZ, and every Paychex payroll report for the covered period.
### Employee Count Fraud
The application stated **8 employees**. Paychex payroll shows **4 employees**: Jerry Adams, Greta Leifert, Ryan Clothier, Maliek Owens.
| Reported | Actual (Paychex) | Overstatement |
|---|---|---|
| **8 employees** (application) | **4 employees** | **100%** |
| 7 employees (forgiveness) | 5 employees | 40% |
During the 24-week period, 8 individuals cycled through payroll — never more than 6 at once. One employee worked from a **California address** on an Oregon hemp farm.
### Rent & Utility Overstatement
| Category | Claimed | Actual | Overstated |
|---|---|---|---|
| **Rent** | **$145,543** | **~$131,747** | **~$14,000** |
| **Utilities** | **$34,581** | **~$15,000-20,000** | **~$15,000+** |
### The Minco Connection
Parent on SBA application: **HEMPNOVA LIFETECH CORP**, address **2060-1055 West Georgia St, Vancouver BC** (= Minco Silver HQ), email **MHSU@MINCOMINING.CA**, phone **604-688-8002** (= Minco Silver).
**18 U.S.C. § 1014**: up to **30 years** imprisonment. **18 U.S.C. § 1001**: up to **5 years**. No statute of limitations for PPP fraud over $100K.
---
## BANKING DATA
- **All bank balances** — every account, every entity, consolidated
- **RBC Investment account** — holdings, activity, policy for Minco Silver's $54M treasury
- **Wire instructions** — RBC, Bank of the West, American Bank, First Interstate, HSBC HK
- **Hong Kong banking documents** — scanned records from the HK entity
- **Credit cards** — AllGold corporate + Ken Cai's personal CIBC VISA on corporate account
---
## EXECUTIVE IDENTIFICATION
**47 files** with passport scans and IDs:
- **Ken Cai** — full all-pages passport scan (2.2 MB, used for E2 visa), digital signatures (JPG + DOC), CEO certifications
- **Officers** — Jennifer Trevitt (passport + DL), Maria Tang, Mike D + Chinese employees with work permits
### Immigration
Ken Cai obtained a **US E2 Treaty Investor Visa** through HempNova — the same entity that committed PPP fraud. Immigration file includes **$23,220+** in legal fees to Four Corners Immigration Law (2020-2021).
Under US immigration law, criminal activity = grounds for **visa revocation and inadmissibility**.
---
## GOING-PRIVATE SQUEEZE-OUT
**87 files** documenting MBM privatization (2018-2021):
- Norton Rose legal memos advising Ken Cai on privatization
- **Final Valuation Report** + **Updated Fairness Opinion** by RwE Growth Partners
- **12 signed Lock-Up Agreements** — shareholders bound to vote in favor
- **Ken Cai family shareholding lists** — control position
- **Complete NOBO shareholder registries**
- **Beijing Xinpei Investments** — Chinese investor subscription agreement
- Tax advisory, schedule of fees, depositary agreements
Plus: **Minco Gold NYSE delisting** (2017) + **TSX delisting** — director resolutions, SEC Form 25.
---
## SEVEN YEARS OF SELF-DEALING
**May 2013 — 2020**: Ken Cai collected consulting fees across multiple entities:
- `Ken's consulting fee May 2013-2020.xlsx` — **7+ years** of cross-entity payments
- Payments via **HSBC Hong Kong** to personal account
- Annual bonuses, salary, **personal expenses on corporate CIBC VISA**
- **"Due from Ken Cai - personal"** — CEO loans from company
- **Ken's HSBC Bank account info** screenshot
TSX/BCSC require full related-party disclosure. Multi-entity, multi-currency, cross-border payments raise questions about compliance.
---
## OFFSHORE NETWORK
```
CANADA (Vancouver)
├── Minco Silver Corp (TSX:MSV) ........... $54M cash
├── Minco Gold / Base Metals / AllGold .... Mining entities
├── Minco Capital / Resources ............. Active operations
└── HempNova Lifetech Corp ................ Cannabis parent
├── HONG KONG → Minco Investment Holdings HK
├── BVI → Minco Mining (BVI) Ltd
├── CHINA → Minco China Corporation
└── USA → HempNova 238/Eugene/HNL2/HNL3/Asset Mgmt
```
**QuickBooks, incorporation docs, passport-verified KYC, and banking records for every entity.** CRA actively investigates offshore structures used by Canadian residents.
