Ransomware Group intelligence

Akira

Active

Track Akira with 1670 published victims and 2 known leak locations in a single intelligence view.

BREACH HOUSE ALERTS

Want an alert every time a new ransomware post is published?

Choose the feeds and the countries you care about — we email you when they move.

Victims 1670 Known published victims in this dataset

First discovered 2023-04-26 Earliest victim discovery date

Last discovered 2026-10-22 Latest victim discovery date

Inactive since 1 days Days since the latest known victim

Top country United States 917 victims

Known locations 2 Leak or negotiation infrastructure tracked

Akira is tracked by Breach House as a ransomware group with 1670 published victims.

United States is currently the most targeted country in this dataset.

2 known leak locations are currently associated with this group.

1670

Leaked 744 44.6%
Pending 926 55.4%
Deleted 0 0.0%

Top Countries

Distribution

Label	Type	Availability	Links
Leak location 2	Onion service	Up checked 4m ago	`akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion`
Leak location 1	Onion service	Up checked 5m ago	`akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion`

Finance / Legal / Insurance 432
Communication / Marketing 320
Manufacturing / Engineering 182
Services 140
Construction / Real Estate 106
Not identified 78
IT 74
Healthcare / Pharma 66
Energy 41
Agriculture / Food 34
Transportation / Travel / Logistics 33
Hospitality / Food & Beverage / Tourism 33
Retail / E-commerce 32
Telecommunications 29
Education 26
Public Sector 16
NGOs / Associations 6
null 2

Typical Attacks (29)

▼

How Akira typically operates, as attributed by MITRE ATT&CK v20.0. Attributed via Akira, Akira, Akira _v2.

T1078 Valid Accounts Initial AccessPersistencePrivilege EscalationStealth

What they do: Akira uses valid account information to remotely access victim networks, such as VPN credentials.

What that means: Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
T1133 External Remote Services Initial AccessPersistence

What they do: Akira uses compromised VPN accounts for initial access to victim networks.

What that means: Adversaries may leverage external-facing remote services to initially access and/or persist within a network.
T1047 Windows Management Instrumentation Execution

What they do: Akira will leverage COM objects accessed through WMI during execution to evade detection.

What that means: Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads.
T1059.001 PowerShell Execution

What they do: Akira has used PowerShell scripts for credential harvesting and privilege escalation.

What that means: Adversaries may abuse PowerShell commands and scripts for execution.
T1059.003 Windows Command Shell Execution

What they do: Akira executes from the Windows command line and can take various arguments for execution.

What that means: Adversaries may abuse the Windows command shell for execution.
T1106 Native API Execution

What they do: Akira executes native Windows functions such as GetFileAttributesW and `GetSystemInfo`.

What that means: Adversaries may interact with the native OS application programming interface (API) to execute behaviors.
T1543 Create or Modify System Process PersistencePrivilege Escalation

What they do: Akira _v2 can create a child process for encryption.

What that means: Adversaries may create or modify system-level processes to repeatedly execute malicious payloads as part of persistence.
T1027.001 Binary Padding Stealth

What they do: Akira has used binary padding to obfuscate payloads.

What that means: Adversaries may use binary padding to add junk data and change the on-disk representation of malware.
T1036.005 Match Legitimate Resource Name or Location Stealth

What they do: Akira has used legitimate names and locations for files to evade defenses.

What that means: Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
T1480 Execution Guardrails Stealth

What they do: Akira _v2 will fail to execute if the targeted `/vmfs/volumes/` path does not exist or is not defined.

What that means: Adversaries may use execution guardrails to constrain execution or actions based on adversary supplied and environment specific conditions that are expected to be present on the target.
T1685 Disable or Modify Tools Defense Impairment

What they do: Akira has disabled or modified security tools for defense evasion.

What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
T1558 Steal or Forge Kerberos Tickets Credential Access

What they do: Akira have used scripts to dump Kerberos authentication credentials.

What that means: Adversaries may attempt to subvert Kerberos authentication by stealing or forging Kerberos tickets to enable Pass the Ticket.
T1018 Remote System Discovery Discovery

What they do: Akira uses software such as Advanced IP Scanner and MASSCAN to identify remote hosts within victim networks.

