Ransomware Group intelligence

Akira

Active

Track Akira with 1670 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 1670 Known published victims in this dataset

First discovered 2023-04-26 Earliest victim discovery date

Last discovered 2026-10-22 Latest victim discovery date

Inactive since 0 days Days since the latest known victim

Top country United States 917 victims

Known locations 2 Leak or negotiation infrastructure tracked

Akira is tracked by Breach House as a ransomware group with 1670 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

1670

Leaked 744 44.6%
Pending 926 55.4%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Up checked 3h ago	`akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion`
Leak location 1	Onion service	Up checked 3h ago	`akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion`

Finance / Legal / Insurance 432
Communication / Marketing 320
Manufacturing / Engineering 182
Services 140
Construction / Real Estate 106
Not identified 78
IT 74
Healthcare / Pharma 66
Energy 41
Agriculture / Food 34
Transportation / Travel / Logistics 33
Hospitality / Food & Beverage / Tourism 33
Retail / E-commerce 32
Telecommunications 29
Education 26
Public Sector 16
NGOs / Associations 6
null 2

Typical Attacks (29)

▼

How Akira typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Akira, Akira, Akira _v2.

T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: Akira uses valid account information to remotely access victim networks, such as VPN credentials.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1133 External Remote Services Initial AccessPersistence

What they do: Akira uses compromised VPN accounts for initial access to victim networks.

What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1047 Windows Management Instrumentation Execution

What they do: Akira will leverage COM objects accessed through WMI during execution to evade detection.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.001 PowerShell Execution

What they do: Akira has used PowerShell scripts for credential harvesting and privilege escalation.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1059.003 Windows Command Shell Execution

What they do: Akira executes from the Windows command line and can take various arguments for execution.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1543 Create or Modify System Process PersistencePrivilege Escalation

What they do: Akira _v2 can create a child process for encryption.

What that means: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
T1027.001 Binary Padding Stealth

What they do: Akira has used binary padding to obfuscate payloads.

What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: Akira has used legitimate names and locations for files to evade defenses.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1480 Execution Guardrails Stealth

What they do: Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.

What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
T1685 Disable or Modify Tools Defense Impairment

What they do: Akira has disabled or modified security tools for defense evasion.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1558 Steal or Forge Kerberos Tickets Credential Access

What they do: Akira have used scripts to dump Kerberos authentication credentials.

What that means: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
T1018 Remote System Discovery Discovery

What they do: Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1057 Process Discovery Discovery

What they do: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

What that means: Adversaries may attempt to get information about running processes on a system.
T1082 System Information Discovery Discovery

What they do: Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1083 File and Directory Discovery Discovery

What they do: Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1135 Network Share Discovery Discovery

What they do: Akira can identify remote file shares for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1482 Domain Trust Discovery Discovery

What they do: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

What that means: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
T1654 Log Enumeration Discovery

What they do: Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

What that means: Adversaries may enumerate system and service logs to find useful data.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: Akira has used RDP for lateral movement.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1213.002 Sharepoint Collection

What they do: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.
T1560.001 Archive via Utility Collection

What they do: Akira uses utilities such as WinRAR to archive data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1219 Remote Access Tools Command and Control

What they do: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: Akira will exfiltrate victim data using applications such as Rclone.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: Akira encrypts files in victim environments as part of ransomware operations.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: Akira _v2 can stop running virtual machines.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: Akira will delete system volume shadow copies via PowerShell commands.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1531 Account Access Removal Impact

What they do: Akira deletes administrator accounts in victim networks prior to encryption.

What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
T1657 Financial Theft Impact

What they do: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (41)

▼

Software Akira has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

DonPAPI LaZagne Mimikatz

Defense evasion

PowerTool Zemana Anti-Rootkit driver Zemana Anti-Rootkit

Discovery

Advanced IP Scanner Masscan ReconFTW SharpHound SoftPerfect NetScan

Discovery & enumeration

Advanced IP Scanner Bloodhound ldapdomaindump Masscan ReconFTW SharpHound SharpShares SoftPerfect NetScan

Exfiltration

FileZilla MEGA RClone Temp[.]sh WinSCP

Networking & tunnelling

Cloudflared OpenSSH Ngrok

OffSec

Impacket

Offensive security tooling

CrackMapExec Impacket NetExec

RMM Tools

AnyDesk MobaXterm Radmin RustDesk

Remote monitoring & management

AnyDesk MeshAgent MobaXterm Radmin RustDesk TeamViewer

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (15)

▼

$3,991,216 Received (USD)

24 Payments

15 Known wallets

$997,459 Largest single payment

2023-07-13 → 2024-09-17 Payment window

bitcoin · 15

Address	Chain	Received (USD)	Payments
`bc1qr0pqfghr9cksfc5arr2rak3lt2y50v03pc76nh`	bitcoin	$997,461	2
`bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdaj`	bitcoin	$482,181	1
`bc1q0dx45y82r5rt36sm38jv0k4dexwc4nj9z4ryw7`	bitcoin	$446,073	2
`bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2`	bitcoin	$351,883	1
`bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6h`	bitcoin	$298,537	2
`bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24`	bitcoin	$252,389	1
`bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mc`	bitcoin	$229,395	4
`bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8`	bitcoin	$150,205	1
`bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtah`	bitcoin	$149,891	1
`bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkyd`	bitcoin	$139,534	1
`bc1qpwwtck0zhzrj56fxeayz6wz5546nlp607qzpvh`	bitcoin	$109,655	2
`bc1qghj85gz0dkr9jeucana3z4xu50ujtllj50rvj0`	bitcoin	$106,115	2

+3 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

akira_readme_3.txt txt · 3485 chars

Hi friends,

Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:

1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

6. Negotiations with Akira can only be conducted in a chat room, which you can access using the login details provided below or in the notes (a readme.txt file) in your systems. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf.

7. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme_2.txt txt · 2908 chars

Hi friends,

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme.txt txt · 2662 chars

Hi friends,

Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.

5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (1670)