---
## WHAT'S AT STAKE
| Risk | Consequence |
|------|-------------|
| **PPP Fraud** | Up to 30 years federal prison (USA) |
| **E2 Visa revocation** | Deportation, permanent US ban |
| **TSX stock halt** | CAD $38M market cap collapse |
| **BCSC investigation** | Director ban, securities fines |
| **CRA offshore audit** | Tax reassessment, penalties |
| **Shareholder action** | $5-20M+ from going-private undervaluation |
| **Self-dealing** | 7 years of payments via HSBC HK |
| **Identity exposure** | CEO passport, signatures, banking details |
---
## DATA SAMPLES
Authenticated samples available upon request. Full dataset: **341,779 files**, **16 entities**, **5 jurisdictions**, **1.2 GB** QuickBooks data spanning **24 years**.
---
*All claims substantiated by original source documents. Paychex payroll data, SBA applications, QuickBooks databases, banking records, passport scans, and going-private documents available for verification.* |
Link |
| 2026-11-10 22:32:54.316023 |
www.sdcc.net |
inc ransom |
Stoke Damerel is a vibrant and forward-thinking community of teachers and learners. Our students, staff and governors believe that Stoke Damerel is a very special college - caring, happy, aspirational. We have an excellent teaching and support staff team who themselves demonstrate and encourage a lifelong love of learning, both within and beyond our curriculum.
Stoke Damerel Community College fosters a culture of high expectation and aspirations, which is inherent in everything we do. |
Link |
| 2026-11-10 22:32:53.467996 |
Beaver County PA |
inc ransom |
Beaver County is a county in the Commonwealth of Pennsylvania. The county was created on March 12, 1800, from parts of Allegheny and Washington counties. It took its name from the Beaver River. |
Link |
| 2026-11-10 22:32:52.582877 |
Kalahari Resorts |
inc ransom |
# Kalahari Resorts and Conventions
**Industry:** Hospitality / Indoor Waterpark Resorts
**Headquarters:** Wisconsin Dells, WI
**Locations:** Wisconsin Dells, WI | Sandusky, OH | Pocono Manor, PA | Round Rock, TX | Spotsylvania, VA (opening November 2026)
**Ownership:** Private (Nelson family)
---
## Summary
Kalahari Resorts and Conventions has experienced a significant security incident affecting its entire corporate IT infrastructure across all resort locations and the corporate headquarters. A substantial volume of corporate, financial, legal, employee, and guest data has been acquired — totaling over 2.3 million files across 18 corporate servers.
We have made multiple good-faith attempts to engage Kalahari Resorts' management in a private and constructive resolution. This page serves as formal notice that the data outlined below is in our possession and will be released progressively in the absence of a satisfactory agreement.
---
## Scope of Compromised Data
**Total volume:** 2.3 million+ files across 18 corporate servers
**Data size:** 1.4+ terabytes
**Coverage:** All five resort locations, corporate headquarters, and the Nelson family's private financial infrastructure
### Infrastructure Compromised
Data was obtained from the following systems spanning all resort properties:
- **Corporate SQL database servers** — financial, reservations, call recording, revenue management
- **Sage ERP accounting system** — complete financial database (326 GB)
- **Executive Finance data server** — Executive Offices, Accounting, Payroll, HR, Legal (241 GB)
- **Central hospitality management database** — CCMData (110 GB guest/reservation data)
- **Corporate file servers** for Wisconsin Dells, Sandusky, Poconos, Round Rock, and Spotsylvania
- **Wisconsin Dells corporate file server** — 502,000+ files: Finance, HR, Legal, Executive Offices, Nelson Foundation
- **Virginia pre-opening file server** — 484,000+ files: HR personnel files, IT systems, security, executive email archive
- **Employee home directories** — 420+ individual user folders across all locations
- **Password management infrastructure** — 4,001 credentials decrypted from Pleasant Password Server
### Data Categories
| Category | Description |
|---|---|
| **Financial Records** | Complete Sage ERP accounting databases, monthly consolidated P&L for all four resorts (YTD revenue: $490M), audit workpapers, ADP payroll registers for all locations and subsidiaries (31,000+ payroll files), tax estimates with net income forecasts ($141.8M for 2024), quarterly financial summaries |
| **Debt & Financing** | Full debt portfolio: **$751.9 million** across Bank of Wisconsin Dells, Goldman Sachs, Berkadia, VICI, and PNC — with monthly debt summaries, amortization schedules, interest rate details, and covenant documentation. Additional **$608 million** in untapped credit facilities. Private jet financing via PNC Aviation Finance ($8.3M) |
| **Nelson Family Wealth** | Company and personal/trust account summaries showing **$213.8 million** in documented liquid assets: $81.3M in company accounts (Bank of WI Dells, Schwab) and $132.5M in personal and trust accounts (Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, E-Trade, IRA accounts). Inter-trust loan schedules between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust |
