Ransomware Group intelligence

Akira

Active

Track Akira with 1670 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 1670 Known published victims in this dataset

First discovered 2023-04-26 Earliest victim discovery date

Last discovered 2026-10-22 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 917 victims

Known locations 2 Leak or negotiation infrastructure tracked

Akira is tracked by Breach House as a ransomware group with 1670 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

1670

Leaked 744 44.6%
Pending 926 55.4%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Up checked 4m ago	`akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion`
Leak location 1	Onion service	Up checked 5m ago	`akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion`

Finance / Legal / Insurance 432
Communication / Marketing 320
Manufacturing / Engineering 182
Services 140
Construction / Real Estate 106
Not identified 78
IT 74
Healthcare / Pharma 66
Energy 41
Agriculture / Food 34
Transportation / Travel / Logistics 33
Hospitality / Food & Beverage / Tourism 33
Retail / E-commerce 32
Telecommunications 29
Education 26
Public Sector 16
NGOs / Associations 6
null 2

Typical Attacks (29)

▼

How Akira typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Akira, Akira, Akira _v2.

T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: Akira uses valid account information to remotely access victim networks, such as VPN credentials.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1133 External Remote Services Initial AccessPersistence

What they do: Akira uses compromised VPN accounts for initial access to victim networks.

What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1047 Windows Management Instrumentation Execution

What they do: Akira will leverage COM objects accessed through WMI during execution to evade detection.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.001 PowerShell Execution

What they do: Akira has used PowerShell scripts for credential harvesting and privilege escalation.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1059.003 Windows Command Shell Execution

What they do: Akira executes from the Windows command line and can take various arguments for execution.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1543 Create or Modify System Process PersistencePrivilege Escalation

What they do: Akira _v2 can create a child process for encryption.

What that means: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
T1027.001 Binary Padding Stealth

What they do: Akira has used binary padding to obfuscate payloads.

What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: Akira has used legitimate names and locations for files to evade defenses.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1480 Execution Guardrails Stealth

What they do: Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.

What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
T1685 Disable or Modify Tools Defense Impairment

What they do: Akira has disabled or modified security tools for defense evasion.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1558 Steal or Forge Kerberos Tickets Credential Access

What they do: Akira have used scripts to dump Kerberos authentication credentials.

What that means: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
T1018 Remote System Discovery Discovery

What they do: Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1057 Process Discovery Discovery

What they do: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

What that means: Adversaries may attempt to get information about running processes on a system.
T1082 System Information Discovery Discovery

What they do: Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1083 File and Directory Discovery Discovery

What they do: Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1135 Network Share Discovery Discovery

What they do: Akira can identify remote file shares for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1482 Domain Trust Discovery Discovery

What they do: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

What that means: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
T1654 Log Enumeration Discovery

What they do: Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

What that means: Adversaries may enumerate system and service logs to find useful data.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: Akira has used RDP for lateral movement.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1213.002 Sharepoint Collection

What they do: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.
T1560.001 Archive via Utility Collection

What they do: Akira uses utilities such as WinRAR to archive data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1219 Remote Access Tools Command and Control

What they do: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: Akira will exfiltrate victim data using applications such as Rclone.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: Akira encrypts files in victim environments as part of ransomware operations.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: Akira _v2 can stop running virtual machines.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: Akira will delete system volume shadow copies via PowerShell commands.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1531 Account Access Removal Impact

What they do: Akira deletes administrator accounts in victim networks prior to encryption.

What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
T1657 Financial Theft Impact

What they do: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (41)

▼

Software Akira has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

DonPAPI LaZagne Mimikatz

Defense evasion

PowerTool Zemana Anti-Rootkit driver Zemana Anti-Rootkit

Discovery

Advanced IP Scanner Masscan ReconFTW SharpHound SoftPerfect NetScan

Discovery & enumeration

Advanced IP Scanner Bloodhound ldapdomaindump Masscan ReconFTW SharpHound SharpShares SoftPerfect NetScan

Exfiltration

FileZilla MEGA RClone Temp[.]sh WinSCP

Networking & tunnelling

Cloudflared OpenSSH Ngrok

OffSec

Impacket

Offensive security tooling

CrackMapExec Impacket NetExec

RMM Tools

AnyDesk MobaXterm Radmin RustDesk

Remote monitoring & management

AnyDesk MeshAgent MobaXterm Radmin RustDesk TeamViewer

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (15)

▼

$3,991,216 Received (USD)

24 Payments

15 Known wallets

$997,459 Largest single payment

2023-07-13 → 2024-09-17 Payment window

bitcoin · 15

Address	Chain	Received (USD)	Payments
`bc1qr0pqfghr9cksfc5arr2rak3lt2y50v03pc76nh`	bitcoin	$997,461	2
`bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdaj`	bitcoin	$482,181	1
`bc1q0dx45y82r5rt36sm38jv0k4dexwc4nj9z4ryw7`	bitcoin	$446,073	2
`bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2`	bitcoin	$351,883	1
`bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6h`	bitcoin	$298,537	2
`bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24`	bitcoin	$252,389	1
`bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mc`	bitcoin	$229,395	4
`bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8`	bitcoin	$150,205	1
`bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtah`	bitcoin	$149,891	1
`bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkyd`	bitcoin	$139,534	1
`bc1qpwwtck0zhzrj56fxeayz6wz5546nlp607qzpvh`	bitcoin	$109,655	2
`bc1qghj85gz0dkr9jeucana3z4xu50ujtllj50rvj0`	bitcoin	$106,115	2

+3 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

akira_readme_3.txt txt · 3485 chars

Hi friends,

Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:

1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

6. Negotiations with Akira can only be conducted in a chat room, which you can access using the login details provided below or in the notes (a readme.txt file) in your systems. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf.

7. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme_2.txt txt · 2908 chars

Hi friends,

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme.txt txt · 2662 chars

Hi friends,

Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.

5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (1670)