Search, filter and paginate the victim timeline for Akira. Showing 1–100 of 1670.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Bethany Press International id35437 View details	2026-10-22	United States	Services		pending
Bethany Press International Published: 2026-10-21 Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib \| \| ute millions of life-changing Christian books each year. They offer industry-leading publishing \| \| services for both short-run and long-run printing and distribution. \| \| \| \| We will upload 40gb of corporate data soon. Employee personal information (financials and so on \| \| ), customer information, financials, contracts and agreements, and so on. \| \| Terminal status: pending ID 35437
Ransomware	Bethany Press International id35444 View details	2026-10-22	United States	Services	—	pending
Bethany Press partners with authors, ministries, and publishers to create, produce, and distrib ute millions of life-changing Christian books each year. They offer industry-leading publishing services for both short-run and long-run printing and distribution. We will upload 40gb of corporate data soon. Employee personal information (financials and so on ), customer information, financials, contracts and agreements, and so on. ID 35444
Ransomware	Medienwerkstatt id35438 View details	2026-10-22	Germany	Services	—	pending
Medienwerkstatt stands for digital and printed communication of the highest quality and disting uishes itself through an exceptional customer service. With more than 50 passionate talents for various offline and online disciplines, medienwerkstatt ag is one of the largest media service providers in the canton of Thurgau. We will upload 130gb of corporate data soon. Employee personal information (names, addresses, p hones, contacts and so on), customer information, contracts and agreements, and so on. ID 35438
Ransomware	Annapath id35439 View details	2026-10-22	India	IT	—	pending
Annapath, Inc. is a privately owned surgical and cytopathology laboratory that primarily focuse s on dermatopathology, serving clients in Maryland, Delaware, Pennsylvania, Washington D.C., Vi rginia, and West Virginia. The company offers a full range of anatomic and clinical pathology s ervices, emphasizing prompt and accurate diagnoses with a commitment to exceptional customer se rvice. We will upload 110gb of corporate data soon. Employee personal information (passports and other s personal files), customer information, contracts and agreements, and so on. ID 35439
Ransomware	Cascade Flooring America id35387 View details	2026-10-21	United States	Retail / E-commerce		pending
Cascade Flooring America Published: 2026-10-21 Cascade Flooring America is a flooring store located in Vancouver, WA, offering a wide range of \| \| products including flooring, furniture, window coverings, and kitchen and bath services. The c \| \| ompany caters to homeowners looking for premium flooring solutions, with options such as carpet \| \| , hardwood, luxury vinyl, laminate, and tile. \| \| \| \| We will upload 50gb of corporate data soon. Employee personal information (passports and other \| \| personal information), client information, financials, confidential files, NDA, and so on. \| \| Terminal status: pending ID 35387
Ransomware	Flextron Circuit Assembly id35388 View details	2026-10-21	—	Manufacturing / Engineering		pending
Flextron Circuit Assembly Published: 2026-10-21 Flextron Circuit Assembly specializes in quick-turn prototype PCB manufacturing and assembly, o \| \| ffering a comprehensive range of services including design, fabrication, and assembly of printe \| \| d circuit boards (PCBs). \| \| \| \| We will upload 34gb of corporate data soon. Employee personal information (passports, DLs, addr \| \| esses, emails and so on), financials, NDA, and so on. \| \| Terminal status: pending ID 35388
Ransomware	Flextron Circuit Assembly id35389 View details	2026-10-21	Singapore	Manufacturing / Engineering	—	pending
Flextron Circuit Assembly specializes in quick-turn prototype PCB manufacturing and assembly, o ffering a comprehensive range of services including design, fabrication, and assembly of printe d circuit boards (PCBs). We will upload 34gb of corporate data soon. Employee personal information (passports, DLs, addr esses, emails and so on), financials, NDA, and so on. ID 35389
Ransomware	Cascade Flooring America id35390 View details	2026-10-21	United States	Manufacturing / Engineering	—	pending
Cascade Flooring America is a flooring store located in Vancouver, WA, offering a wide range of products including flooring, furniture, window coverings, and kitchen and bath services. The c ompany caters to homeowners looking for premium flooring solutions, with options such as carpet , hardwood, luxury vinyl, laminate, and tile. We will upload 50gb of corporate data soon. Employee personal information (passports and other personal information), client information, financials, confidential files, NDA, and so on. ID 35390
Ransomware	Stransky Heiz-Mess-R id35139 View details	2026-10-19	Austria	Services		leaked
Stransky Heiz-Mess-R Published: 2026-09-15 Discover Stransky—a leader in sustainable energy solutions. Trust in over 30 years of experien \| download \| egeltechnik GmbH \| ce in heating technology and quality. \| \| \| \| \| \| Here is the access to 50gb of corporate data. Employee personal information, contacts and agre \| \| \| ements, financials, projects, NDAs and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35139
Ransomware	Brentwood Country Cl id35140 View details	2026-10-19	United States	Other		leaked
Brentwood Country Cl Published: 2026-09-15 Nestled in the heart of one of L.A.'s most desirable neighborhoods, cooled by the ocean breeze \| download \| ub \| s just minutes away, Brentwood Country Club has been a warm, welcoming, "home away from home" \| \| \| for members and their guests since 1948. At Brentwood, youll find an elegant, yet relaxed atmo \| \| \| sphere, where friends and families gather to appreciate each others company and all the best t \| \| \| hat life has to offer. \| \| \| \| \| \| Here is the access to upload company data. Employee personal information (passport, DLs), cont \| \| \| acts and agreements, financials, clients data, projects and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35140
Ransomware	Congressional Iron W id35141 View details	2026-10-19	United States	Manufacturing / Engineering		leaked
Congressional Iron W Published: 2026-09-15 Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerc \| download \| orks \| ial construction industry in the greater Baltimore-Washington area. Established in 2004, the c \| \| \| ompany offers a range of services including estimating, drafting, fabrication, and project man \| \| \| agement, focusing on steel and architectural metals components such as structures, stairs, and \| \| \| canopies. \| \| \| \| \| \| Here is the access to 35gb of corporate data. Employee personal information (passport numbers, \| \| \| SSNs, DLs, financial information, health information), clients information, company financial \| \| \| s, projects, NDAs. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35141
Ransomware	Vetta id35128 View details	2026-10-19	Brazil	IT		leaked
Vetta Published: 2026-09-20 Vetta Digital Serviços specializes in providing integrated digital solutions focused on energy \| download \| \| management and sustainability for industrial operations. Their offerings include advanced sof \| \| \| tware technologies, industrial automation projects, and data infrastructure optimization aimed \| \| \| at reducing carbon footprints and energy costs. \| \| \| \| \| \| Here is the access to upload company data. Internal files, a bit of corporate docs, clients, p \| \| \| rojects. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35128
Ransomware	Javep Chevrolet id35124 View details	2026-10-19	Brazil	Services		leaked
Javep Chevrolet Published: 2026-09-20 Javep Chevrolet makes buying a car simple and easy. They help customers find their perfect veh \| download \| \| icle through a complete online experience. From first contact to final delivery, everything ha \| \| \| ppens right from home. \| \| \| \| \| \| Here is the access to 16gb of corporate data. Detailed employee personal information (passport \| \| \| number, NAME, address, phone, email address and so on), projects, clients information, Chevro \| \| \| let agreements and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35124