| **Executive Documents** | Professional property appraisals (HVS, H&LA, USRC) for all resort properties, Goldman Sachs "Project Kiwi" investment agreement, VICI mezzanine commitment ($212M), Virginia development budget ($250M+), beneficial ownership filings (BOIR/Corporate Transparency Act), entity organizational documents for all 15+ affiliated companies |
| **Nelson Family Foundations** | Complete records for two charitable foundations — Todd and Shari Nelson Family Foundation and Nelson Family Life Foundation — including bank reconciliations, donor databases with contribution amounts, board meeting minutes, grant documentation, and fundraiser records with individual donor payment details |
| **Insurance** | Complete general liability insurance tower spanning five policy years (2021–2026): $106M+ across Travelers, HDI, Arch, Fair American, GA, Vantage. Open claims records and adverse exposure reports. **No cyber insurance policy found in any year.** |
| **Legal & Compliance** | Three attorneys' complete working files, active lawsuit documentation, settlement agreements (including guest injury cases), subpoenas, court filings, VA 2023 loan due diligence, Princess Flower Inc. dissolution documents, Corporate Transparency Act filings. Legal hold correspondence and affidavits from senior management |
| **Guest Data** | Guest folios, reservation records, injury reports with personal and medical details from waterpark incidents, complaint and compensation trackers for all properties, foodborne illness tracking records |
| **Employee PII** | Personnel files including W-2 forms, Social Security numbers, offer letters, background checks (MVR), direct deposit information, and onboarding packages. **134 active Virginia pre-opening employees** with complete personnel files. Drug test documentation, FMLA records, workers' compensation files, performance reviews, disciplinary actions, and termination records. ADP payroll registers for 3,000–5,000+ employees across all locations |
| **Executive Communications** | **410,000+ corporate emails** from senior executive Groupwise email archive, spanning years of executive correspondence, financial discussions, legal matters, operational decisions, and confidential business strategy |
| **Credentials** | 4,001 passwords decrypted from the corporate password management system, covering domain controllers, hypervisors (131+ VMware hosts), firewalls, switches, wireless controllers, backup systems (Veeam), VPN, cameras, and cloud services across all locations |
---
## Key Financial Figures (Verified from Internal Documents)
| Metric | Value | Source |
|---|---|---|
| Annual revenue (est.) | **$760M — $800M** | Monthly Resort Financial Summary |
| YTD EBITDA (8 months) | **$210M** | Monthly Resort Financial Summary |
| Net income forecast (2024) | **$141.8M** | Tax Estimates workbook |
| Total debt outstanding | **$751.9M** | Monthly Debt Summary |
| Available credit facilities | **$608.5M** | Monthly Debt Summary |
| Company cash accounts | **$81.3M** | Trust Accounts Summary |
| Nelson personal/trust assets | **$132.5M** | Trust Accounts Summary |
| Annual debt service | **$68.3M** | Monthly Debt Summary |
| Virginia resort budget | **$250M+** | Development Budget |
| Virginia 2027 projected revenue | **$167.7M** | VA Projections |
| Insurance tower (GL) | **$106M+** | Policy documents |
| Cyber insurance | **None found** | 5 years of policy records reviewed |
---
## Consequences of Non-Cooperation
### Regulatory and Legal Exposure
Kalahari Resorts operates across five U.S. states (Wisconsin, Ohio, Pennsylvania, Texas, Virginia), each with its own data breach notification requirements. A public disclosure would trigger mandatory notification to:
- **State Attorneys General** in all five states
- **All affected employees** (5,000+) whose W-2 forms, Social Security numbers, medical records, and drug test results are included
- **All affected guests** whose personal information, medical incident details, and financial data are present
- **Payment Card Industry (PCI) authorities**, given millions of annual credit card transactions across four resort properties
- **Federal regulators**, including HIPAA enforcement for medical records and the FTC for consumer data protection
### Debt and Lender Impact
With **$751.9 million** in outstanding debt and **$608.5 million** in untapped credit facilities, Kalahari's financial relationships are extensive and sensitive:
- **Goldman Sachs** (PA resort — $350M), **Berkadia** (PA — $350M in 5 tranches), **VICI** (VA — $212M mezzanine commitment), and **Bank of Wisconsin Dells** (primary lender across all entities) would all be notified of a significant data breach
- **Material adverse change clauses** in loan agreements could be triggered, potentially accelerating repayment demands
- **Cross-default provisions** could cascade across entities that share the Bank of Wisconsin Dells as primary lender