Search, filter and paginate the victim timeline for Akira. Showing 901–1000 of 1670.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Southwood Financial,SWF FUNDING LLC, EduCap Inc. id19646 View details	2025-04-30	United States	Finance / Legal / Insurance	—	pending
Southwood Financial specializes in private student loan solutions and debt settlement services aimed at helping borrowers achieve financial stability. SWF FUNDING LLC and EduCap Inc. have also be en impacted and lost their data. We are going to to upload more than 370 GB of these companies. In the archives you will find the following: personal information o f employees and borrowers (SSNs, passports and so on), financial data (audits, payment details, reports), a lot of corporate NDAs, etc. ID 19646
Ransomware	Kramer Green Zuckerman Greene and Buchsbaum id19621 View details	2025-04-28	United States	Finance / Legal / Insurance	—	pending
Kramer, Green, Zuckerman, Greene & Buchsbaum, PA is a law firm in Hollywood, FL, specializing in asset protection, estate planning , corporate legal matters, and business transactions. We are going to upload more than 80 GB of essential corporate doc uments such as: personal docs of employees and clients (lots of), client financial data (audits, payment details, reports), corpor ate NDA’s, court hearings records and other numerous confidential documents. ID 19621
Ransomware	Tolerance Masters id19619 View details	2025-04-28	United States	Finance / Legal / Insurance	—	pending
Tolerance Masters company manufactures impellers and wheels in cu stom configurations to meet the exact requirements of their clien t specifications. We are going to upload 18 GB of essential corporate documents suc h as: personal information employees, a bit of customers informat ion, financial data (audits, payment details, reports), corporate NDA’s, confidentiality agreements etc. ID 19619
Ransomware	DYNAMIS Insurance id19353 View details	2025-04-25	Guatemala	Finance / Legal / Insurance	—	pending
DYNAMIS Insurance is a Greek insurance company that offers a wide range of insurance products with solid backing and the confidenc e of personal contact. We are ready to upload 25 GB of essential corporate documents suc h as: personal information of employees, information of clients, financial data (audits, payment details, reports, credit card det ails), corporate NDA’s, lots of contracts and agreements etc. ID 19353
Ransomware	J. SCHNEEBERGER Maschinen AG id19349 View details	2025-04-25	Switzerland	Manufacturing / Engineering	—	pending
J. SCHNEEBERGER Maschinen AG develops and produces the most moder n CNC grinding machines for the manufacturing and re-grinding of cutting tools and the production of a variety of precision parts. We are going to upload more than 30 GB of corporate documents suc h as: passports and identity cards of employees, financial data ( audits, payment details, reports), corporate NDA’s and confidenti ality agreements, etc. ID 19349
Ransomware	Santa Cruz Properties id19346 View details	2025-04-25	United States	Communication / Marketing	—	pending
Santa Cruz Properties company emphasizes exceptional service and personal guidance, ensuring clients navigate the buying and selli ng process smoothly. We are ready to upload 15 GB of essential corporate documents suc h as: personal information of employees, some information about c ustomers, financial data (audits, payment details, reports), nume rous contracts, corporate NDA’s, etc. ID 19346
Ransomware	Cohn Lifland Pearlman Herrmann and Knopf id19345 View details	2025-04-25	United States	Finance / Legal / Insurance	—	pending
These respected guys didn't seem to have much respect for their c lients, as a huge amount of personal information was almost unpro tected. We took 110 GB of files where a lot of client information can be found: passports, driver's licenses, birth/death certific ates, correspondence, addresses, contacts and more. There is also a lot of data about the firm in the form of financial statements and other documents, and many of them are confidential. The most interesting thing about this case is that these guys didn't want to pay even with an active cyber insurance policy. We will uploa d the files shortly. ID 19345
Ransomware	Dress To id19333 View details	2025-04-24	Brazil	Finance / Legal / Insurance	—	pending
Dress To is a women's clothing brand. We are going to to upload more than 34 GB of essential corporate documents such as: employees and customers personal files (identi ty cars, passports and so on), financial data (audits, payment de tails, reports), corporate agreements, etc. ID 19333
Ransomware	Oversea Casing id19331 View details	2025-04-24	United States	Finance / Legal / Insurance	—	pending
Oversea Casing Company has been operated for more than three gene rations and enjoys a strong working partnership with Superior Far ms, a leading purveyor of sustainably-raised American lamb, which allows them to produce high quality consistent casings. We are ready to upload corporate documents such as: information o f employees and customers, financial data (audits, payment detail s, reports), contracts, etc. ID 19331
Ransomware	Fogelman Management Group id19330 View details	2025-04-24	United States	Services	—	pending
Fogelman is a multifamily investment and property management firm . We are ready to upload than 12GB of essential corporate document. The most interesting are ~4000 files filled with personal inform ation of employees (SSN, DOB, phone, email and so on), financial data (audits, payment details, reports), corporate NDA’s, confide ntial trial documents, etc. ID 19330
Ransomware	Rayle Electric Membership Corporation id19316 View details	2025-04-23	United States	Finance / Legal / Insurance	—	pending
Rayle Electric Membership Corporation is a member-owned electric cooperative which provides electrical power to the rural areas of all or parts of ten northeast Georgia counties. We are ready to upload more than 30GB of essential corporate docu ments such as: personal information of employees, financial data (audits, payment details, reports), corporate NDA’s, confidential trial documents, etc. ID 19316
Ransomware	Diedrich Coffee id19296 View details	2025-04-22	United States	Retail / E-commerce	—	pending
Diedrich Coffee specializes in sourcing, roasting and selling the world's highest quality coffees. The company markets its three l eading brands of specialty coffees, Diedrich Coffee, Coffee Peopl e and Gloria Jeans Coffees, through office coffee service distrib utors, restaurants, and specialty retailers, and via the company' s web stores. We are ready to upload more than 15 GB of corporate documents suc h as: various files of employees and customers, financial data (a udits, payment details, reports), corporate NDA’s, confidential c ontracts, etc. ID 19296
Ransomware	Machu PicchuFoods id19285 View details	2025-04-21	Peru	Agriculture / Food	—	pending
Machu Picchu Foods provides services as a cacao ingredi ent and chocolate supplier, as well as a contract manuf acturer for private labels. You will find some essential corporate documents such a s: financial data (audits, payment details, reports), c ontact numbers and e-mail addresses of employees and cu stomers, corporate licenses, agreements and contracts, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:CBF4A123ECB9ADF4647B13B 80AACB9F700A5BE33&dn=mpf.com.pe&tr=udp://tracker.openbi ttorrent.com:80/announce&tr=udp://tracker.opentrackr.or g:1337/announce ID 19285
Ransomware	Auren part 1 id19284 View details	2025-04-21	—	Finance / Legal / Insurance	—	pending
Auren is a consulting firm for multidisciplinary servic es, whose aim is to contribute to the sustainable devel opment of society, organizations and people. You will find more than 40 GB of essential corporate do cuments such as: contact numbers and e-mail addresses o f employees and customers, financial data (audits, paym ent details, reports), corporate licenses, agreements a nd contracts, personal passports, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:8C5AF0A7AF2246DCDD8A1BE 7C1140C6AE07ECA86&dn=Auren.com part1&tr=udp://tracker.o penbittorrent.com:80/announce&tr=udp://tracker.opentrac kr.org:1337/announce ID 19284