Ransomware	Southern California id35126 View details	2026-10-19	United States	Telecommunications		leaked
Southern California Published: 2026-09-20 Southern California Telephone Company (SCTC) is a dynamic telecom provider with over 30 years \| download \| Telephone Company \| of experience, offering a comprehensive range of services for both residential and business cl \| \| \| ients. Their product lineup includes high-speed internet, mobility solutions, virtual fax serv \| \| \| ices, and VoIP offerings, catering to various connectivity needs. \| \| \| \| \| \| Here is the access to 34gb of corporate data. Employee personal information (passports, w-9s a \| \| \| nd so on), customer information (phone numbers and other sensitive information), contracts and \| \| \| agreements, NDAs, confidential certificates and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35126
Ransomware	Blossomland Accounti id35129 View details	2026-10-19	United States	Retail / E-commerce		leaked
Blossomland Accounti Published: 2026-09-20 Blossomland Accounting LLC provides a range of accounting services including tax preparation a \| download \| ng \| nd planning, payroll services, and consulting in Southwest Michigan. The company focuses on de \| \| \| veloping long-term relationships with clients, offering personalized services tailored to thei \| \| \| r unique financial needs. \| \| \| \| \| \| Here is the access to 12gb of corporate data. Employee personal information (SSN numbers, pass \| \| \| ports, DLs, death certs), financials, confidential clients files, credit card details, project \| \| \| s, contracts and agreements and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35129
Ransomware	Practice Management id35127 View details	2026-10-19	United States	Other		leaked
Practice Management Published: 2026-09-20 Practice Management specializes in providing comprehensive medical billing and revenue cycle m \| download \| (maximizedrevenue.co \| anagement services tailored for healthcare organizations, particularly Federally Qualified Hea \| \| m) \| lth Centers (FQHCs). \| \| \| \| \| \| Here is the access to 43gb of corporate data. Detailed employee personal information (NAME, ad \| \| \| dress, phone, email), client information (name, IDs and medical information), projects and so \| \| \| on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35127
Ransomware	Krycler, Ervin, Taub id35114 View details	2026-10-19	United States	Finance / Legal / Insurance		leaked
Krycler, Ervin, Taub Published: 2026-10-03 Krycler, Ervin, Taubman & Kaminsky is a prominent accounting, litigation support, and consulti \| download \| man & Kaminsky \| ng firm based in Sherman Oaks, California. Established in 1987, the firm is dedicated to provi \| \| \| ding personalized service and achieving high-quality standards for its clients. \| \| \| \| \| \| Here is the access to 88gb of corporate data. Lots of employee documents (passports, DLs, SSN, \| \| \| death and birth certs), financials, insurance, credit cards, client information, NDAs and so \| \| \| on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35114
Ransomware	Apex Litigation Supp id35119 View details	2026-10-19	United States	IT		leaked
Apex Litigation Supp Published: 2026-09-25 Apex Litigation Support is a business that provides comprehensive litigation services to attor \| download \| ort \| neys and law firms. Our team of experienced professionals is committed to delivering accurate \| \| \| and timely results that exceed our client's expectations. \| \| \| \| \| \| Here is the access to 77gb of corporate data. Detailed employee and clients personal informati \| \| \| on (passports, licenses, names, addresses, phones, emails and so on), personal financials, con \| \| \| fidential files, enormous amount of client data, lots of NDAs and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 35119
Ransomware	The Official College id34594 View details	2026-10-16	Spain	Energy		leaked
The Official College Published: 2026-10-03 The Official College of Architects of León (COAL) was established on July 12, 1931, encompassi \| download \| of Architects of Le \| ng the regions of León, Asturias, and Galicia. The College of Galicia was legally separated in \| \| ón (COAL) \| 1973 and the College of Asturias in 1981. \| \| \| \| \| \| Here is the access to 77gb of corporate data. Detailed personal information (passports), finan \| \| \| cials, students and clients information and so on. \| \| \| \| \| \| Click the download button. \| \| \| \| \| \| You will find several password-free archives. Click on any of them to start the download. \| \| \| \| Terminal status: leaked ID 34594
Ransomware	Boyle, Pecharich, Cline, Whitt id34579 View details	2026-10-16	—	Services		pending
Boyle, Pecharich, Cline, Whitt Published: 2026-10-15 This law firm has been serving clients in Arizona since 1950, specializing in various legal are \| ington and Stallings \| as including business law, real estate law, probate, trusts, estate administration, and estate \| \| planning. They are dedicated to assisting individuals and businesses in Prescott and Yavapai Co \| \| unty with their legal challenges. \| \| \| \| We will upload 24gb of corporate data soon. Detailed client information (SSN numbers, passports \| \| , DLs), court files, contracts, financials, lots of confidential files, NDA, and so on. \| \| Terminal status: pending ID 34579
Ransomware	Videk id33890 View details	2026-10-15	United Kingdom	IT	—	pending
Videk is a leading global provider of vision-based print verification systems, inserter input a nd output scanning systems, and data management software. We will upload 8gb of corporate data soon. Employee information, customer information, contract s, financials, NDA, and so on. ID 33890
Ransomware	Boyle, Pecharich, Cline, Whittington and Stallings id33891 View details	2026-10-15	United States	Services	—	pending
This law firm has been serving clients in Arizona since 1950, specializing in various legal are as including business law, real estate law, probate, trusts, estate administration, and estate planning. They are dedicated to assisting individuals and businesses in Prescott and Yavapai Co unty with their legal challenges. We will upload 24gb of corporate data soon. Detailed client information (SSN numbers, passports , DLs), court files, contracts, financials, lots of confidential files, NDA, and so on. ID 33891
Ransomware	Svd (Sun Valley Dairy) id33883 View details	2026-10-15	United States	Agriculture / Food	—	pending
Sun Valley Dairy is a Truck Transportation, Grocery, and Retail company located in Keizer, Oreg on with $65.2 million in revenue and 19 employees. We will upload corporate data soon. Employee information (passport scans, w-9 forms), customer information, contracts and agreements, internal confidential financials, etc. ID 33883
Ransomware	FOODMatch id33862 View details	2026-10-14	—	—	—	pending
FOODMatch DIVINA is a producer and importer of Mediterranean specialty foods, offering a wide range of products including olives, antipasti, spreads, sauces, and condiments. The company fo cuses on responsibly and traditionally crafted foods that enhance community and quality of life . We will upload 55gb of corporate data soon. Detailed employee information (passports, DLs, SSNs , complete forms), client information, contracts and agreements, payment details, NDA, etc. ID 33862
Ransomware	Shediac Lobster Shop id33863 View details	2026-10-14	Canada	—	—	pending
Shediac Lobster Shop Ltd. specializes in supplying premium frozen Atlantic lobster to restauran ts, food distributors, and global markets. With over 70 years of processing expertise, the comp any offers a diverse and customizable line of cold-water lobster products, ensuring high qualit y and reliability. We will upload 10gb of corporate data soon. Employee information (passports, SSN numbers, compl ete forms), client information, contracts and agreements, confidential files, financials, payme nt details, NDA, etc. ID 33863
Ransomware	Torns Enterprises id33864 View details	2026-10-14	—	—	—	pending