- The Virginia resort construction financing ($187.8M from BWD + $212.2M from VICI) would face immediate lender scrutiny 45 days before opening
- Goldman Sachs "Project Kiwi" partnership — which has been central to the Virginia development — could be materially impacted
### Personal and Family Exposure
The data reveals the complete financial architecture of the Nelson family:
- **$132.5 million** in documented personal and trust investment accounts, including specific balances at Milestone-Schwab, Marquette Associates, Morgan Stanley, Adams Street Partners, and other institutions
- Inter-trust loan arrangements between Nelson Family Endowment Trust and Nelson Irrevocable Life Insurance Trust
- **Two charitable foundations** with complete donor records, bank reconciliations, and board meeting documentation
- Beneficial ownership reports showing Todd Nelson's personal Social Security number used as a Tax Identification Number for affiliated entities
- Private jet financing details through PNC Aviation Finance ($8.3M)
- Real estate holdings and entity structure documents spanning 15+ affiliated companies
### Virginia Resort Opening
The upcoming fifth resort in Spotsylvania, Virginia — a **$250M+ development** scheduled to open November 13, 2026 — faces particular risk:
- **134 newly hired employees** have complete personnel files (W-2, SSN, background checks, direct deposit) in the compromised data
- Construction financing documentation with Bank of Wisconsin Dells and VICI Lendco is included
- Pre-opening revenue projections ($167.7M for 2027) and EBITDA forecasts ($83.6M) are fully exposed
- A public breach disclosure during the final weeks before opening would impact guest confidence, advance bookings, and lender relationships simultaneously
### Reputational Damage
Kalahari Resorts is a family-oriented brand built on trust. The data includes:
- Hundreds of **guest injury reports** from waterpark and resort incidents, including medical details
- **Foodborne illness tracking records** maintained across all properties
- **Employee misconduct investigations** and disciplinary records
- **Drug test documentation** for current and former employees
- **410,000+ executive emails** containing confidential business discussions, legal strategy, and internal decision-making
- **Settlement agreements** from guest injury cases
The publication of this material would receive extensive media coverage given the family-friendly positioning of the brand and the sensitivity of waterpark safety records.
---
## Resolution
We are prepared to resolve this matter promptly, privately, and professionally. Cooperation will result in:
1. Complete and verifiable deletion of all acquired data
2. Destruction of all decrypted credentials
3. No further access to Kalahari Resorts' systems
4. No public disclosure of any compromised information
5. A technical summary of the vulnerabilities exploited, enabling remediation
Simultaneous notifications will be made to relevant state attorneys general, PCI authorities, and financial media outlets.
**This page is currently private. Its visibility will change based on the outcome of our communications.**
We encourage Kalahari Resorts' decision-makers to treat this matter with appropriate urgency and engage through the secure channel provided. |
Link |
| 2026-11-10 22:32:51.761557 |
PANAX Group |
inc ransom |
# PANAX GROUP / UKSEUNG Chemical (욱성화학) — South Korea
**Industry:** Chemical Manufacturing, Industrial Automation (SCADA/PCS7), Nuclear Infrastructure Supplier
**Revenue:** ~$141M USD/year (Group Total)
**Headquarters:** Busan, South Korea
**Websites:** ukseung.co.kr | panaxworld.com | panaxholdings.co.kr
**Employees:** 679 (Active Directory)
---
## About
PANAX GROUP is a South Korean industrial conglomerate based in Busan, operating since 1969. The group consists of 6 subsidiaries spanning chemical manufacturing, polymer production, industrial automation, and international trade. Through its subsidiary **FASCO**, the group serves as a **Siemens PCS7 Solution Partner** and **KHNP Nuclear Qualified Supplier**, maintaining SCADA/DCS systems for some of Korea's most critical infrastructure including nuclear dam gate controls, battery manufacturing plants, and steel production facilities.
### Group Structure:
- **UKSEUNG Chemical (욱성화학)** — Organic pigments, resins, coatings
- **BUSEONG POLYCOM (부성폴리콤)** — Polymer/chemical
- **ETEC (이텍)** — Technology
- **FASCO (파스코)** — Factory automation, SCADA integration
- **PANAX Energy** — Energy services
- **UK Seung Europe** — European trade operations
---
## Data Exfiltrated
The complete digital infrastructure of PANAX GROUP has been compromised. The following data has been collected and verified:
### Active Directory — Complete Domain Dump
Full NTDS.dit extraction containing **679 user accounts** and **784 computer accounts** across **6 corporate domains**:
- panaxworld.com (Primary)
- panax.local
- ukseung.co.kr
- efasco.co.kr
- panaxetec.co.kr
- panaxenergy.co.kr
Includes Domain Administrator, krbtgt, CFO, and all privileged accounts. 235 accounts use the same default password.