Ransomware	Auren part 2 id19283 View details	2025-04-21	—	Finance / Legal / Insurance	—	pending
Auren is a consulting firm for multidisciplinary servic es, whose aim is to contribute to the sustainable devel opment of society, organizations and people. You will find more than 40 GB of essential corporate do cuments such as: contact numbers and e-mail addresses o f employees and customers, financial data (audits, paym ent details, reports), corporate licenses, agreements a nd contracts, personal passports, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:CC65DA01AF172D847915FE1 6A0B358D04ADD3710&dn=Auren.com part2&tr=udp://tracker.o penbittorrent.com:80/announce&tr=udp://tracker.opentrac kr.org:1337/announce ID 19283
Ransomware	ZB ZIMMERMANN UND BECKERGmbH id19282 View details	2025-04-21	Germany	Finance / Legal / Insurance	—	leaked
ZBP Zimmermann und Becker is an architecture and planni ng firm that offers engineering, planning, design, and object monitoring services. You will find more than 70 GB of essential corporate do cuments such as: pension insurance numbers, contact num bers and e-mail addresses of employees and customers, H R documents with info about family members, financial d ata (audits, payment details, reports), corporate licen ses, agreements and contracts, internal corporate corre spondences, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:E34417E983A9B436E701802 05386CC5EA77B2176&dn=zb.intern&tr=udp://tracker.openbit torrent.com:80/announce&tr=udp://tracker.opentrackr.org :1337/announce ID 19282
Ransomware	MASHBURN CONSTRUCTION id19279 View details	2025-04-21	United States	Construction / Real Estate	—	pending
Mashburn Construction is a full-service construction company prov iding construction management, design-build, preconstruction and general contracting services. We are ready to upload more than 162 GB of essential corporate do cuments such as: personal documents of employees, financial data (audits, payment details, reports), projects, a lot of confidenti al agreements, corporate NDA’s, etc. ID 19279
Ransomware	The law firm of Rochelle McCullough, L.L.P id19278 View details	2025-04-21	United States	Finance / Legal / Insurance	—	pending
The law firm of Rochelle McCullough, L.L.P. primarily focuses its practice on: matters involving corporate bankruptcy and individu als with substantial business-related obligations; assistance and counsel to financially distressed business entities and individu als with significant business-related responsibilities; commercia l and individual Chapter 11 reorganizations and creditor rights. We are ready to upload 21 GB of essential corporate documents suc h as: personal information of employees and customers, financial data of the firm and its clients (audits, payment details, report s), confidential agreements, trial documents, corporate NDA’s, et c. ID 19278
Ransomware	Bindi SpA id19277 View details	2025-04-21	Italy	Finance / Legal / Insurance	—	pending
Bindi SpA is headquartered in Italy. The Company's line of busine ss includes the manufacturing of concrete products from a combina tion of cement and aggregate. We are ready to upload 30 GB of corporate documents such as: cont act numbers and e-mail addresses of customers, financial data (au dits, payment details, reports), corporate NDA’s, employee docs, etc. ID 19277
Ransomware	TrussWorks International id19276 View details	2025-04-21	United States	Communication / Marketing	—	pending
TWI can engineer, design, fabricate, machine, paint, and pre-asse mble all aspects of your project in house, which gives us complet e control over quality, schedule, and budget. We are ready to upload more than 13 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, SSNs, phones, addresses, driver's licenses and so on. You will also find their and their clients financial data (a udits, payment details, reports), corporate NDA’s, etc. ID 19276
Ransomware	Agencia Browne y Espinoza id19252 View details	2025-04-18	Chile	Finance / Legal / Insurance	—	leaked
Agencia Browne y Espinoza is an accounting company based out of 8 12 Huérfanos, Santiago, Chile. We are ready to upload more than 37 GB of essential corporate doc uments such as: a lot of clients financial data (audits, payment details, reports), corporate NDA’s, confidential personal details , etc. ID 19252
Ransomware	Heinz Hammer Vertragswerkstatt (Mercedes-Benz car dealer) id19251 View details	2025-04-18	Germany	Finance / Legal / Insurance	—	pending
Heinz Hammer Vertragswerkstatt offers customized mobility and ser vice packages and have access to a nationwide pool of new, used M ercedes-Benz vehicles. We are ready to upload more than 40 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of customers , employee files, financial data (payment details, reports, lots of invoices), contracts containing personal data, etc. ID 19251
Ransomware	Hubbard, McIlwain, &Brakefield, P.C. id19243 View details	2025-04-18	United States	Hospitality / Food & Beverage / Tourism	—	pending
Hubbard, McIlwain, & Brakefield, P.C. is one of the most well-res pected and successful firms in Alabama. We are ready to upload more than 4 GB of data. Not much but inter esting: trial documents, a lot of client data such as financials, personal docs, etc. ID 19243
Ransomware	Tänzer GmbH id19240 View details	2025-04-18	Germany	Finance / Legal / Insurance	—	pending
Tänzer GmbH offers their customers an ever-growing range of repai r services since 1990. We are ready to upload more than 13 GB of corporate documents suc h as: information about employees and customers, a bit of persona l files, financial data, projects data,etc. ID 19240
Ransomware	Toppan Next id19239 View details	2025-04-18	Japan	Finance / Legal / Insurance	—	pending
TOPPAN NEXT empowers businesses with the confidence to safeguard high-risk digital and physical information & products. But fails ... We are ready to upload more than 12GB of essential corporate docu ments such as: personal information of employees, customers data, financial data (audits, payment details, reports, credit cards d etails), contracts and agreements, corporate NDA’s, etc. ID 19239
Ransomware	Hayward Quartz Technology id19237 View details	2025-04-18	United States	IT	—	pending
Hayward Quartz Technology started in Hayward California with a si mple goal of supporting quartz fabricators with high quality mach ined quartz products. We are ready to upload more than 50 GB of corporate documents suc h as: employee details, financial data, corporate NDA, etc. ID 19237
Ransomware	Lamberti Group id19199 View details	2025-04-16	Italy	Communication / Marketing	—	pending
The Lamberti Group produces chemical specialties for a broad rang e of applications. We are ready to upload essential corporate documents such as: det ailed financial information, employee personal information, proje cts, customers data, corporate NDA’s, etc. ID 19199
Ransomware	Dale Partners Architects id19194 View details	2025-04-16	United States	Education	—	pending
Dale \| Bailey, an Association is a joint venture of Bailey Archit ecture Education, P.A.and Dale Partners Architects P.A. The assoc iation was formed in August 2008 to create a firm with unsurpasse d experience in educational facility planning, design and constru ction. We are ready to upload over 148 GB of essential corporate documen ts such as: contact numbers and e-mail addresses of employees and partners, employee personal files, detailed financial data (audi ts, payment details, reports), corporate NDA’s, etc. ID 19194
Ransomware	Anfarm Hellas id19193 View details	2025-04-16	Greece	Agriculture / Food	—	pending