What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
T1057 Process Discovery Discovery

What they do: Akira verifies the deletion of volume shadow copies by checking for the existence of the process ID related to the process created to delete these items.

What that means: Adversaries may attempt to get information about running processes on a system.
T1082 System Information Discovery Discovery

What they do: Akira uses the GetSystemInfo Windows function to determine the number of processors on a victim machine.

What that means: An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.
T1083 File and Directory Discovery Discovery

What they do: Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware.

What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
T1135 Network Share Discovery Discovery

What they do: Akira can identify remote file shares for encryption.

What that means: Adversaries may look for folders and drives shared on remote systems as a means of identifying sources of information to gather as a precursor for Collection and to identify potential systems of interest for Lateral Movement.
T1482 Domain Trust Discovery Discovery

What they do: Akira uses the built-in Nltest utility or tools such as AdFind to enumerate Active Directory trusts in victim environments.

What that means: Adversaries may attempt to gather information on domain trust relationships that may be used to identify lateral movement opportunities in Windows multi-domain/forest environments.
T1654 Log Enumeration Discovery

What they do: Akira _v2 can enumerate the trace, debug, error, info, and warning logs on targeted systems.

What that means: Adversaries may enumerate system and service logs to find useful data.
T1021.001 Remote Desktop Protocol Lateral Movement

What they do: Akira has used RDP for lateral movement.

What that means: Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP).
T1213.002 Sharepoint Collection

What they do: Akira has accessed and downloaded information stored in SharePoint instances as part of data gathering and exfiltration activity.

What that means: Adversaries may leverage the SharePoint repository as a source to mine valuable information.
T1560.001 Archive via Utility Collection

What they do: Akira uses utilities such as WinRAR to archive data prior to exfiltration.

What that means: Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration.
T1219 Remote Access Tools Command and Control

What they do: Akira uses legitimate utilities such as AnyDesk and PuTTy for maintaining remote access to victim environments.

What that means: An adversary may use legitimate remote access tools to establish an interactive command and control channel within a network.
T1567.002 Exfiltration to Cloud Storage Exfiltration

What they do: Akira will exfiltrate victim data using applications such as Rclone.

What that means: Adversaries may exfiltrate data to a cloud storage service rather than over their primary command and control channel.
T1486 Data Encrypted for Impact Impact

What they do: Akira encrypts files in victim environments as part of ransomware operations.

What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
T1489 Service Stop Impact

What they do: Akira _v2 can stop running virtual machines.

What that means: Adversaries may stop or disable services on a system to render those services unavailable to legitimate users.
T1490 Inhibit System Recovery Impact

What they do: Akira will delete system volume shadow copies via PowerShell commands.

What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
T1531 Account Access Removal Impact

What they do: Akira deletes administrator accounts in victim networks prior to encryption.

What that means: Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
T1657 Financial Theft Impact

What they do: Akira engages in double-extortion ransomware, exfiltrating files then encrypting them, in order to prompt victims to pay a ransom.

What that means: Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims.

Tools Observed (41)

▼

Software Akira has been seen using, grouped by what it is used for. Legitimate administration tools appear here because these actors routinely abuse them — presence in this list is not itself malicious.

Credential theft

DonPAPI LaZagne Mimikatz

Defense evasion

PowerTool Zemana Anti-Rootkit driver Zemana Anti-Rootkit

Discovery

Advanced IP Scanner Masscan ReconFTW SharpHound SoftPerfect NetScan

Discovery & enumeration

Advanced IP Scanner Bloodhound ldapdomaindump Masscan ReconFTW SharpHound SharpShares SoftPerfect NetScan

Exfiltration

FileZilla MEGA RClone Temp[.]sh WinSCP

Networking & tunnelling

Cloudflared OpenSSH Ngrok

OffSec

Impacket

Offensive security tooling

CrackMapExec Impacket NetExec

RMM Tools

AnyDesk MobaXterm Radmin RustDesk

Remote monitoring & management

AnyDesk MeshAgent MobaXterm Radmin RustDesk TeamViewer

Tool data from Ransomware Tool Matrix by BushidoUK, licensed CC BY 4.0. Grouped by purpose and matched to this group by Breach House.