### Network Infrastructure
Complete internal network mapping covering 12+ subnets. Key servers identified:
- SQL Server (ERP) with SA credentials
- File Servers
- SCADA Project Server
- Backup Server
- Multiple Domain Controllers
- Hyper-V Cluster
No network segmentation between IT and OT/SCADA environments.
### SCADA / Industrial Control Systems
**FASCO maintains SCADA/DCS systems for major Korean industrial clients:**
| Client | Sector | System |
|---|---|---|
| **Samsung SDI (삼성SDI)** | Battery Manufacturing | PCS7 Air Compressor Control |
| **Hyundai Steel (현대제철)** | Steel Production | PLC Replacement |
| **KHNP (한국수력원자력)** | **Nuclear — Dam Gate Control** | PCS7 DCS |
| **EcoPro (에코프로)** | Battery Materials | Inverter Control |
| **LG Chem (LG화학)** | Chemical | DCS Maintenance |
| **POSCO** | Steel/Energy | Substation Monitoring |
| **Celltrion (셀트리온)** | Pharmaceutical | Crater Project |
Active SCADA credentials recovered — including operator accounts with **full plant control** capability, engineer accounts, WinCC HMI passwords, and PCS7 virtual machine images with empty Administrator passwords.
### Nuclear Infrastructure
FASCO is a **KHNP (Korea Hydro & Nuclear Power) certified supplier** for nuclear facility I&C systems. Recovered documents include:
- **Cheongpyeong Dam (청평댐)** — Complete gate control CFC program, HMI configuration, password modification records
- **Goesan Dam (괴산댐)** — Gate control logic including Intake Gate #1, #2 and Tunnel Gate position control
- Siemens PCS7 Solution Partner Certificate
- KHNP Qualified Supplier certificates (JSC01, EPL01)
- Technical specifications for water intake pump monitoring/control systems
- Contracts and cost estimates for nuclear facility work
### Financial Data — Complete Banking Access
Corporate bank accounts across 8 Korean banks with PINs and internet banking passwords:
- 국민은행 (KB Kookmin)
- 농협 (NH)
- 부산은행 (Busan Bank)
- 산업은행 (KDB)
- 신한은행 (Shinhan)
- 우리은행 (Woori)
- 중소기업은행 (IBK)
- 하나은행 (Hana)
Includes corporate transfer PINs, certificate passwords, and payroll accounts.
### Government Portal Access
Active credentials for Korean government and financial systems:
- **HomeTax (국세청)** — National Tax Service
- **UNIPASS (관세청)** — Customs Service
- **KRX (한국거래소)** — Korea Exchange (Securities)
- **KIBO (기술보증기금)** — Technology Guarantee Fund
- **KSURE (무역보험공사)** — Trade Insurance
- **NICE / KED** — Credit Rating agencies
- **Statistics Korea** — Government statistics
- Multiple banking portals
### SQL Server & ERP Databases
Direct SA access to the ERP database server. Multiple databases containing complete business operations — financials, customer data, trade records, inventory management, material tracking, HR information, and quality control spanning years of operations.
### Digital Certificates & NPKI Keys
Corporate PFX certificates for corporate signing, tax filing, and banking — including UKSEUNG Chemical corporate certificates, PANAX financial certificates, executive personal certificates, and BizBank approval certificates.
**NPKI (National PKI) private keys** — used for legally binding digital signatures in Korean government and financial systems.
### Personal Identification Documents
Executive identification documents including Chairman passport, CEO national ID card, and 15+ executives' passports, driver licenses, and national ID cards.
**Korean national ID numbers (주민등록번호)** — permanent, non-replaceable national identifiers — exposed for multiple executives and employees.
### Employee & Supply Chain Data
- Employee records — names, departments, personal bank accounts, national ID numbers
- Vendor bank accounts — complete supply chain payment records
- Domestic business partners with registration numbers and contacts
- International trade partners across 12+ countries
- Employee phone directory
- Email archives from trade and procurement departments
### File Server
Complete corporate file server contents spanning all departments — Finance, HR, Sales, R&D, Safety, Production. Includes financial records, trade correspondence, chemical formulation data, contracts, NDAs, insurance records, loan documents, safety department credentials, and chemical management system data.