Vicente Torns is a leading industrial group specializing in the manufacturing of electrical con ductors for the energy, automotive, and construction sectors. The company transforms copper and aluminum for use in the electrical sector, offering a wide range of products including encased strips, twisted cables, and polyimide. We will upload 84gb of corporate data soon. Employee information (passports, visa docs, complet e forms and other HR files), client information, contracts and agreements, confidential files, financial papers, NDA, etc. ID 33864
Ransomware	AAA Architectural Hardware id33787 View details	2026-10-12	—	—	—	pending
AAA Architectural Hardware Co. has been a leader in architectural hardware for over 80 years, o ffering a wide range of products and services including keying systems, electronic security, an d custom design requests. We will upload 64gb of corporate data soon. Employee information (name, address and so on), pro jects, clients and partners info, NDAs and so on. ID 33787
Ransomware	Louis Fusco id33727 View details	2026-10-12	—	—	—	pending
Louis Fusco Landscape Architects is a full-service landscape architectural design firm led by p rincipal Louis Fusco. The firm is recognized for its site-sensitive creative designs and meticu lous attention to detail, resulting in award-winning projects featured in landscape journals. We will upload 465gb of corporate data soon. Employee information (passport and DLs scans and s o on), projects (drawings, specifications), clients and partners info, lots of agreements and s o on. ID 33727
Ransomware	PIC GROUP, INC id33728 View details	2026-10-12	United States	Services	—	pending
PIC Group, Inc. is dedicated to delivering value by providing Operation & Maintenance, Commissi oning and Startup, Documentation & Training and Staffing services to the power generation, oil and gas, petrochemical, pulp and paper and manufacturing industries globally. We will upload 8gb of corporate data soon. Employee information, projects (drawings, specificat ions), clients info, contracts and agreements and so on. ID 33728
Ransomware	PIC GROUP, INC id35167 View details	2026-10-12	United States	Services	—	pending
PIC Group, Inc. is dedicated to delivering value by providing Operation & Maintenance, Commissi oning and Startup, Documentation & Training and Staffing services to the power generation, oil and gas, petrochemical, pulp and paper and manufacturing industries globally. We will upload 8gb of corporate data soon. Employee information, projects (drawings, specificat ions), clients info, contracts and agreements and so on. ID 35167
Ransomware	Yarema id33607 View details	2026-10-09	—	—	—	pending
YAREMA specializes in metal fabrication and assembly services. The company offers a range of cu stom solutions to meet various industrial needs. Their intended clients include manufacturers a nd businesses requiring precision metalwork. We will upload 13gb of corporate data soon. Employee information (passports, DLs, SSNs (scans a nd 45 numbers)), projects, client info, NDAs and so on. ID 33607
Ransomware	Design Electric id33600 View details	2026-10-09	—	—	—	pending
Design Electric is a company specializing in industrial, government & transportation electrical in St. Cloud, MN. We will upload 15gb of corporate data soon. Detailed employee information (passports, DLs of mo re than 100 employees, about 350 SSN numbers, addresses, phones and so on), projects, lots of c ontacts, client info, NDA and so on. ID 33600
Ransomware	TigerPress (DCC) id33601 View details	2026-10-09	—	—	—	pending
DCC is a full-service print and packaging provider located in NJ, NY, and MA, specializing in t ransforming creative ideas into high-quality communication tools. They offer a wide range of se rvices including offset printing, digital printing, large format printing, and packaging soluti ons tailored for various industries such as pharmaceuticals, beauty, retail, and consumer goods . We will upload 9 gb of corporate data soon. Employee and clients personal information, projects and so on. ID 33601
Ransomware	Michael K Shelby, CPA id33511 View details	2026-10-06	United States	Finance / Legal / Insurance	—	pending
Michael K. Shelby, CPA, LLC is a CPA firm based in Annapolis, MD, specializing in a comprehensi ve range of tax and accounting services. They provide individual tax preparation, estate and tr ust tax services, and business tax services, ensuring clients meet their tax obligations effici ently. We will upload 18gb of corporate data soon. Personal information of clients and employees (SSNs , payment information), projects, client internal information and so on. ID 33511
Ransomware	Hygrade id33512 View details	2026-10-06	United States	IT	—	pending
Hyggrade Safety is a manufacturer and direct importer specializing in safety and industrial pro ducts. Established in 1949, the company serves the construction and industrial markets. We will upload corporate data soon. Employee information (name, addresses, phones and so on), p rojects and specifications, NDA and so on. ID 33512
Ransomware	The Official Collegeof Architects of León (COAL) id33421 View details	2026-10-03	Mexico	Education	—	pending
The Official College of Architects of León (COAL) was established on July 12, 1931, encompassi ng the regions of León, Asturias, and Galicia. The College of Galicia was legally separated in 1973 and the College of Asturias in 1981. Here is the access to 77gb of corporate data. Detailed personal information (passports), finan cials, students and clients information and so on. Click the download button. You will find several password-free archives. Click on any of them to start the download. ID 33421
Ransomware	The Official College of Architects of León (COAL) id33406 View details	2026-10-02	Mexico	NGOs / Associations	—	pending
The Official College of Architects of León (COAL) was established on July 12, 1931, encompassin g the regions of León, Asturias, and Galicia. The College of Galicia was legally separated in 1 973 and the College of Asturias in 1981. We will upload 77gb of corporate data soon. Detailed personal information (passports), financia ls, students and clients information and so on. ID 33406
Ransomware	Jampac Alimentos id33407 View details	2026-10-02	Brazil	Agriculture / Food	—	leaked
Jampac Alimentos is a leading producer and distributor of food products in Brazil, with over 20 years of experience and a commitment to quality and efficiency. The company serves more than 6 ,500 clients, including restaurants, supermarkets, and industrial kitchens, delivering a wide r ange of products such as poultry, beef, pork, dairy, and fish. We will upload 35gb of corporate data soon. Personal information (passports, payment informatio n and other information), financials, clients information and so on. ID 33407
Ransomware	Pacific Tank Lines id33409 View details	2026-10-02	United States	Manufacturing / Engineering	—	leaked
Pacific Tank Lines, Inc. is a premier full-service petroleum carrier focused on safety and cust omer service. They offer reliable petroleum cargo services with a professional team of drivers and efficient dispatchers. The company operates a modern fleet aimed at reducing their carbon f ootprint and has received multiple awards for their service excellence. We will upload 13gb of corporate data soon. Detailed personal information of 118 employees (pas sports, DLs, addresses, phones, payment details and so on), financials, clients and so on. ID 33409
Ransomware	Wesmar id33376 View details	2026-10-01	United States	Retail / E-commerce	—	leaked
WESMAR specializes in advanced marine technology, offering a range of products including thrust ers, propulsion systems, and commercial fishing sonar. Their innovative solutions cater to vari ous clients, from cruise boats and luxury yachts to commercial fishing operations, ensuring enh anced stability, comfort, and efficiency at sea. We will upload 66gb of corporate data soon. Employee personal documents (passports, DLs, death certs), financials, lots of projects, credit cards, payment details, client information, NDAs a nd so on. ID 33376
Ransomware	DPL Group id33377 View details	2026-10-01	United States	Services	—	leaked
DPL Group Ltd. is a supplier of building materials and home improvement products, offering a wi de range of items including timber sheet materials, heating, plumbing, hand tools, and fixings. The company also provides doors, floors, stairs, electrical supplies, and decorating materials . We will upload 8gb of corporate data soon. Employee personal documents (passports, DLs, medical information), financials, lots of projects, customer information and so on. ID 33377