ANFARM is a manufacturer of generic pharmaceutical formulations f or human use. The company sells its products to 31 countries and acts as third party manufacturer to 45 clients. We are ready to upload more than 35 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of governmen ts(!) of a few countries like Portugal, Spain and a few others (i f somebody is interested), detailed financial data (audits, payme nt details, reports), corporate NDA’s, employee personal informat ion, clients data, etc. ID 19193
Ransomware	D'Granel id19192 View details	2025-04-16	Brazil	Transportation / Travel / Logistics	—	pending
D'Granel is a transportation company that offers logistics, fleet management, and cargo transportation services. We are ready to upload more than 40 GB of essential corporate doc uments such as: financial data (audits, payment details, reports) , lots of confidential documents, corporate NDA’s, contact number s and e-mail addresses of employees and customers etc. ID 19192
Ransomware	Heierli id19171 View details	2025-04-15	Switzerland	Finance / Legal / Insurance	—	pending
The company's activities include project planning, construction m anagement, expertise and consulting in civil engineering and its specialized fields. We are ready to upload more than 92 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports) , corporate NDA’s, etc. ID 19171
Ransomware	Bolivar Insulation id19170 View details	2025-04-15	United States	Finance / Legal / Insurance	—	pending
Bolivar Insulation serves all of southwest Missouri including the areas of Springfield, Bolivar, Branson, Joplin, Columbia and Cam denton, Missouri for gutter cleaning, repair or new gutter instal lation. We are ready to upload more than 9 GB of essential corporate docu ments such as: financial data (audits, payment details, reports), contact numbers and e-mail addresses of employees and customers, SSN’s, driver licenses, passport scans, etc. ID 19170
Ransomware	King Industries Inc. id19169 View details	2025-04-15	United States	Finance / Legal / Insurance	—	pending
King Industries, Inc. designs, manufactures, and distributes addi tives for small to large companies throughout the world who make their own branded products we all know and use like engine oils, greases, hydraulic oils, paints, coatings, and rubber goods. We are ready to upload more than 260 GB of essential corporate do cuments such as: corporate NDA’s, passport scans, medical documen ts, contact numbers and e-mail addresses of employees and custome rs, financial data (audits, payment details, reports), etc. ID 19169
Ransomware	PEÑA BRIONES MCDANIEL & CO. id19168 View details	2025-04-15	United States	Finance / Legal / Insurance	—	pending
PEÑA BRIONES MCDANIEL & CO. offers a wide range of accounting, ta x, assurance, and consulting services across Texas and New Mexico . Their clientele includes individuals, non-profits, governments, financial institutions, and businesses from various industries. We are ready to upload more than 34 GB of essential corporate doc uments such as: marriage licenses, corporate licenses, agreements and contracts, personal passport scans, driver licenses, contact numbers and e-mail addresses of employees and customers, financi al data (audits, payment details, reports), etc. ID 19168
Ransomware	Inductors Inc. id19167 View details	2025-04-15	United States	Finance / Legal / Insurance	—	pending
Inductors Inc. is the premier franchised distributor of inductive components specializing in power and RF products. We are ready to upload more than 6 GB of essential corporate docu ments such as: corporate NDA’s, corporate licenses, agreements an d contracts, financial data (audits, payment details, reports), i nsurance documents, etc. ID 19167
Ransomware	Caputo id19151 View details	2025-04-14	Italy	Finance / Legal / Insurance	—	pending
The firm assists businesses in small business accounting, tax pre paration, strategic business planning, part-time Chief Financial Officer Services, and assistance in loan proposal preparation to banks among others. We are ready to upload more than 20 GB of essential corporate doc uments such as: corporate NDA’s, personal SSN’s, internal corpora te correspondence, contact numbers and e-mail addresses of employ ees and customers, driver licenses, corporate licenses, agreement s and contracts, financial data (audits, payment details, reports ), etc. ID 19151
Ransomware	Agricola Da Quinta De Corona id19149 View details	2025-04-14	Portugal	Agriculture / Food	—	pending
Companhia Agricola da Quinta de Corona has its headquarters in Li sbon. Its main activity is forestry. We are ready to upload more than 38 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, corporate licenses, agreements and contracts, emp loyee passports, etc. ID 19149
Ransomware	STUMPF MÜLLER Biberach id19148 View details	2025-04-14	Germany	IT	—	pending
The company rents and leases tools and equipment in the areas of sanitation, heating, control and control technology. We are ready to upload some of essential corporate documents such as: contact numbers and e-mail addresses of employees and custom ers, corporate licenses, agreements and contracts, etc. ID 19148
Ransomware	Oklahoma Steel & Wire id19147 View details	2025-04-14	United States	Manufacturing / Engineering	—	pending
Oklahoma Steel & Wire Co Inc. offers a complete line in both agri cultural and industrial wire products. We are ready to upload more than 129 GB of essential corporate do cuments such as: corporate licenses, agreements and contracts, co ntact numbers and e-mail addresses of employees and customers, fi nancial data (audits, payment details, reports), etc. ID 19147
Ransomware	All4Labels -Global Packaging Group id19111 View details	2025-04-12	Germany	Communication / Marketing	—	pending
All4Labels, headquartered in Hamburg, is one of the wor ld’s top label manufacturers and the leading provider o f digital printing solutions with a specialization on t he home and personal care as well as food & beverage ma rkets. You will find more than 192 GB of essential corporate d ocuments such as: financial data (audits, payment detai ls, reports), contact numbers and e-mail addresses of e mployees and customers, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:[redacted] 0DD0181057CC32D04&dn=all4labels.com.br&tr=udp://tracker .openbittorrent.com:80/announce&tr=udp://tracker.opentr ackr.org:1337/announce ID 19111
Ransomware	City Plumbing & ElectricSupply Co. id19107 View details	2025-04-12	United States	Public Sector	—	leaked
North Georgia's largest wholesale distributor or plumbi ng & electrical products. You will find more than 77 GB of essential corporate do cuments such as: contact numbers and e-mail addresses o f employees and customers, financial data (audits, paym ent details, reports), confidential licenses, agreement s and contracts, etc. We have made the process of downloading company data as simple as possible for our users. All you need is any torrent client (like Vuze, Utorrent, qBittorrent or Tra nsmission to use magnet links). You will find the torre nt file above. 1. Open uTorrent, or any another torrent client. 2. Add torrent file or paste the magnet URL to upload t he data safely. 3. Archives have no password. MAGNET URL: magnet:?xt=urn:btih:[redacted] FAAC169E8E4C109A5&dn=cpesupply.com&tr=udp://tracker.ope nbittorrent.com:80/announce&tr=udp://tracker.opentrackr .org:1337/announce ID 19107
Ransomware	Batesville Products,Inc. id19099 View details	2025-04-11	United States	Communication / Marketing	—	pending
BPI is a full-service, custom aluminum casting supplier headquart ered in Lawrenceburg, IN. We are ready to upload more than 7 GB of essential corporate docu ments such as: contact numbers and e-mail addresses of employees and customers, corporate NDA’s, financial data (audits, payment d etails, reports), corporate licenses, agreements and contracts, p ersonal SSN’s, etc. ID 19099
Ransomware	SeproTec Multilingual Solutions id19080 View details	2025-04-10	Spain	Communication / Marketing	—	pending