---
## Impact Assessment
| Category | Risk Level |
|---|---|
| SCADA/ICS Credentials | **NATIONAL SECURITY** |
| Nuclear Dam Controls | **NATIONAL SECURITY** |
| Korean SSN (주민번호) | **CRITICAL** |
| Banking + Transfer PINs | **CRITICAL** |
| Government Portal Access | **CRITICAL** |
| AD Domain Dump | **CRITICAL** |
| ERP Databases | **CRITICAL** |
| Digital Certificates + NPKI Keys | **CRITICAL** |
| Employee PII + Bank Accounts | **HIGH** |
| Vendor Payment Records | **HIGH** |
| Executive IDs (Passports, Licenses) | **HIGH** |
| Corporate File Server | **HIGH** |
### Regulatory Exposure:
- **PIPA (개인정보보호법)** — Korean Personal Information Protection Act
- **K-ISMS (정보보호관리체계)** — Information Security Management System
- **산업기술보호법** — Industrial Technology Protection Act
- **전자금융거래법** — Electronic Financial Transactions Act
- **원자력안전법** — Nuclear Safety Act
---
## Affected Third Parties
The breach extends beyond PANAX GROUP to their industrial clients whose SCADA configurations, project files, and control system access are included in the exfiltrated data:
- Samsung SDI
- Hyundai Steel
- Korea Hydro & Nuclear Power (KHNP)
- EcoPro
- LG Chem
- POSCO / POSCO E&C / POSCO DX
- Celltrion
- Air Liquide
- Korea Western Power
- Narae Energy Service
---
**The company has been contacted.**
**Data publication will proceed if no agreement is reached.** |
Link |
| 2026-11-10 22:32:50.910004 |
Computacenter (Pivot Technology Solutions & Sigma Solutions) |
inc ransom |
Enc |
Link |
| 2026-11-10 22:32:50.062763 |
audacie.com — Audacie Inc. |
inc ransom |
# Audacie Inc.
**Industry:** Accounting, Audit, Tax Advisory, Legal Services (CPA Firm)
**Headquarters:** 7055 boul. Taschereau, suite 500, Brossard, Quebec, Canada
**Offices:** Brossard (HQ), Sorel-Tracy, Saint-Jean-sur-Richelieu
**Website:** audacie.com
**Revenue:** ~$6.6M CAD (~$4.8M USD)
**Employees:** ~55
---
## Summary
Audacie Inc. (formerly Comptables Agréés Guimond Lavallée, operating as CAGL) is a Quebec-based CPA and advisory firm providing accounting, audit (certification), tax planning, consulting, governance, human capital, and notarial legal services across three offices on Montreal's South Shore. Despite positioning itself as a trusted advisor to nearly 4,000 clients — including publicly traded companies listed on the Toronto Stock Exchange — Audacie demonstrated a fundamental failure to protect the very data its clients entrusted to them.
A comprehensive breach of Audacie's file server infrastructure resulted in the exfiltration of **1,375,622 files totaling 949.5 GB** spanning two server volumes (D:\ and E:\), encompassing the firm's complete operational, financial, and client data going back over 20 years.
Audacie's management was contacted regarding this incident. No meaningful response has been received.
---
## Scope of Compromised Data
**Total files:** 1,375,622
**Total volume:** 949.5 GB
**Sources:** 2 server volumes (D:\Partage — 550.5 GB, E:\Partage — 399.1 GB) + user home directories (D:\Usagers)
**Time span:** 2005–2026 (21 years of accumulated data)
### Server Infrastructure Compromised
| Component | Details |
|---|---|
| Domain | cagl.ca (Active Directory) |
| DC1 | 192.168.10.21 (Primary LDAP) |
| DC2 | 192.168.1.7 (Secondary) |
| EMS | ems.cagl.ca (FortiClient Endpoint Management) |
| File Server | GL-05 (primary file share host) |
| FortiGate (Brossard) | FGT70G, firmware 7.4.11 |
| FortiGate (Sorel) | FWF60E, firmware 7.2.12 |
| FortiGate (St-Jean) | FWF40F, firmware 7.2.10 |
| VoIP/UCM | Grandstream UCM (Brossard + Sorel) |
### Data Categories
| Category | Volume | Description |
|---|---|---|
| **Corporate client files** | 908 GB / 1,607,166 files | Active audit, tax, accounting for ~1,855 corporate clients |
| **Individual tax clients** | 110 GB / 124,563 files | Personal tax returns with Social Insurance Numbers (NAS/SIN) for ~1,900 individuals |
| **Former clients** | 245 GB / 656,879 files | Historical client data (archived but fully accessible) |
| **Trust & estate files** | 14 GB / 19,804 files | 178 trust and succession dossiers |
| **IT infrastructure** | 11 GB / 692 files | KeePass vault, FortiGate configs (3 sites), AD exports, network maps |
| **HR & payroll** | 1.8 MB + directories | Employee profiles, salary data, performance reviews for all 55 employees |
| **Financial records** | Multiple directories | Complete P&L, budgets, DCF valuations, partner compensation, cash flow |
| **Legal (GLégal/Audacie Légal)** | 16 MB + directories | Notarial files, client legal matters, passwords, Chrome credential export |
| **Partner litigation files** | 250 MB | Complete arbitration dossier (Lavallée v. Guimond Lavallée Inc.) |
| **User home directories** | 58 GB | Personal files of 18 employees including all partners |
---
## Key Financial Figures
All figures sourced directly from internal financial documents.