Crypto Wallets (15)

▼

$3,991,216 Received (USD)

24 Payments

15 Known wallets

$997,459 Largest single payment

2023-07-13 → 2024-09-17 Payment window

bitcoin · 15

Address	Chain	Received (USD)	Payments
`bc1qr0pqfghr9cksfc5arr2rak3lt2y50v03pc76nh`	bitcoin	$997,461	2
`bc1qfdzu6uv2nek524pe7lz4w0mxtt9898vfaegdaj`	bitcoin	$482,181	1
`bc1q0dx45y82r5rt36sm38jv0k4dexwc4nj9z4ryw7`	bitcoin	$446,073	2
`bc1q9wnp6k7xxdqkdv4fa5ceyhv08espuskhu8ghq2`	bitcoin	$351,883	1
`bc1qknumj4326runqxfr58kg0s7v7gu9y5v5t9uv6h`	bitcoin	$298,537	2
`bc1qr0txunr259we37wer7w6et33qyq0n6hv83pw24`	bitcoin	$252,389	1
`bc1q0lwpz2yufw3x9as6f679lwk8jx43g44683x5mc`	bitcoin	$229,395	4
`bc1qhzd63mz9mfucak7yzfn65p6rcsgztnsqr3dak8`	bitcoin	$150,205	1
`bc1qqrsd02sqthm8gej8lfesgpx82saw7q2g5pjtah`	bitcoin	$149,891	1
`bc1q4my6vqq8cg689drf9jccqudjclv67sz4cudkyd`	bitcoin	$139,534	1
`bc1qpwwtck0zhzrj56fxeayz6wz5546nlp607qzpvh`	bitcoin	$109,655	2
`bc1qghj85gz0dkr9jeucana3z4xu50ujtllj50rvj0`	bitcoin	$106,115	2

+3 more wallets not shown (the 12 largest by amount received are listed).

Crowdsourced payment data from Ransomwhere, licensed CC BY 4.0. Figures are what has been reported and attributed to this family, not a confirmed total. Cite as: Cable, Jack. (2024). Ransomwhere: A Crowdsourced Ransomware Payment Dataset (1.1.0) [Data set]. Zenodo. https://doi.org/10.5281/zenodo.6512122

Ransom Notes (3)

▼

The note this group leaves on a compromised machine. Click a filename to read it.

akira_readme_3.txt txt · 3485 chars

Hi friends,

Whatever who you are and what your title is, if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

Well, for now let's keep all the tears and resentment to ourselves and try to build a constructive dialogue. We're fully aware of what damage we caused by locking your internal sources. At the moment, you have to know:

1. Dealing with us you will save A LOT due to we are not interested in ruining you financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of the deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidentally corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and use in order to get into, identify backup solutions and download your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at once. Then all of this will be published in our blog - akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad[.]onion.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

6. Negotiations with Akira can only be conducted in a chat room, which you can access using the login details provided below or in the notes (a readme.txt file) in your systems. You should ignore any attempts (such as emails/social media messages, phone calls, etc.) to redirect you to another chat or email address (proton.me is often used by unauthorized individuals) on our behalf.

7. Be careful while working with recovery agencies as they often try to use your cyber incident to stuff their pockets. There are many risks for you to lose money and get nothing in return.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme_2.txt txt · 2908 chars

Hi friends,

ATTENTION! Strictly prohibited:

- Deleting files with .arika extension;

- Replacing or renaming .arika and .akira files;

- Using third party software to recover your systems.

If you violate these rules, we cannot guarantee a successful recovery.

5. We're more than negotiable and will definitely find a way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - torproject[.]org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion/d/[snip] .

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

akira_readme.txt txt · 2662 chars

Hi friends,

Whatever who you are and what your title is if you're reading this it means the internal infrastructure of your company is fully or partially dead, all your backups - virtual, physical - everything that we managed to reach - are completely removed. Moreover, we have taken a great amount of your corporate data prior to encryption.

1. Dealing with us you will save A LOT due to we are not interested in ruining your financially. We will study in depth your finance, bank & income statements, your savings, investments etc. and present our reasonable demand to you. If you have an active cyber insurance, let us know and we will guide you how to properly use it. Also, dragging out the negotiation process will lead to failing of a deal.