Seprotec offers top-notch translation, localization and interpret ation services for every business unit or functional area in 220 languages. In addition, they offer intellectual property managem ent services to reduce complexity and cost in IP Management. We are ready to upload a lot of essential corporate documents suc h as: corporate NDA’s, personal SSN’s, corporate licenses, agreem ents and contracts, medical documents and certificates, financial data (audits, payment details, reports), contact numbers and e-m ail addresses of employees and customers, etc. ID 19080
Ransomware	Dumont Telephone id19070 View details	2025-04-09	United States	IT	—	pending
Dumont Telephone is a proven leader in technology and a proud sup porter of regional economic development. We give our customers sm all-town service with products that rival big-time tech companies , including broadband internet, streaming video, telephone, and b usiness services. We are ready to upload more than 6 GB of essential corporate docu ments such as: financial data (audits, payment details, reports), insurance documents, corporate licenses, agreements and contract s, personal SSN’s, etc. ID 19070
Ransomware	Simms Sigal Linwood Inc. id19060 View details	2025-04-09	United States	Finance / Legal / Insurance	—	pending
Representing brands from all reaches of the world Simms Sigal Lin wood Inc. is one of the leading and most trusted importers and di stributors in the indusrty. We are ready to upload a lot of essential corporate documents suc h as: contact numbers and e-mail addresses of employees and custo mers, financial data (audits, payment details, reports), etc. ID 19060
Ransomware	Hotell Euroopa id19059 View details	2025-04-09	Estonia	Hospitality / Food & Beverage / Tourism	—	pending
Hestia Hotel Group OU is an enterprise located in Estonia, with t he main office in Tallinn. It operates in the All Other Business Support Services industry. We are ready to upload more than 12 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, corporate licenses, agreements and contracts, fin ancial data (audits, payment details, reports), etc. ID 19059
Ransomware	Consonic id19058 View details	2025-04-09	Australia	Communication / Marketing	—	pending
Consonic has a proud 50 year history of providing engineering sol utions to the Australian and New Zealand Automotive, Plastic Proc essing, Packaging, Food Processing and Medical industries. We are ready to upload more than 26 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, internal corporate correspondences, financial dat a (audits, payment details, reports), etc. ID 19058
Ransomware	Bauer-Walser AG id19041 View details	2025-04-08	Switzerland	Finance / Legal / Insurance	—	pending
Bauer Walser AG is a leading company in the precious metals indus try with a 100-year history of success. We are ready to upload more than 50 GB of essential corporate doc uments such as: corporate NDA’s, contact numbers and e-mail addre sses of employees and customers, financial data (audits, payment details, reports), corporate licenses, agreements and contracts, etc. ID 19041
Ransomware	The Fullerton Hotelsand Resorts id19037 View details	2025-04-08	Singapore	Hospitality / Food & Beverage / Tourism	—	pending
The Fullerton Hotels and Resorts owns and operates four propertie s in the Asia-Pacific, with three award-winning hotels in the pri me Central Business District locations of Singapore and Sydney, a s well as a luxury oceanfront resort in Hong Kong. We are ready to upload more than 148 GB of essential corporate do cuments such as: NDA’s and corporate licenses, agreements and con tracts, driver licenses, passports and other employee and custome r documents, financial data (audits, payment details, reports), e tc. ID 19037
Ransomware	TIME Group id19020 View details	2025-04-07	Italy	Finance / Legal / Insurance	—	pending
TIME develops and installs BMS, an ERP system and with both high- level technological and application features, to meet the market needs of Italian SMEs in production and business process manageme nt/monitoring. We are ready to upload a lot of essential corporate documents suc h as: financial data (audits, payment details, reports), employee HR documents, contact numbers and e-mail addresses of employees and customers, etc. ID 19020
Ransomware	ASOLO DOLCE SAS id19019 View details	2025-04-07	Italy	Communication / Marketing	—	pending
Asolo Dolce Spa operates within the Production of rusks and biscu its; production of preserved pastry products industry. It was inc orporated in 2006. Its headquarters are located at Via Enrico Fer mi 51 Asolo Veneto 31011. We are ready to upload more than 17 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports) , etc. ID 19019
Ransomware	SMYK id19018 View details	2025-04-07	Poland	Finance / Legal / Insurance	—	pending
SMYK stores offer a wide selection of clothing and footwear, toys , baby accessories and other products for children aged 0-14. The SMYK chain’s advantage is the availability of a multitude of pro ducts of various categories for children aged 0-14 “under one roo f”. We are ready to upload more than 28 GB of essential corporate doc uments such as: corporate NDA’s, corporate licenses, agreements a nd contracts, financial data (audits, payment details, reports), contact numbers and e-mail addresses of employees and customers, etc. ID 19018
Ransomware	DELOPT id18959 View details	2025-04-04	India	Finance / Legal / Insurance	—	pending
DELOPT is a world-class Company in the area of Defence Electronic s & Electro-Optics and solutions for Retail market with In-Store Technology. We are ready to upload more than 70 GB of essential corporate doc uments such as: corporate NDA’s, contact numbers and e-mail addre sses of employees and customers, corporate licenses, agreements a nd contracts, financial data (audits, payment details, reports), passports and other employee and customer documents, etc. ID 18959
Ransomware	AWM Alliance Real Estate Group Ltd. id18957 View details	2025-04-04	Canada	Construction / Real Estate	—	pending
AWM-Alliance Real Estate Group Ltd. provides highly disciplined p roperty management, leasing and sales services for all types of r eal estate. We are ready to upload more than 67 GB of essential corporate doc uments such as: internal corporate correspondence, financial data (audits, payment details, reports), contact numbers and e-mail a ddresses of employees and customers, HR documents, passports and other employee and customer documents, etc. ID 18957
Ransomware	RORZE Technology Inc. id18956 View details	2025-04-04	Taiwan, Province of China	IT	—	pending
Well-known throughout the global semi-conductor industry, Japan’s number 1 wafer handling solutions provider RORZE Corporation has now set-up a subsidiary in Taiwan. We are ready to upload some of essential corporate documents such as: financial data (audits, payment details, reports), contact n umbers and e-mail addresses of employees and customers, etc. ID 18956
Ransomware	Parker Fabrication, Inc id18953 View details	2025-04-04	United States	Manufacturing / Engineering	—	pending
Parker Fabrication, Inc.'s Manufacturing & Engineering techniques are able to produce the utmost in service, customized applicatio ns, & design for any Metal project. We are ready to upload some essential corporate documents such as : financial data (audits, payment details, reports), internal cor porate correspondences, etc. ID 18953
Ransomware	Henna Chevrolet id18952 View details	2025-04-04	United States	Finance / Legal / Insurance	—	pending
Henna Chevrolet, part of the Henna Motor Co., has been proudly se rving Austin, Texas, motorists for more than seven decades, and w e look forward to continuing to provide our customers with the sa me unsurpassed level of care that they've come to expect from the Henna name. We are ready to upload more than 43 GB of essential corporate doc uments such as: driver licenses, financial data (audits, payment details, reports), contact numbers and e-mail addresses of employ ees and customers, personal SSN’s, etc. ID 18952