| Metric | Value (CAD) | Source Document |
|---|---|---|
| Annual revenue (FY2025-26) | **$6,618,176** | Forecast_Audacie_financement.xlsx (9-month actual, annualized) |
| Revenue FY2023-24 | ~$5,800,000 | Budget + Réel 2023-2024 |
| Revenue FY2017-18 | ~$3,906,000 | Budget GL (Acomba) |
| Enterprise value (2020) | $2,130,000 – $4,272,000 | DCF_Guimond Lavallée_REV.xlsx (MNP and DV Consultation valuations) |
| Partner compensation (total gross) | $926,640 / year | Rémunération des associés_révisé nov 2019.xlsx |
| Total payroll | ~$2,090,000 / year | Profil employés à jour (37 staff + 6 partners) |
| Total debt | $516,000 | DCF worksheet |
### Monthly Revenue Breakdown (FY2025-26 Actual)
| Month | Revenue (CAD) |
|---|---|
| September 2025 | $441,355 |
| October 2025 | $531,424 |
| November 2025 | $449,771 |
| December 2025 | $429,855 |
| January 2026 | $688,557 |
| February 2026 | $437,560 |
| March 2026 | $576,721 |
| April 2026 | $613,699 |
| May 2026 | $794,690 |
---
## Publicly Traded Client Exposure
Audacie serves as external auditor and tax advisor to several **Toronto Stock Exchange (TSX)** listed companies. Complete 52-109 certification files, audit working papers, internal financial controls documentation, and MD&A preparation materials were obtained:
| Client | Exchange | Ticker | Data Volume |
|---|---|---|---|
| **Goodfellow Inc.** | TSX | GDL | 9.4 GB — 52-109 cert, Audit Committee, Risk & Control Matrix |
| **GURU Organic Energy Corp.** | TSX | GURU | 9.0 GB — 52-109 securities filings |
| **BTB REIT** | TSX | BTB.UN | 7.2 GB — 52-109, MD&A, IFRS reporting |
| **Keurig Dr Pepper** (via Van Houtte) | NASDAQ | KDP | Client files via subsidiary |
| **SAFRAN** (via Orolia Canada) | Euronext | SAF | Aerospace/defense subsidiary files |
| **Testia** (Airbus subsidiary) | Euronext | AIR | Aviation inspection division |
Disclosure of non-public financial information for these entities may constitute a securities regulation matter under the jurisdiction of the **Autorité des marchés financiers (AMF)** and the **Ontario Securities Commission (OSC)**.
---
## Politically Exposed Persons
| Name | Role | Data |
|---|---|---|
| **Denis Coderre** | Former Mayor of Montreal | Complete personal and corporate tax files via "Groupe Denis Coderre" |
---
## Credentials Compromised
| Type | Count | Details |
|---|---|---|
| Chrome password export | 88 credential pairs | Government portals (GCKey, clicSÉQUR), legal systems, banking, personal accounts |
| KeePass vault | 1 database (encrypted) | Company-wide password manager — Guimond.kdbx (147 KB, updated October 2026) |
| FortiGate configurations | 6 files (3 sites) | Complete firewall rules, VPN credentials, LDAP service accounts, IPsec keys |
| VoIP/UCM credentials | 4 sets | Including external-facing: admin / ToO08&kmy!85gmdB (Sorel UCM on public IP) |
| Active Directory export | 53 VPN users | Full username list with group memberships |
| SMTP credentials | 1 set | Plaintext email relay password |
### Password Patterns Observed
Common passwords across systems: `Sandy1993`, `Glegal7055`, `Notaire123`, `Slalom7055`, `Audacie2024` — indicating widespread password reuse across government, professional, and personal accounts.