Ransomware	Krycler, Ervin, Taubman & Kaminsky id33371 View details	2026-10-01	United States	Manufacturing / Engineering	—	leaked
Krycler, Ervin, Taubman & Kaminsky is a prominent accounting, litigation support, and consultin g firm based in Sherman Oaks, California. Established in 1987, the firm is dedicated to providi ng personalized service and achieving high-quality standards for its clients. We will upload 88gb of corporate data soon. lots of employee documents (passports, DLs, SSN, de ath and birth certs), financials, insurance, credit cards, client information, NDAs and so on. ID 33371
Ransomware	Geebee Garments id33239 View details	2026-09-28	—	Manufacturing / Engineering	—	leaked
Geebee Garments is a renowned apparel manufacturer with over 130 years of experience, operating facilities in the UAE and Bangladesh. The company specializes in a wide range of products, inc luding casual wear, formal wear, and workwear, catering to leading brands globally. We will upload 100gb of corporate data soon. Employee information (passports, SSN), financials, client information, NDAs and so on. ID 33239
Ransomware	Knit id33240 View details	2026-09-28	United Kingdom	Finance / Legal / Insurance	—	leaked
One of our essential beliefs is that architecture changes lives. This belief guides our path ev ery day. We seek clients and relationships who are equally interested in improving their city, their business, their school, their neighborhood or the place they call home. We will upload 175gb of corporate data soon. Employee information (passports, DLs, credit cards ), projects, financials, client information, NDAs and so on. ID 33240
Ransomware	Wallatec id33139 View details	2026-09-24	United States	Manufacturing / Engineering	—	leaked
Wallatec creates high-performance carbonation systems for restaurants and busy kitchens. Their equipment is built to handle intense daily use, working perfectly even in the most hectic envir onments. We will upload 15gb of corporate data soon. Employee information (passports), projects, financi als, client information and so on. ID 33139
Ransomware	Strack Companies id33142 View details	2026-09-24	United States	IT	—	leaked
Strack Construction is a commercial and industrial construction contractor headquartered in St. Joseph, Minnesota. Founded in 1938, the family-owned company provides design-build, general co ntracting, construction management, and real estate development services. We will upload 60gb of corporate data soon. Employee information, projects (drawings and specif ications), detailed financials, client information, NDAs and so on. ID 33142
Ransomware	Urban Engineering id33093 View details	2026-09-23	—	Manufacturing / Engineering	—	leaked
Urban Engineering is a company that specializes in providing engineering services. They focus o n delivering innovative solutions for various projects. Their intended clients include business es and organizations seeking professional engineering expertise. The company is headquartered i n Annandale, Virginia. We will upload 20gb of corporate data soon. Employee information, projects, lots of financial d ocuments, contracts and agreements, NDAs and so on. ID 33093
Ransomware	HIT dd id33091 View details	2026-09-23	—	null	—	leaked
HIT d.d. is a prominent entertainment and gaming provider based in Nova Gorica, Slovenia, offer ing a diverse range of services including hotels, casinos, wellness centers, and dining options . With over 40 years of experience, the company operates multiple resorts and entertainment ven ues across Slovenia and Bosnia and Herzegovina, catering to both local and international client s. We will upload 367gb of corporate data soon. Detailed employee personal information (passports, licenses, names, addresses, phones, email and so on), financials, confidential agreements, cli ent data, interesting casino files, NDAs and so on. ID 33091
Ransomware	Apex Litigation Support id33092 View details	2026-09-23	—	Finance / Legal / Insurance	—	leaked
Apex Litigation Support is a business that provides comprehensive litigation services to attorn eys and law firms. Our team of experienced professionals is committed to delivering accurate an d timely results that exceed our client's expectations. We will upload 77gb of corporate data soon. Detailed employee and clients personal information (passports, licenses, names, addresses, phones, emails and so on), personal financials, confide ntial files, enormous amount of client data, lots of NDAs and so on. ID 33092
Ransomware	Coe Press Equipment id33057 View details	2026-09-22	United States	Manufacturing / Engineering	—	leaked
COE Press Equipment designs and manufactures a complete line of premiere coil handling and serv o roll feed equipment from stand-alone roll feeds, precision straighteners, and reels to comple te integrated feed systems and cut-to-length lines. We will upload 25gb of corporate data soon. Detailed employee personal information (SSNs, drive rs licenses, passports and other HR files), financials, projects, confidential client docs, NDA s and so on. ID 33057
Ransomware	TDMI id33058 View details	2026-09-22	United States	Finance / Legal / Insurance	—	leaked
TDMI has an in-house sample department for outstanding product development and quality testing. The company stay alert to emerging trends and develop innovative textiles based on constant ma rket research analyses. We will upload 33gb of corporate data soon. Detailed employee personal information (SSNs, drive rs licenses, passports), financials, credit cards, projects, client data, NDAs and so on. ID 33058
Ransomware	DI.C.S.EL. S.R.L. id33056 View details	2026-09-22	Italy	Other	—	leaked
Introduction DI.C.S.EL. S.R.L., founded in 2005, is an Italian company headquartered in Milan a nd operating throughout Lombardy, specializing in the provision of technical solutions for the electrical and measurement sectors. We will upload 9gb of corporate data soon. Employee personal information (drivers licenses, EU IDs), financials, payment details, projects, NDAs and so on. ID 33056
Ransomware	Prestige Management id33029 View details	2026-09-21	United States	IT	—	leaked
Prestige Management Inc. is a licensed real estate company based in New York, specializing in r esidential and commercial property management. The company is dedicated to providing high-quali ty management services for property owners and residents, ensuring accountability and complianc e in their operations. We will upload 20gb of corporate data soon. Employee and client information (name, address and so on), financials, payment details. ID 33029
Ransomware	Anderson Industries id32967 View details	2026-09-18	United States	—	—	leaked
Anderson Industries is a cutting-edge engineering and manufacturing company that assists forwar d-thinking businesses in bringing innovative products to market. They offer a range of products including agricultural equipment, trailers, and foundry services. We will upload 9gb of corporate data soon. Employee personal information, client information, l ots of projects, specifications, orders, financials, NDAs and so on. ID 32967
Ransomware	Practice Management (maximizedrevenue.com) id32922 View details	2026-09-17	United States	—	—	leaked
Practice Management specializes in providing comprehensive medical billing and revenue cycle ma nagement services tailored for healthcare organizations, particularly Federally Qualified Healt h Centers (FQHCs). We will upload 43gb of corporate data soon. Detailed employee personal information (NAME, addre ss, phone, email), client information (name, IDs and medical information), projects and so on. ID 32922
Ransomware	Vetta id32923 View details	2026-09-17	Brazil	IT	—	leaked
Vetta Digital Serviços specializes in providing integrated digital solutions focused on energy management and sustainability for industrial operations. Their offerings include advanced softw are technologies, industrial automation projects, and data infrastructure optimization aimed at reducing carbon footprints and energy costs. We will upload corporate data soon. Internal files, a bit of corporate docs, clients, projects. ID 32923
Ransomware	Javep Chevrolet id32924 View details	2026-09-17	Brazil	Retail / E-commerce	—	leaked