Ransomware	Gem-Dandy Accessories id18936 View details	2025-04-03	United States	Finance / Legal / Insurance	—	pending
Gem-Dandy is one of the country's leading belt & accessory compan ies servicing retailers across the globe since 1921. We are ready to upload more than 75 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports) , etc. ID 18936
Ransomware	Fuller Metric Parts id18935 View details	2025-04-03	Canada	Manufacturing / Engineering	—	pending
Fuller Fasteners has been operating since 1976, providing an exte nsive inventory of metric and inch fasteners in Surrey, BC, Missi ssauga, ON, and Shanghai warehouses. We are ready to upload more than 8 GB of essential corporate docu ments such as: HR documents, financial data (audits, payment deta ils, reports), contact numbers and e-mail addresses of employees and customers, internal corporate correspondences, etc. ID 18935
Ransomware	AKIRA TEAM is back in touch with you. id18928 View details	2025-04-02	—	Retail / E-commerce	—	pending
AKIRA TEAM is a ransomware-as-a-service group that emerged in March 2023, specializing in double extortion tactics that steal critical data before encrypting systems. The group primarily targets businesses in North America, with a focus on sectors including academe, professional services, construction, and materials, though Retail and E-commerce are also vulnerable. AKIRA TEAM gains access using compromised credentials or exploited VPN vulnerabilities, then exfiltrates data to leverage for ransom demands ranging from $200,000 to over $4 million. It was listed as a ransomware victim associated with Akira. ID 18928
Ransomware	Taking stock of March 2025 id18915 View details	2025-04-02	—	Communication / Marketing	—	pending
Our team was able to breach the IT defenses of a huge number of c ompanies. Among them are: \| csur.net \| alghisi.net \| minoas.gr \| grandimolini.it \| transpor tescarvalho.com.br \| cesaroni.com \| Everyone who agreed to cooperate with us did not appear on this l ist. The data of the others have been made publicly available or disclosed here. We always act honestly and try not to disclose the fact of data l eakage until the very last moment. Therefore, it is in your best interest not to be on this list and contact us immediately. ID 18915
Ransomware	Socarpor id18914 View details	2025-04-02	Portugal	Finance / Legal / Insurance	—	pending
Socarpor, as Porto de Aveiro, is a company that has been operatin g in the Port of Aveiro since 1984, offering a wide range of serv ices related to goods transported by sea, such as loading/unloadi ng, warehousing, distribution and logistics. We are ready to upload a lot of essential corporate documents suc h as: passports and other employee and customer documents, intern al corporate correspondences, corporate licenses, agreements and contracts, financial data (audits, payment details, reports), con tact numbers and e-mail addresses of employees and customers, etc . ID 18914
Ransomware	Naza TTDI Sdn Bhd id18913 View details	2025-04-02	Malaysia	Finance / Legal / Insurance	—	pending
The company established its foothold in the industry through the development of notable townships and buildings. These development s which are centred around Klang Valley includes the 662-acre Tam an Tun Dr Ismail, TTDI Alam Impian, Stadium Malawati, Masjid Al-I khlas, and TTDI Jaya. We are ready to upload a lot of essential corporate documents suc h as: corporate NDA’s, employee passport numbers, corporate licen ses, agreements and contracts, contact numbers and e-mail address es of employees and customers, financial data (audits, payment de tails, reports), etc. ID 18913
Ransomware	Mikado Publicis id18912 View details	2025-04-02	Luxembourg	Public Sector	—	pending
Mikado Publicis is a Communication Agency specialized in Advertis ing, Brand Content, Media, Digital, Design and OOH. We are ready to upload more than 15 GB of essential corporate doc uments such as: corporate NDA’s, HR documents, contact numbers an d e-mail addresses of employees and customers, corporate licenses , agreements and contracts, financial data (audits, payment detai ls, reports), etc. ID 18912
Ransomware	Entech Sales & Service, LLC id18911 View details	2025-04-02	United States	IT	—	pending
The company's services offer expertise in areas like building aut omation, card access systems, chemical water treatment, rental he ating, ventilation, air conditioning, generator equipment, and ot her commercial support. We are ready to upload more than 174 GB of essential corporate do cuments such as: corporate NDA’s, financial data (audits, payment details, reports), contact numbers and e-mail addresses of emplo yees and customers, etc. ID 18911
Ransomware	Prima Power id18910 View details	2025-04-02	Italy	Communication / Marketing	—	pending
Prima Power provides businesses of all sizes with targeted dynami c technologies that enhance profitability in sheet metal working. We are ready to upload a lot of essential corporate documents suc h as: corporate NDA’s, financial data (audits, payment details, r eports), etc. ID 18910
Ransomware	Bamar Plastics, Inc. id18896 View details	2025-04-01	United States	Manufacturing / Engineering	—	leaked
Bamar Plastics, Inc. is a custom injection molding company specia lizing in the production of precision parts in thermoplastic engi neering resins for customers who require high quality coupled wit h maximum cost effectiveness. We are ready to upload more than 27 GB of essential corporate doc uments such as: personal SSN’s, corporate NDA’s, financial data ( audits, payment details, reports), driver licenses, internal corr espondences, contact numbers and e-mail addresses of employees an d customers, HR documents, etc. ID 18896
Ransomware	Mercury Integrated Manufacturing id18895 View details	2025-04-01	Canada	Manufacturing / Engineering	—	pending
Mercury Corporation is a large manufacturing company that produce s your parts using print technology. They deal primarily with met al products, as well as medium and large plastic products, and ha ve in-house capabilities to create a product from design to compl etion. We are ready to upload more than 73 GB of essential corporate doc uments such as: internal corporate correspondences, financial dat a (audits, payment details, reports), insurance documents, corpor ate licenses, agreements and contracts, corporate NDA’s, personal passports, driver licenses and SSN’s, contact numbers and e-mail addresses of employees and customers, etc. ID 18895
Ransomware	Regency Outdoor Advertising id18872 View details	2025-03-31	United States	Communication / Marketing	—	pending
Regency Outdoor: The Force Behind Billboard Advertising in the En tertainment Capital of the World. We are ready to upload a lo of essential corporate documents such as: contact numbers and e-mail addresses of employees and custom ers, financial data (audits, payment details, reports), corporate licenses, agreements and contracts, internal corporate correspon dence, etc. ID 18872
Ransomware	Hartmann Stanyak Bürosysteme id18851 View details	2025-03-31	Germany	Services	—	pending
Hartmann Stanyak Bürosysteme provides system solutions for office environments. The company offers services including consulting, needs planning, scenario development, systems, training, and serv ice We are ready to upload a lot of essential corporate documents suc h as: contact numbers and e-mail addresses of employees and custo mers, financial data (audits, payment details, reports), corporat e licenses, agreements and contracts, personal SSN’s, etc. ID 18851
Ransomware	REPROHAUS Corp id18849 View details	2025-03-31	United States	Communication / Marketing	—	leaked
Pioneers in signage and printing, focused on every detail from de sign and fabrication to installation and management. We are ready to upload more than 16 GB of essential corporate doc uments such as: corporate NDA’s, driver licenses, personal SSN’s and passports, financial data (audits, payment details, reports), etc. ID 18849