---
## Sensitive Client Categories
### Healthcare
Neuroperforma (clinics), Purkinje (EMR software provider), Peripharm (pharmaceutical), Clinique K, RxTuteur — **subject to Quebec Loi 25 health data provisions**
### 984 Sage Simply Accounting Databases
Complete general ledger, accounts receivable, accounts payable, and payroll records for hundreds of clients stored in MySQL-backed .SAJ database format spanning 226 GB.
### Government Powers of Attorney
2,415 files containing signed ARC (Canada Revenue Agency) and MRQ (Revenu Québec) authorization forms — granting Audacie representative access to client government tax accounts.
---
## Key Findings
1. **3,933 client Social Insurance Numbers exposed** — Personal NAS/SIN numbers present across T1/TP-1 individual returns, T4/RL-1 employment slips, and trust returns. Mandatory notification under Quebec's **Loi 25** (Act respecting the protection of personal information in the private sector).
2. **TSX-listed company audit files compromised** — Non-public financial data for at least 3 publicly traded entities creates potential securities regulation implications.
3. **Complete network infrastructure exposed** — FortiGate firewall configurations for all 3 office sites, including VPN topology, LDAP credentials, and IPsec mesh keys, enabling persistent access.
4. **88 plaintext credential pairs** — Exported Chrome passwords including federal government (GCKey), provincial government (clicSÉQUR), legal databases, and personal accounts — with extensive password reuse.
5. **Internal partner dispute fully documented** — Complete arbitration file (Lavallée v. Guimond Lavallée Inc., 2022) including business valuations, sworn declarations, shareholder agreements, and financial counter-claims.
6. **Fondation Audacie** — Newly registered charity (2024) with complete financial setup, government registration documents, and employee presentation materials.
---
## Regulatory Exposure
| Regulation | Applicability | Maximum Penalty |
|---|---|---|
| **Quebec Loi 25** | 3,933 individuals with NAS/SIN, health data | Up to **$25,000,000 CAD** |
| **PIPEDA** (federal) | Cross-provincial client data | Compliance orders, public reporting |
| **AMF / OSC** | TSX-listed client audit files | Regulatory sanctions, auditor debarment |
| **OCPAQ** (CPA Order of Quebec) | Professional standards violation | License suspension / revocation |
---
*Data available for verification upon contact. Resolution discussions welcome prior to full publication.* |
Link |
| 2026-11-10 22:32:49.227065 |
CIMSA LOGISTICS |
inc ransom |
In the warehousing logistics business for over 20 years, we provide best-in-class warehouse storage solutions for both manufacturing plants in northeast Mexico and their suppliers by allowing parts and raw materials to be stored minutes away from maquiladora plants.
Our personnel are individually and team driven to provide value and the flexibility required to meet all your service expectations.
We are flexible and innovative in the design of customized warehousing logistics plans that meet the most demanding use cases.
Part of the Amado Trucking, Inc. family of companies, we provide seamless warehousing and transportation solutions without equal in the industry. |
Link |
| 2026-11-10 22:32:48.374406 |
HELP Foundation |
inc ransom |
The HELP Foundation (HELP) has been a leading provider of residential services for children and adults with intellectual and developmental disabilities (IDD) since 1965. Beginning with a few dedicated families and one childrens' home HELP has grown to care for more than 500 individuals each year in 26 locations. Our mission is to ensure that people with IDD have the homes, environments and opportunities to be valued members of their communities. In serving this mission HELP provides residential support services in Cuyahoga, Lake, and Summit counties as well as our HELP Summer Program for children with developmental, behavioral and medical disabilities, and the HELP Adult Day Support Program. |
Link |
| 2026-11-10 22:32:47.539034 |
StrucSure Home Warranty |
inc ransom |
StrucSure Home Warranty is a leading provider of new home warranties and risk management solutions for home builders, contractors, and homeowners across the United States. The company offers comprehensive coverage options, including structural, workmanship, and systems warranties, backed by reinsurance from Lloyds of London. StrucSure aims to protect builders and homeowners from potential defects and financial liabilities while providing tailored insurance solutions to meet diverse needs. Their services also include warranty administration and marketing support to enhance builder-client relationships. |
Link |
| 2026-11-10 22:32:46.683072 |
gamechangerwm.com |
inc ransom |
Game Changer Wealth is a full-service financial services firm with three offices located in the heart of Baton Rouge, Lafayette, and Metairie. |
Link |
| 2026-11-10 22:32:45.817387 |
raymondjames.com |
inc ransom |
Raymond James Financial is a prominent American multinational independent investment bank and diversified financial services company. Founded in 1962 and headquartered in St. Petersburg, Florida, the firm manages nearly $2 trillion in assets under administration. |
Link |