Javep Chevrolet makes buying a car simple and easy. They help customers find their perfect vehi cle through a complete online experience. From first contact to final delivery, everything happ ens right from home. We will upload 16gb of corporate data soon. Detailed employee personal information (passport nu mber, NAME, address, phone, email address and so on), projects, clients information, Chevrolet agreements and so on. ID 32924
Ransomware	Blossomland Accounting id32896 View details	2026-09-16	—	Finance / Legal / Insurance	—	leaked
Blossomland Accounting LLC provides a range of accounting services including tax preparation an d planning, payroll services, and consulting in Southwest Michigan. The company focuses on deve loping long-term relationships with clients, offering personalized services tailored to their u nique financial needs. We will upload 12gb of corporate data soon. Employee personal information (SSN numbers, passpor ts, DLs, death certs), financials, confidential clients files, credit card details, projects, c ontracts and agreements and so on. ID 32896
Ransomware	Bee Maid Honey id32897 View details	2026-09-16	Canada	Agriculture / Food	—	leaked
Bee Maid Honey Limited is the marketing arm of the Alberta Honey Producers Cooperative Limited and the Manitoba Cooperative Honey Producers Limited. Honey produced by beekeepers in western C anada is processed and packaged at Bee Maid's Winnipeg, MB and Spruce Grove, AB plants. We will upload 46gb of corporate data soon. Employee personal information (passports numbers, D Ls, death certs and other HR files), financials, confidential internal files, projects, contrac ts and agreements, NDA and so on. ID 32897
Ransomware	Manders id32898 View details	2026-09-16	United Kingdom	Services	—	leaked
Manders Companies is a family-owned contractor based in the Washington Metropolitan Area, recog nized for its full-service maintenance, renovation support, and painting services for multi-fam ily, commercial, and residential properties. We will upload 70gb of corporate data soon. Employee personal information (SSN numbers, passpor ts, DLs), financials, confidential clients files, contracts and agreements, NDAs and so on. ID 32898
Ransomware	Pilot Precision id32869 View details	2026-09-15	United States	Manufacturing / Engineering	—	leaked
Pilot Precision Products specializes in industrial broaches, cutting tools, milling, drilling, and turning for machining operations. They offer a diverse array of products including CNC inde xable broaching, solid carbide drills, and various types of milling tools. We will upload 30gb of corporate data soon. Employee personal information (SSN numbers, names, addresses and so on), detailed financials, lots of projects info, contracts and agreements, cus tomers, partners and so on. ID 32869
Ransomware	Lazyboyz id32870 View details	2026-09-15	Norway	Retail / E-commerce	—	leaked
Lazy Boyz - Harley-Davidson Oslo specializes in motorcycles and workshop services, particularly for Harley-Davidson and Royal Enfield, with over 30 years of experience. They offer a wide ran ge of new and used motorcycles, as well as comprehensive services including repairs, customizat ions, and parts supply. We will upload corporate data soon. Employee personal information, financials, contracts and ag reements and so on. ID 32870
Ransomware	Southern California Telephone Company id32867 View details	2026-09-15	United States	Telecommunications	—	pending
Southern California Telephone Company (SCTC) is a dynamic telecom provider with over 30 years o f experience, offering a comprehensive range of services for both residential and business clie nts. Their product lineup includes high-speed internet, mobility solutions, virtual fax service s, and VoIP offerings, catering to various connectivity needs. We will upload 34gb of corporate data soon. Employee personal information (passports, w-9s and so on), customer information (phone numbers and other sensitive information), contracts and agr eements, NDAs, confidential certificates and so on. ID 32867
Ransomware	AK Stamping id32737 View details	2026-09-10	India	Manufacturing / Engineering	—	leaked
AK Stamping is a leader in precision metal stamping technology, offering engineered design solu tions and a complete package of manufacturing capabilities, including prototyping, tooling, and precision stamping for various manufacturing scales. We will upload 30gb of corporate data soon. SQL and other internal files. ID 32737
Ransomware	Eagle Construction id32738 View details	2026-09-10	—	Construction / Real Estate	—	leaked
Eagle Construction specializes in building quality new homes across Virginia, offering a variet y of communities, floor plans, and quick move-in options. Their services cater to a diverse cli entele, including families and individuals looking for single-family homes, townhomes, and 55 communities. We will upload 70gb of corporate data soon. Detailed employee personal information (passports, DLs, SSNs, w-9 forms), internal confidential files, projects, clients information and so on. ID 32738
Ransomware	George Cameron Nash id32739 View details	2026-09-10	United States	Services	—	leaked
George Cameron Nash Interior Design operates showrooms in Dallas and Houston, Texas, specializi ng in high-end furniture and lighting. They represent a diverse range of brands, including Alex ander Lamont, Chelsea Textiles, and Rubelli, offering products such as outdoor furniture, fabri cs, textiles, and wall coverings. We will upload corporate data soon. Employee personal information, customer information, contra cts. ID 32739
Ransomware	Kyodo USA id32715 View details	2026-09-09	United States	Transportation / Travel / Logistics	—	leaked
Kyodo USA is a leading distributor of marine engine spares and ship operation equipment, boasti ng over 20 years of experience in the international maritime industry. The company serves over 300 clients across more than 100 countries, providing a highly diversified product line and rel iable services. We will upload 30gb of corporate data soon. Detailed employee personal docs scans (DLs, passpor ts, SSNs and other information), contacts and agreements, financials, confidential files, custo mer files, projects, NDAs and so on. ID 32715
Ransomware	Brent Electric id32682 View details	2026-09-08	United Kingdom	Energy	—	leaked
Brent Electric Inc. has been serving the electrical industry since 1996, providing expert servi ces for all electrical needs. The company specializes in generator sales and service, ensuring reliable power solutions for its clients. Additionally, Brent Electric offers custom engraving services, catering to a diverse range of customer requirements. We will upload corporate data soon. Employee personal docs scans (DLs, passports), contacts and agreements, financials, customer files, projects, NDAs and so on. ID 32682
Ransomware	Brentwood Country Club id32677 View details	2026-09-08	United States	Hospitality / Food & Beverage / Tourism	—	leaked
Nestled in the heart of one of L.A.'s most desirable neighborhoods, cooled by the ocean breezes just minutes away, Brentwood Country Club has been a warm, welcoming, "home away from home" fo r members and their guests since 1948. At Brentwood, youll find an elegant, yet relaxed atmosph ere, where friends and families gather to appreciate each others company and all the best that life has to offer. We will upload corporate data soon. Employee personal information (passport, DLs), contacts and agreements, financials, clients data, projects and so on. ID 32677
Ransomware	CreateASoft id32678 View details	2026-09-08	United States	IT	—	leaked
Inc. is a software company. The company provides dynamic process improvement solutions, predict ive technology, and end-to-end support to a variety of process-based operations dedicated to im proving operational efficiency and responsiveness. We will upload corporate data soon. Employee and customer files, contacts and agreements, finan cials, projects and so on. ID 32678
Ransomware	Stransky Heiz-Mess-Regeltechnik GmbH id32573 View details	2026-09-04	Germany	Manufacturing / Engineering	—	leaked
Discover Stransky—a leader in sustainable energy solutions. Trust in over 30 years of experienc e in heating technology and quality. We will upload 50gb of corporate data soon. Employee personal information, contacts and agreeme nts, financials, projects, NDAs and so on. ID 32573
Ransomware	Worrell id32572 View details	2026-09-04	United Kingdom	Services	—	leaked