Ransomware	Virserius Studio id18848 View details	2025-03-31	United States	Construction / Real Estate	—	pending
Virserius Studio is an interior architecture & lifestyle design f irm with offices in New York and Paris. We are ready to upload more than 18 GB of essential corporate doc uments such as: corporate NDA’s, corporate licenses, agreements a nd contracts, contact numbers and e-mail addresses of employees a nd customers, etc. ID 18848
Ransomware	Ste Group Key Corp id18847 View details	2025-03-31	Spain	Healthcare / Pharma	—	pending
Excellence, technology, and rigor driving innovative solutions in pharmaceutical engineering and healthcare We are ready to upload more than 30 GB of essential corporate doc uments such as: corporate NDA’s, financial data (audits, payment details, reports), contact numbers and e-mail addresses of employ ees and customers, etc. ID 18847
Ransomware	Superior Forge & Steel id18761 View details	2025-03-28	United States	Manufacturing / Engineering	—	pending
SFS is a fully integrated alloy steel product manufacturer from s crap selection for melting through finishing. The primary product is forged and hardened rolls for hot and cold rolling of ferrous and nonferrous metals. We are ready to upload more than 22 GB of essential corporate doc uments such as: corporate NDA’s, medical documents, internal corp orate correspondences, HR documents, contact numbers and e-mail a ddresses of employees and customers, financial data (audits, paym ent details, reports), etc. ID 18761
Ransomware	S.S. White id18760 View details	2025-03-28	United States	IT	—	pending
S.S. White leads the world in Flexible Shaft technology and innov ation. They are known throughout the world for having the best pe rforming, highest quality Flexible Shafts. We are ready to upload more than 50 GB of essential corporate doc uments such as: HR documents, corporate licenses, agreements and contracts, family contact information, driver licenses, contact n umbers and e-mail addresses of employees and customers, etc. ID 18760
Ransomware	Kaspar Companies id18758 View details	2025-03-28	United States	Finance / Legal / Insurance	—	pending
Kaspar Companies is a building material provider company. We are ready to upload more than 200 GB of databases and essentia l corporate documents such as: financial data (audits, payment de tails, reports), corporate licenses, agreements and contracts, dr iver licenses, etc. ID 18758
Ransomware	UNITED OPTICS GmbH id18756 View details	2025-03-28	Germany	Finance / Legal / Insurance	—	pending
UNITED OPTICS is the chain of specialist opticians in Austria and Germany. Founded in 1993, the network already comprises 36 leadi ng companies with 90 locations throughout Austria and Germany. We are ready to upload a lot of essential corporate documents suc h as: contact numbers and e-mail addresses of employees and custo mers, medical documents, financial data (audits, payment details, reports), etc. ID 18756
Ransomware	Manning Materials Corp. id18747 View details	2025-03-27	United States	Finance / Legal / Insurance	—	pending
As a single source supplier of Exterior Insulation Finish Systems (EIFS), Stucco, Stucco Components, and Insulated Concrete Forms (ICF) products, Manning Materials has earned a reputation for out standing quality building materials, along with concentrated expe rtise and exceptional service. We are ready to upload more than 25 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, driver licenses, financial data (audits, payment details, reports), corporate licenses, agreements and contracts, etc. ID 18747
Ransomware	NAI Earle Furman id18745 View details	2025-03-27	United States	Finance / Legal / Insurance	—	pending
NAI Earle Furman, LLC specialize in the office, industrial, retai l, land, multifamily, and investment sectors and offer a wide ran ge of services including sales, leasing, development, site select ion, consulting, and property management. We are ready to upload more than 64 GB of essential corporate doc uments such as: corporate confidential licenses, NDA’s, agreement s and contracts, personal SSN’s, driver licenses, financial data (audits, payment details, reports), contact numbers and e-mail ad dresses of employees and customers, etc. ID 18745
Ransomware	REIMERS FURNITURE MFG INC id18742 View details	2025-03-27	United States	Services		pending
RFM seating create chairs that are customizable, long lasting, an d available for all body types so that every customer finds a cha ir that truly fits them. We are ready to upload more than 58 GB of essential corporate doc uments such as: corporate licenses, agreements and contracts, cor porate NDA’s, resident cards, driver licenses, personal SSN’s, co ntact numbers and e-mail addresses of employees and customers, HR documents, family member informations, etc. ID 18742
Ransomware	Hansa Solutions id18732 View details	2025-03-26	Latvia	Services	—	pending
Hansa offers core end-to-end software solutions for the Insurance and Reinsurance markets. We are ready to upload a lot of essential corporate documents suc h as: passports and other employee and customer documents, contac t numbers and e-mail addresses of employees and customers, studen t transfer certificates and examination forms, etc. ID 18732
Ransomware	TOGA id18731 View details	2025-03-26	Australia	Construction / Real Estate	—	pending
TOGA real estate development company that specializes in resident ial, commercial, hotel, and retail projects. We are ready to upload more than 530 GB of essential corporate do cuments such as: financial data (audits, payment details, reports ), contact numbers and e-mail addresses of employees and customer s, many database files, etc. ID 18731
Ransomware	Helbor id18730 View details	2025-03-26	Brazil	Construction / Real Estate	—	pending
Helbor is one of the largest real estate developers in Brazil. It s activities are recognized through its strong presence in the me tropolitan region of São Paulo, home to more than 21 million peop le. We are ready to upload more than 54GB of essential corporate docu ments such as: corporate NDA’s, internal correspondence, financia l data (audits, payment details, reports), corporate licenses, ag reements and contracts, contact numbers and e-mail addresses of e mployees and customers, etc. ID 18730
Ransomware	Monette Barakett id18729 View details	2025-03-26	Canada	Finance / Legal / Insurance	—	pending
Monette Barakett is a legal firm that provides services regarding labor law, civil law and public law. We are ready to upload a lot of essential corporate documents suc h as: passports and other employee and customer documents, contac t numbers and e-mail addresses of employees and customers, financ ial data (audits, payment details, reports), etc. ID 18729
Ransomware	Plaza Brasília Hotéis id18700 View details	2025-03-25	Brazil	Finance / Legal / Insurance	—	pending
The Brasília Palace Hotel was the first building inaugurated in B rasília when it opened its doors in 1958. It was the first large hotel in the city, with 13,000 square meters and the capacity to accommodate up to 350 people. We are ready to upload more than 250 GB of essential corporate do cuments such as: personal passports and other employee and custom er documents, contact numbers and e-mail addresses of employees a nd customers, financial data (audits, payment details, reports), corporate licenses, agreements and contracts, etc. ID 18700
Ransomware	AAYLEX ONE S.A. id18699 View details	2025-03-25	Romania	Healthcare / Pharma	—	pending
At Cocorico, we aim to raise the most natural, healthiest and bes t tasting chicken. We are ready to upload more than 19 GB of essential corporate doc uments such as: corporate licenses, agreements and contracts (inc luding corporate NDA’s), contact numbers and e-mail addresses of employees and customers, employees medical documents, etc. ID 18699