2. Paying us you save your TIME, MONEY, EFFORTS and be back on track within 24 hours approximately. Our decryptor works properly on any files or systems, so you will be able to check it by requesting a test decryption service from the beginning of our conversation. If you decide to recover on your own, keep in mind that you can permanently lose access to some files or accidently corrupt them - in this case we won't be able to help.

3. The security report or the exclusive first-hand information that you will receive upon reaching an agreement is of a great value, since NO full audit of your network will show you the vulnerabilities that we've managed to detect and used in order to get into, identify backup solutions and upload your data.

4. As for your data, if we fail to agree, we will try to sell personal information/trade secrets/databases/source codes - generally speaking, everything that has a value on the darkmarket - to multiple threat actors at ones. Then all of this will be published in our blog - https://akiral2iz6a7qgd3ayp3l6yub7xx2uep76idk3u2kollpj5z3z636bad.onion.

5. We're more than negotiable and will definitely find the way to settle this quickly and reach an agreement which will satisfy both of us.

If you're indeed interested in our assistance and the services we provide you can reach out to us following simple instructions:

1. Install TOR Browser to get access to our chat room - https://www.torproject.org/download/.

2. Paste this link - https://akiralkzxzq2dsrzsrvbr2xgbbu2wgsmxryd4csgfameg52n7efvr2id.onion.

3. Use this code - [snip] - to log into our chat.

Keep in mind that the faster you will get in touch, the less damage we cause.

View on RansomLook

Ransom-note text from RansomLook, licensed CC BY 4.0.

Victims (1670)

Search, filter and paginate the victim timeline for Akira. Showing 1501–1600 of 1670.