Worrell Corporation is a family-owned business based in Indianapolis that specializes in promot ional products, marketing, and print services. They assist clients in finding impactful promoti onal items while offering tailored marketing strategies and webstore solutions. We will upload 45gb of corporate data soon. Employee and client information, contacts and agree ments, financials, projects and so on. ID 32572
Ransomware	PennFab id32429 View details	2026-09-02	United States	Manufacturing / Engineering	—	leaked
PennFab is a Pennsylvania-based steel manufacturing company specializing in structural steel fa brication for various industries, including railroad and transportation. They offer a wide rang e of services such as engineering, welding, and custom metal fabrication, ensuring high-quality products made in the USA. We will upload 40gb of corporate data soon. Employee personal information (scanned passports, D Ls, SSNs and so on of 53 employees), clients information, contacts and agreements, financials, NDAs. ID 32429
Ransomware	ScrubaDub Auto Wash Centers id32417 View details	2026-09-02	United States	Services	—	leaked
ScrubaDub Car Wash is New England's leading auto wash, offering customizable tunnel and touchle ss washes, interior cleaning, and detailing services across over 20 locations in Massachusetts, New Hampshire, Maine, and Rhode Island. We will upload corporate data soon. Employee personal information (passport numbers, DLs of 22 employees, contact information), clients information (addresses, contacts and so on), company f inancials, payment details. ID 32417
Ransomware	Algra Group id32418 View details	2026-09-02	Switzerland	Services	—	leaked
Algra Group specializes in customized input systems, front panels, and industrial labels, provi ding tailored solutions for various industries. Their product range includes agnostic touch sys tems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation, wellness, medical technology, and transportation. We will upload corporate data soon. Employee personal information (passport numbers, DLs), clie nts and partners information, contacts and agreements, financials, NDAs. ID 32418
Ransomware	Congressional Iron Works id32404 View details	2026-09-01	—	Manufacturing / Engineering	—	leaked
Congressional Iron Works is a full-service miscellaneous metals contractor serving the commerci al construction industry in the greater Baltimore-Washington area. Established in 2004, the com pany offers a range of services including estimating, drafting, fabrication, and project manage ment, focusing on steel and architectural metals components such as structures, stairs, and can opies. We will upload 35gb of corporate data soon. Employee personal information (passport numbers, SS Ns, DLs, financial information, health information), clients information, company financials, p rojects, NDAs. ID 32404
Ransomware	Flex1 id32400 View details	2026-09-01	United States	IT	—	leaked
Flex1 is an innovative provider of desktop-as-a-service solutions that enables businesses to cr eate secure and cost-effective digital workspaces. Their platform combines cloud architecture w ith productivity tools and managed support services to ensure employees can work efficiently fr om any device, at any time. We will upload 402gb of corporate data and their client soon. Employee personal information, cl ients information (lawyers clients (passports, DLs, SSNs and so on), pet's clinic, etc), financ ials and so on. ID 32400
Ransomware	BYK Construction id32401 View details	2026-09-01	United States	Construction / Real Estate	—	leaked
BYK Construction is a trusted home builder based in Mount Vernon, Washington, specializing in r esidential and commercial construction, land development, property management, and home mainten ance. We will upload 27gb of corporate data and their client soon. Employee personal information (pas sport numbers, SSNs, DLs, financial information), clients information, company financials, proj ects (specifications) and so on. ID 32401
Ransomware	KFZ-MEISTERBETRIEB JOST GmbH id32335 View details	2026-08-31	Germany	Manufacturing / Engineering	—	pending
KFZ-MEISTERBETRIEB JOST GmbH specializes in the repair and maintenance of all types of motor ve hicles. The company offers comprehensive services in the maintenance, repair, and sale of motor vehicles. We will upload 6gb of corporate data soon. Employee personal information, clients information, financials and so on. ID 32335
Ransomware	Gale Credit Union id32336 View details	2026-08-31	United States	Finance / Legal / Insurance	—	leaked
Gale Credit Union offers a variety of financial products and services including loans, savings and checking accounts, and credit cards. Their intended clients are individuals and businesses residing or working in ten counties in Illinois. We will upload 50gb of corporate data soon. Employee personal information (passport, SSNs, DLs, credit cards and so on), clients and partners information, projects, financials, contracts and agreements and so on. ID 32336
Ransomware	WEMS id32328 View details	2026-08-31	United States	IT	—	leaked
WEMS Electronics is a full-service turn-key small business specializing in state-of-the-art EMI custom filters, engineering, and manufacturing services. The company offers a completely integ rated approach to the design and fabrication of precision electronic components, assemblies, an d subsystems. We will upload 51gb of corporate data soon. Employee personal information, client information, lots of confidential HR files, projects, financials, projects, contrast and agreements, NDAs an d so on. ID 32328
Ransomware	Alumax id32232 View details	2026-08-28	United States	Manufacturing / Engineering	—	leaked
Alumax Alumínios specializes in the distribution of aluminum and accessories for the constructi on industry, focusing on providing tailored solutions for builders and metalworkers. The compan y prides itself on its partnership with Hydro, a global leader in sustainable aluminum, allowin g them to offer high-quality products that meet the market's demanding needs. We will upload 58gb of corporate data soon. Detailed employee personal information (passports, IDs, and another personal docs scans), client information, projects, financials, confidential f iles, contrast and agreements, NDAs and so on. ID 32232
Ransomware	BEPeterson id32234 View details	2026-08-28	United States	Services	—	leaked
BEPeterson is a full-service metal fabricator specializing in custom solutions for vessels, tan ks, and heavy-gauge metal parts since 1935. The company serves a diverse range of industries in cluding defense, medical, energy, and industrial sectors, providing high-quality products throu gh advanced manufacturing techniques. We will upload 20gb of corporate data soon. Employee personal information, client information, projects, financials, NDAs and so on. ID 32234
Ransomware	JRT Mechanical id32235 View details	2026-08-28	India	Manufacturing / Engineering	—	leaked
JRT Mechanical is a full-service mechanical contractor specializing in plumbing, HVAC, hydronic s, and mechanical insulation, serving the Pacific Northwest for over 30 years. Founded in 1992, the company has expanded from a small plumbing business to a robust team of over 160 employees , focusing primarily on commercial and industrial projects. We will upload 46gb of corporate data soon. Detailed employee personal information (SSNs, passp orts, DLs, resumes, and another personal docs scans), medical information, client information, projects, financials, confidential files, contrast and agreements, NDAs and so on. ID 32235
Ransomware	Cetylite id32199 View details	2026-08-27	United States	null	—	leaked
Cetylite, Inc. specializes in dental and medical products aimed at enhancing patient comfort, s afety, and satisfaction. Their offerings include exclusive specialty products like Cetacaine fo r dental practices and proprietary Rx and disinfection products for the medical field. We will upload 6gb of corporate data soon. Employee personal information (passports, DLs, SSNs, credit cards), client information, detailed financials, confidential files, NDAs and so on. ID 32199
Ransomware	CGP MEP id32200 View details	2026-08-27	United Kingdom	Manufacturing / Engineering	—	pending