Ransomware	Primex Farms LLC id18686 View details	2025-03-25	United States	Agriculture / Food	—	pending
Primex Farms is a manufacturer of nuts and dried fruits. We are ready to upload more than 25 GB of essential corporate doc uments such as: corporate NDA’s, personal driver license scans, p assports and other employee and customer documents, financial dat a (audits, payment details, reports), corporate licenses, agreeme nts and contracts, etc. ID 18686
Ransomware	CS Plastics id18573 View details	2025-03-21	Belgium	Manufacturing / Engineering	—	pending
CS Plastics specializes in manufacturing machines and equipment f or the plastic processing sector. We are ready to upload a lot of essential corporate documents suc h as: driver licenses, financial data (audits, payment details, r eports), internal corporate correspondences, contact numbers and e-mail addresses of employees and customers, etc. ID 18573
Ransomware	Land Planners id18545 View details	2025-03-20	United States	Finance / Legal / Insurance	—	pending
Land Planners PC is a company that operates in the Architecture, Engineering & Design industry with HQ in Georgia. We are ready to upload more than 13 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, personal passports, SSN’s, employment authorizati ons and driver licenses, HR documents, financial data (audits, pa yment details, reports), etc. ID 18545
Ransomware	Auren id18544 View details	2025-03-20	Spain	Finance / Legal / Insurance	—	pending
Auren is a consulting firm for multidisciplinary services, whose aim is to contribute to the sustainable development of society, o rganizations and people. We are ready to upload more than 40 GB of essential corporate doc uments such as: contact numbers and e-mail addresses of employees and customers, financial data (audits, payment details, reports) , corporate licenses, agreements and contracts, personal passport s, etc. ID 18544
Ransomware	ZB ZIMMERMANN UND BECKER GmbH id18538 View details	2025-03-20	Germany	Finance / Legal / Insurance	—	pending
ZBP Zimmermann und Becker is an architecture and planning firm th at offers engineering, planning, design, and object monitoring se rvices. We are ready to upload more than 70 GB of essential corporate doc uments such as: pension insurance numbers, contact numbers and e- mail addresses of employees and customers, HR documents with info about family members, financial data (audits, payment details, r eports), corporate licenses, agreements and contracts, internal c orporate correspondences, etc. ID 18538
Ransomware	The Ely Company, Inc. id18521 View details	2025-03-19	United States	Manufacturing / Engineering	—	leaked
The Ely Company, Inc. has a solid foundation of over 50 years exp erience with the manufacturing and productions of quality machine d parts for Commercial and Aerospace Industries. We are ready to upload more than 14 GB of essential corporate doc uments such as: financial data (audits, payment details, reports) , corporate licenses, agreements and contracts, healthcare docume nts, personal SSN’s, contact numbers and e-mail addresses of empl oyees and customers, etc. ID 18521
Ransomware	Machu Picchu Foods id18520 View details	2025-03-19	Peru	Agriculture / Food	—	pending
Machu Picchu Foods provides services as a cacao ingredient and ch ocolate supplier, as well as a contract manufacturer for private labels. We are ready to upload some essential corporate documents such as : financial data (audits, payment details, reports), contact numb ers and e-mail addresses of employees and customers, corporate li censes, agreements and contracts, etc. ID 18520
Ransomware	LINC Systems id18519 View details	2025-03-19	United States	Finance / Legal / Insurance	—	pending
LINC Systems is a leading distributor of fastening solutions and industrial supplies. We are ready to upload mor4e than 11 GB of essential corporate do cuments such as: contact numbers and e-mail addresses of employee s, vendors and customers, financial data (audits, payment details , reports), corporate licenses, agreements and contracts, etc. ID 18519
Ransomware	VEST LLC id18518 View details	2025-03-19	United States	Finance / Legal / Insurance	—	pending
Vest LLC is one of the largest producers of electric welded carbo n steel tubing in the Western United States. They are located in the heavy industrial neighborhood of Los Angeles named Vernon. We are ready to upload more than 125 GB of essential corporate do cuments such as: corporate NDA’s, financial data (audits, payment details, reports), HR documents, driver license information, con tact numbers and e-mail addresses of employees and customers, per sonal SSN’s, etc. ID 18518
Ransomware	JAMEL CONTAINERS LLC id18494 View details	2025-03-18	United States	Finance / Legal / Insurance	—	pending
JAMEL CONTAINERS specialize in custom corrugated packaging, custo m printing & die-cuts, custom design services, and fulfillment fo r industries including manufacturing goods, health products, and foods. We are ready to upload a lot of essential corporate documents suc h as: corporate NDA’s, driver licenses, contact numbers and e-mai l addresses of employees and customers, financial data (audits, p ayment details, reports), etc. ID 18494
Ransomware	SAGETRA INC. id18490 View details	2025-03-18	Canada	Communication / Marketing	—	pending
SAGETRA Inc. is committed to providing unique, high quality kitch en products to professional cooks and food service companies thro ughout Canada and the United States. We are ready to upload a lot of essential corporate documents suc h as: employee driver licenses, passport scans, contact numbers a nd e-mail addresses of employees and customers, financial data (a udits, payment details, reports), etc. ID 18490
Ransomware	Solist id18468 View details	2025-03-17	Canada	Communication / Marketing	—	pending
Solist Technologies specializes in IP telephony, telephone system s, and sensory ambiance solutions since 1995. Their product offer ings include structured cabling, service plans, and a proprietary solution called Sol Messager. Our team was able to breach Solist's IT defenses. We always act with integrity and try not to disclose the data bre ach until the very last moment. Therefore, it is in your best int erest to stay off this list and contact us immediately. ID 18468
Ransomware	PIBOR ISO SA id18463 View details	2025-03-17	Switzerland	Finance / Legal / Insurance	—	pending
With over fifty professions, all dedicated to design and manufact uring, Pibor ISO SA is one of the leaders in the precision watch components sector. We are ready to upload more than 32 GB of essential corporate doc uments such as: financial data (audits, payment details, reports) , contact numbers and e-mail addresses of employees and customers , internal corporate correspondences, corporate licenses, agreeme nts and contracts, etc. ID 18463
Ransomware	Domina Entrega Total id18421 View details	2025-03-14	Colombia	Transportation / Travel / Logistics	—	pending
Domina Entrega Total a company based on security and trust, offer ing specialized services in Logistics , Digital and BPO. We are ready to upload more than 28 GB of essential corporate doc uments such as: corporate NDA’s, contact numbers and e-mail addre sses of employees and customers, corporate licenses, agreements a nd contracts, internal corporate correspondences, passports and o ther employee and customer documents, etc. ID 18421

‹ Prev 1 … 7 8 9 10 11 12 13 … 17 Next ›

Akira

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (2)

Top Activity Sectors (18)

Typical Attacks (29)

Tools Observed (41)

Credential theft

Defense evasion

Discovery

Discovery & enumeration

Exfiltration

Networking & tunnelling

OffSec

Offensive security tooling

RMM Tools

Remote monitoring & management

Crypto Wallets (15)

Ransom Notes (3)

Victims (1670)

Restricted Access

Now you can see the leak, not just the listing