Type	Target	Discovered	Country	Business Category	Intel Link	Leak status
Ransomware	Premium Guard id10435 View details	2024-01-16	United States	Communication / Marketing	—	pending
Premium Guard Inc. (PGI) specializes in designing, manufacturing,and distributing products for automotive, diesel, powersport, and specialty filter markets. 40GB of files with clients and customers data, financial files, projects, orders, contracts will be available for downloading soon. ID 10435
Ransomware	Blackburn College id10395 View details	2024-01-11	United States	Education	—	pending
Blackburn College is a private college in Carlinville, Illinois. Blackburn is a federally recognized work college with a student-managed work program, enabling students to gain leadership experience as they manage other students. We are going to upload 30GB ofthe college files. There are many operational files inside, HR files with personal docs of students and employees. ID 10395
Ransomware	Vincentz Network id10394 View details	2024-01-11	Germany	Telecommunications	—	pending
Vincentz Network is in partnership with different industries in the national and international markets. These include geriatric care, the paint industry, the automotive industry, furniture production, painting technology, technical dealers and ambitious woodworkers. We have 70GB of data that will be uploaded here to share with you. You will find there numerous detailed financial and operational documents. We will also upload a few databases with HR and accounting files. ID 10394
Ransomware	Viridi id10378 View details	2024-01-09	United States	Healthcare / Pharma	—	leaked
Viridi Parente designs and builds fail-safe battery systems for industrial, medical, commercial, municipal, and residential building applications. 70 GB of data contain lots of files with accounting, payment, projects information. There are also many nondisclosure documents, NDA and personal documents of employees. Uploading is coming. ID 10378
Ransomware	Ito Pallpack Gruppen id10377 View details	2024-01-09	Norway	Communication / Marketing	—	pending
Ito Pallpack Gruppen is a business that has delivered industrial solutions for six decades. With our own production department, they have unique opportunities for testing and pre-installation of the deliveries. 30 GB of files will be uploaded soon. Finance, project, contracts and personal information - all this can be foundinside the archive we are going to share with you. ID 10377
Ransomware	Van Buren Public Schools id10372 View details	2024-01-08	United States	Education	—	pending
The Van Buren Public Schools is a school district headquartered in Belleville, Michigan. A lot of files with information about students and their parents, HR information, accounting and other files. ID 10372
Ransomware	Heller Industries id10371 View details	2024-01-08	United States	Finance / Legal / Insurance	—	pending
Heller Industries, Inc. provides reflow technology solutions. TheCompany offers curing systems, semi conductors, and reflow equipment for electronic manufacturers and assemblers. Almost 300gb ofdata will be available soon. There are numerous NDAs with names of widely known corporations, personal documents, finance files and so on. ID 10371
Ransomware	International Electronic Machines Corp id10295 View details	2023-12-25	—	Communication / Marketing	—	pending
On this blessed day we are sharing with you that another company is going to celebrate the New Year with their data on our blog. International Electronic Machines develops, produces and markets innovative imaging, optical and other sensor-based systems for safety and security applications for intelligent transportation system applications. 16Gb of data will be uploaded early next year. Many HR files with personal information, IP, project files and so on. ID 10295
Ransomware	Nissan Australia id10264 View details	2023-12-22	Australia	Communication / Marketing	—	leaked
We've obtained 100 GB of Nissan Australia. They seem not to be very interested in the data, so we will upload it for you within afew days. You will find docs with personal information of their employees in the archives and much other interested stuff like NDAs, projects, information about clients and partners etc. By the way, there is a notice on their website regarding investigation about possible personal information leakage, so we will confirm that with the data uploading. ID 10264
Ransomware	Nexiga id10044 View details	2023-12-15	—	Communication / Marketing	—	pending
Nexiga offers a full service geomarketing to optimize marketing and sales with market and geodata, analyzes and geoinformation systems. 30Gb of their files will be uploaded soon. You can find lots of projects documentation, finance and accounting are presentedwidely. A bit of personal docs with addresses, phones etc. ID 10044
Ransomware	Hyman Hayes Associates id10028 View details	2023-12-14	—	Healthcare / Pharma	—	pending
Hyman Hayes Associates is a full service architecture firm specializing in healthcare, laboratory, and general building design. These guys do not need their data so the files of this company willbe available for downloading soon. There are many files with project information, a bit financials and contracts, other operational docs. ID 10028
Ransomware	SmartWave Technologies id9978 View details	2023-12-12	—	IT	—	pending