CGP MEP is a Building Services Consultancy based in London and Leeds, specializing in mechanica l and electrical engineering. They offer a wide range of services across various sectors includ ing leisure, education, residential, and industrial projects. We will upload 260gb of corporate data soon. Detailed employee personal information (passports, DLs, SSNs, personal financials), client information, projects, financials, NDAs and so on. ID 32200
Ransomware	Seabrook Island id32201 View details	2026-08-27	United States	—	—	leaked
Seabrook Island and its stunning natural beauty create the perfect setting for luxury homes enj oying oceanfront, riverfront, tidal marsh, golf course, and maritime forest views. We will upload 55gb of corporate data soon. Employee personal information (passports, DLs, SSNs , personal financials), client information, projects, financials, NDAs and so on. ID 32201
Ransomware	Gill Rock Drill id32145 View details	2026-08-26	United States	Manufacturing / Engineering	—	leaked
Gill Rock Drill Company, Inc., located in Lebanon, PA, is a family-owned manufacturer and distr ibutor specializing in drilling equipment and tools for the drilling industry. The company offe rs a range of services including contract drilling, rentals, and technical support, focusing on building strong customer relationships based on integrity and trust. We will upload 5gb of corporate data soon. Employee personal information (passports, DLs, w-9 c omplete forms), client information, financials, payment details, CCs, NDAs and so on. ID 32145
Ransomware	Oral and Maxillofacial Surgery id32146 View details	2026-08-26	—	Healthcare / Pharma	—	leaked
Oral and maxillofacial surgeons Dr. Catrambone and Dr. August , Brockton, MA practice a full sc ope of oral and maxillofacial surgery with expertise ranging from corrective jaw surgery to wis dom tooth removal. We will upload 14gb of corporate data soon. Employee personal information (passports, phone con tacts), client information, financials, patients and so on. ID 32146
Ransomware	PA-ID id32147 View details	2026-08-26	—	Other	—	pending
PA-ID GmbH specializes in mechanical construction and manufacturing, building series and custom systems, as well as electrical design and the development of tailored industrial software. We will upload 119gb of corporate data soon. Employee personal information (passports, ID's), c lient information, financials, NDAs and so on. ID 32147
Ransomware	WINTER Ingenieure id32097 View details	2026-08-25	Germany	Manufacturing / Engineering	—	leaked
WINTER Ingenieure specializes in planning and monitoring the construction of technical building equipment across Germany, focusing on functionality, sustainability, and cost-effectiveness. W ith a team of over 140 employees located in Düsseldorf, Berlin, and Hamburg, they integrate tec hnical components into buildings innovatively. We will upload 340gb of corporate data soon. Employee personal information (German passports, I Ds, addresses, phones contacts), confidential files, projects, lots of specifications and so on . ID 32097
Ransomware	Davis & Ferber id32099 View details	2026-08-25	United States	Retail / E-commerce	—	leaked
Davis & Ferber LLP is a personal injury and malpractice law firm based in New York, specializin g in various legal areas including medical malpractice, motor vehicle accidents, nursing home a buse, and family law. We will upload 60gb of corporate data soon. Detailed personal client information (passports, DL s, addresses, SSNs, death/birth certs, phones and so on for almost a thousand people), confiden tial files, court files, hearings, police reports, NDAs, etc. ID 32099
Ransomware	Bihl id32072 View details	2026-08-24	Germany	Manufacturing / Engineering	—	leaked
Boustead International Heaters (BIH) is a leading global designer and supplier of thermal proce ss equipment, including direct fired heaters, waste heat recovery units (WHRUs), and heat recov ery steam generators (HRSGs). We will upload 392gb of corporate data soon. Huge amount of detailed personal employee informat ion (passports, DLs, addresses, SSNs, death/birth certs, phones, contacts), confidential financ ials and agreements and contracts, client information, NDAs and so on. ID 32072
Ransomware	JC Sales id31966 View details	2026-08-21	United States	—	—	leaked
JC Sales is a leading full-service wholesaler based in Los Angeles, California, specializing in a vast array of wholesale products including health and beauty items, food and beverages, gene ral merchandise, and seasonal items. We will upload 206gb of corporate data soon. Detailed personal employee information (passports, DLs, addresses, phones, contacts), confidential financials, contracts and agreements, client i nformation, NDAs and so on. ID 31966
Ransomware	Cascade Coffee id31848 View details	2026-08-20	United States	—	—	leaked
Cascade Coffee is a premier gourmet coffee contract manufacturer based near Seattle, Washington , specializing in roasting, grinding, flavoring, and packaging coffee. The company caters to so me of the world's finest coffee brands, providing a wide range of products including whole bean , ground, flavored coffees, and specialty blends. We will upload corporate data soon. Detailed personal employee information (passports, DLs, add resses, phones, car information), details, financials, contracts and agreements, NDAs and so on . ID 31848
Ransomware	Deas Millwork id31854 View details	2026-08-20	—	—	—	leaked
Deas Millwork specializes in architectural design elements, offering custom millwork solutions for various projects. They focus on creating high-quality craftsmanship that serves as the cent erpiece of any design. We will upload corporate data soon. Employee personal information (passports, DLs, addresses, p hones, emails and other information), financials, contracts and agreements and so on. ID 31854
Ransomware	Ericksen Krentel id31886 View details	2026-08-19	—	—	—	leaked
Ericksen Krentel CPAs and Consultants is a New Orleans-based CPA firm offering a wide range of services including tax, accounting, audit, advisory, and consulting for both businesses and ind ividuals. Their expertise spans various industries such as construction, healthcare, hospitalit y, maritime, and nonprofit sectors. We will upload 30gb of corporate data soon. Detailed client and employee personal information ( passports, DLs, SSNs, addresses and other information), detailed financials, confidential docum ents, contracts and agreements, NDAs and so on. ID 31886
Ransomware	Borchert & LaSpina id31829 View details	2026-08-18	—	—	—	leaked
Borchert & LaSpina, P.C. is a respected law firm located in Queens, New York, with a team of si x experienced attorneys specializing in various areas of law including real estate, mortgage fo reclosure, commercial litigation, personal injury, and elder law. We will upload corporate data soon. Client personal information (lots of passports, DLs, SSNs a nd other information), financials, confidential legal files, contracts and so on. ID 31829
Ransomware	Keystops id31716 View details	2026-08-14	United States	—	—	leaked
Key Oil Company is the largest distributor of branded motor fuels for Marathon Petroleum Compan y and also holds contracts with major brands like ExxonMobil and ConocoPhillips. They provide a wide range of products including lubricants, diesel exhaust fluid, antifreeze, and various fue l delivery solutions. We will upload 15gb corporate data soon. Employee and client personal information (NAME, PASSPO RT, DL, SSN and so on), financials, payment details, contracts and agreements and so on. ID 31716
Ransomware	Cozad Asset Management id31717 View details	2026-08-14	United States	—	—	leaked
Cozad Asset Management, Inc. provides the highest quality professional and personalized financi al services and advice to individuals, families and institutional investors throughout the coun try. We will upload 13gb corporate data soon. Employee personal information (passport, DLs, SSN), fi nancials, confidential files, contracts and agreements, legal files and so on. ID 31717

‹ Prev 1 2 3 4 5 6 7 … 17 Next ›

Akira

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (2)

Top Activity Sectors (18)

Typical Attacks (29)

Tools Observed (41)

Credential theft

Defense evasion

Discovery

Discovery & enumeration

Exfiltration

Networking & tunnelling

OffSec

Offensive security tooling

RMM Tools

Remote monitoring & management

Crypto Wallets (15)

Ransom Notes (3)

Victims (1670)

Restricted Access

Now you can see the leak, not just the listing