SmartWave Technologies is a vertically integrated team of engineers, scientists and technicians that provide design-through-manufacturing capability. These guys don't care about their 65 GB of data containing confidential personal information, lots of HR docs,even medical information. Clients, projects and accounting filesare represented as well. We'll provide access to the files soon. ID 9978
Ransomware	Mitrani Caballero Ojam & Ruiz Moreno - Abogados id9977 View details	2023-12-12	Argentina	Finance / Legal / Insurance	—	pending
Mitrani Caballero Ojam & Ruiz Moreno Abogados is a legal firm that assists the most important companies in Argentina in their critical or most important legal needs. Seems like these lawyers willneed some legal assistance. Expect their data here in a few days. ID 9977
Ransomware	The Teaching Company, LLC id9976 View details	2023-12-12	—	Finance / Legal / Insurance	—	pending
The Teaching Company, doing business as The Great Courses, provides courses on digital versatile disc, audio compact disc, and other formats. 60Gb of data will be uploaded. Clients information, lots of accounting and finance data, courses info and even a holiday video! We will update soon. ID 9976
Ransomware	MSD Information technology id9961 View details	2023-12-11	—	IT	—	pending
MSD is a proven Managed I.T. Solutions provider & Specialized Software Provider. 47 of data will be available here soon. Some of personal information, finance, clients docs are inside. ID 9961
Ransomware	Goiasa id9960 View details	2023-12-11	—	Communication / Marketing	—	pending
Goiasa produces and supplies renewable energy at the lowest cost,with excellence in service and in harmony with the community andthe environment. A lot of information about their projects, sales, HR - 47GB. A few SQLs with more than 26 million lines inside. ID 9960
Ransomware	Studio MF id9957 View details	2023-12-11	—	Services	—	pending
Studio MF provides solutions for continued dedication to the start-up and innovative PMI, supporting the growth and development ofits own business project. We'll share 10Gb of their data soon asthese MFs don't care of it. You can find many files with clientsinformation and other business data. ID 9957
Ransomware	Tasteful Selections id9890 View details	2023-12-07	—	Agriculture / Food	—	pending
Tasteful Selections is a joint venture of RPE, CSS Farms and Plover River Farms Alliance, Inc. They are a vertically integrated grower, shipper, marketer of premium specialty potatoes. 410 Gb of their data will be available here soon. Lots of personal information (SSN and passports. Mostly employees), confidential agreements, clients information and so on. ID 9890
Ransomware	Compass Group Italia id9875 View details	2023-12-06	Italy	Healthcare / Pharma	—	pending
Compass Group is a company based in Italia. Compass Group offers a wide range of services for companies, schools, hospitals, social and health facilities, business premises, sports and leisure. Data of this Italian giant will be published. There are so many files in the 107Gb of data we've taken from them. Finance, HR, legal, personal and so on. ID 9875
Ransomware	Aqualectra Holdings id9874 View details	2023-12-06	—	Energy	—	pending
Aqualectra is Curacao’s government owned utilities company that produces and distributes water and electricity to over 80.000 households and companies. Data fo this company will be available for downloading soon. Operational, business files, lots of payment files etc. ID 9874
Ransomware	Midea Carrier id9842 View details	2023-12-04	Chile	Communication / Marketing	—	pending
Midea Carrier is the result of the union of two global market giants: Midea, a leader in the production of household appliances, and Carrier, a leader in air conditioning and founded by the inventor of air conditioning – Willis Carrier. In 2011, the two companies formed a joint venture to produce and distribute products in Brazil, Argentina and Chile, thus becoming the largest manufacturer of air conditioning equipment in Latin America. 40Gb of data will be released soon. You can find there international contract, agreements, legal documents, HR files etc. ID 9842
Ransomware	Getrix id9839 View details	2023-12-04	Italy	Construction / Real Estate	—	pending
Getrix is the most used real estate management software in Italy.Client information, contracts, real estate and building information. Everything is about 10Gb. The archive will be available soon. ID 9839
Ransomware	Bern Hotels & Resorts id9834 View details	2023-12-03	Panama	Hospitality / Food & Beverage / Tourism	—	pending
Bern Hotels & Resorts is one of Panama's biggest hotel groups. A dozen GB of operational files with detailed personal information will be released soon. Let us know in comment section if you are interested in passport and payment information. ID 9834
Ransomware	Iptor id9816 View details	2023-12-01	—	Communication / Marketing	—	pending
Iptor provides fully integrated enterprise solutions, with highlyadaptable and robust software backed by world-class support fromdistribution and supply chain experts. 20Gb of data will be uploaded. You can find there many confidential agreements, contracts and other operational files. ID 9816
Ransomware	Bauwerk Boen Group id9805 View details	2023-11-30	—	Communication / Marketing	—	pending
Bauwerk Boen Group is, according to the assessment of the BauwerkBoen management, Europe's leading developer, manufacturer and supplier of parquet flooring in the premium segment as well as the second-largest market participant in wood flooring. 40Gb of theirdata will be available here soon for downloading. Lots of contracts, agreement (including confidential ones), employee files and so on. ID 9805
Ransomware	Lydall, Inc. id9785 View details	2023-11-29	—	Communication / Marketing	—	pending
Lydall is a New York Stock Exchange listed company, headquarteredin Manchester, Connecticut with global manufacturing operations producing specialty engineered products for the thermal/acoustical and filtration/separation markets. We are going to upload a good amount of their projects files with drawing and everything. There are many HR files with detailed information, finance, accounting in there. ID 9785
Ransomware	Alpura id9783 View details	2023-11-29	Mexico	Communication / Marketing	—	pending
Alpura, the leading milk producer in Mexico, taking care of everydetail and with the most advanced technology, offers you the best dairy products. You can get to know this company! We'll upload almost 20Gb of their data. There are up-to-date files for the last 3 years in the archive. ID 9783
Ransomware	Servicio Móvil id9780 View details	2023-11-29	—	Communication / Marketing	—	pending
At Servicio Móvil is a Spanish national leader in integral logistics services, information management and business processes. 114Gb of their data will be available here. Contracts, project, agreements, clients information and much of financial data is represented in the files. ID 9780
Ransomware	Teleflora id9779 View details	2023-11-29	Canada	Finance / Legal / Insurance	—	pending
Teleflora is an online flower company headquartered in Los Angeles, California, Teleflora has over 10,000 member florists throughout the U.S. and Canada, with an additional 20,000 affiliated florists outside North America. We'll share a couple of dozens Gbs ofthis company files. Operational, financial docs, some HR files etc. ID 9779
Ransomware	Legacy Mail Management id9721 View details	2023-11-27	—	Services	—	pending
The company categorized under Mailing and Shipping Services. It was established in 2016 and incorporated in IA. The data we got from them will be uploaded here within this week. There are more than 40000 files will be available for downloading and studying. Please wait for updates. ID 9721
Ransomware	Alspec id9673 View details	2023-11-22	—	Energy	—	pending
Alspec offers is a versatile Servery window that is easy to fabricate and install. Almost 20Gb of Alspec's data will be uploaded here as there is no interest in it from them. ID 9673
Ransomware	Custom Engineering &Fabrication, Inc. id9672 View details	2023-11-22	—	Manufacturing / Engineering	—	pending
Custom Engineering & Fabrication is a leading provider of manufacturing solutions to a wide variety of industries, including asphalt, scrap recycling, steel, glass, foam, exterior doors, wood, mineral wool, and paper. These tricky guys lost about 700Gb of their data and don't want it back. Many business docs with personal information there are in the archives. We will share the files here with you soon. ID 9672
Ransomware	IQ Supply Solutions id9671 View details	2023-11-22	—	Services	—	pending
IQ Supply Solutions was founded in November 2017. As a women owned company we have expanded our business by being dedicated to giving our customers the very best service with a focus on detail, dependability and uniqueness. A few Gb of data including personal information will be uploaded soon. The women decided to show their real dedication to their clients. ID 9671
Ransomware	Metro MPLS id9609 View details	2023-11-17	Panama	IT	—	pending
Metro MPLS is a company created to provide data transport services in the Republic of Panama based on a metropolitan fiber optic network using SDH (Synchronous Digital Hierarchy) and Metro Ethernet technology, enabling them to deliver multiple services to customers. Lots of financial, personal and project info will be available soon. ID 9609
Ransomware	ATC SA id9605 View details	2023-11-17	—	Communication / Marketing	—	pending
ATC is an international software company. For more than 25 years,the company provides innovative solutions for the Central Government, Media, Banking, Distribution, Manufacturing and Services. Their corporate data will be available soon. ID 9605
Ransomware	SALUS Controls id9469 View details	2023-11-09	—	Manufacturing / Engineering	—	pending
SALUS Controls is a company that operates in the Industrial Automation industry. 40 GB of data will be available here soon. Personal documents, operational information, contracts, agreements... There is much to look at. ID 9469
Ransomware	Battle Motors (CraneCarrier, CCC) id9468 View details	2023-11-09	—	Finance / Legal / Insurance	—	pending
Battle Motors is a leader in the vocational truck industry, providing custom, severe-service chassis under Battle Motors Engineered Chassis brands. Their data of 50Gb size will be available for downloading here soon. Operational, business agreements, contracts, accounting data etc are in the archive waiting for uploading. ID 9468
Ransomware	City Furniture Hire id9466 View details	2023-11-09	—	Public Sector	—	pending
City Furniture Hire Limited provides quality rental furniture to meet your individual needs whether it be for events, exhibitions,conferences or your office. Everyone interested in data of the company will have the access soon. Wait for an update. ID 9466
Ransomware	Autocommerce id9465 View details	2023-11-09	Slovenia	Retail / E-commerce	—	leaked
The company Autocommerce, d.o.o. is a company that represents theMercedes-Benz brand on the Slovenian car market. We will organize an exhibition hall with the data we exfiltrated from them for everyone interested soon (about 10Gb DB). Welcome everyone! ID 9465
Ransomware	Simons Petroleum/Maxum Petroleum/Pilot Thomas Logistics id9462 View details	2023-11-09	—	Energy	—	pending
We've obtained about 70Gb data of a group of companies in logistics/energy providing fields named Simons Petroleum, Maxum Petroleum and Pilot Thomas Logistics. Lots of operating files, confidential docs, personal information of employees, NDAs and so on. I'll make an update soon. ID 9462
Ransomware	Michael Garron Hospital id9444 View details	2023-11-08	Canada	Healthcare / Pharma	—	pending
Nestled in the heart of East Toronto, Michael Garron Hospital (MGH), a division of Toronto East Health Network, is a vibrant community teaching hospital serving one of Canada’s most diverse communities. We have taken 882k files or 775 GB from their network. You will find lots of confidential information very soon. Stay tuned. ID 9444
Ransomware	BioPower SustainableEnergy Corporation id9426 View details	2023-11-07	—	Energy	—	pending
BioPower Sustainable Energy Corporation is a Canadian manufacturer of commercial and residential grade wood pellets. You will be able to download their data here soon. Lots of operation documents, internal correspondence, employee information, vendors and companies data. Everything is about 20GB. ID 9426
Ransomware	BITZER id9425 View details	2023-11-07	—	Communication / Marketing	—	pending
BITZER manufactures reciprocating compressors, screw compressors,scroll compressors, condensing units, heat exchangers and pressure vessels. We are going to upload 40GB of data. Contacts, agreements and other interested docs of a big manufacturer are coming soon. ID 9425
Ransomware	Patriotisk Selskab id9301 View details	2023-10-31	Denmark	Finance / Legal / Insurance	—	pending
Patriotisk Selskab provides nationwide advice to professional agricultural companies within, among other things, finance, audit, law, livestock, environment and plant breeding. We will upload thedata we have from them soon. You will find European personal documents, confidential agreements and other papers inside. ID 9301
Ransomware	Freeman Johnson id9269 View details	2023-10-30	United Kingdom	Finance / Legal / Insurance	—	pending
Freeman Johnson Solicitors are based in County Durham and North Yorkshire. They have been providing legal services to the community for more than 150 years. More than 200Gb of the community data will be available for downloading. Working on it. ID 9269
Ransomware	Stanford University id9241 View details	2023-10-27	—	Education	—	leaked
Stanford University is one of the world's leading research universities. Stanford is known for its entrepreneurial character, drawn from the legacy of its founders, Jane and Leland Stanford, and its relationship to Silicon Valley. Soon the university will be also known for 430Gb of internal data leaked online. Private information, confidential documents etc. Who is interested - contact us in messages section. ID 9241
Ransomware	CMC Group id9207 View details	2023-10-24	—	Construction / Real Estate	—	leaked
CMC Group is a fully integrated real estate development company focused on luxury residential, commercial and retail properties. 270Gb of data will be available. Very detailed clients informationincluding a DB (addresses, phone numbers, passports/ssns scans etc), confidential documents, contracts projects... And enormous number of accounting files are going to be uploaded. ID 9207
Ransomware	Royal College of Physicians and Surgeonsof Glasgow id9149 View details	2023-10-20	United Kingdom	Education	—	pending
The Royal College of Physicians and Surgeons of Glasgow, is an institute of physicians and surgeons in Glasgow, Scotland. No one from this college is interested to save personal data of students and employees. Sad but true. You will have the opportunity to download the files (800Gb) soon. ID 9149
Ransomware	Southland IntegratedServices id9148 View details	2023-10-20	—	Services	—	pending
Southland Integrated Services provides a variety of health and social services such as primary care, behavioral health, dental services, and more. All the 40Gb we have will be uploaded soon. Medical records, confidential docs, passports may be found in there. ID 9148
Ransomware	Protector Fire Services id9147 View details	2023-10-20	Australia	Communication / Marketing	—	pending
PROTECTOR FIRE SERVICES PTY LTD is a Western Australian owned andmanaged company, with a team of trained specialist personnel fully committed to the fire and safety requirements of the commercial & industrial sectors. We saw no interest from them in the incident, so the data will be available for everyone. There are some databases as a bonus. ID 9147
Ransomware	Visionary Integration Professionals id9142 View details	2023-10-19	—	Services	—	pending
Visionary Integration Professionals (VIP) is a technology firm providing tech-enabled business solutions, IT managed services, andmanagement consulting. Inside the 80Gb archive we are going to upload you can find lots of passports, ssns, dls and other id and personal employee information. There are also tons of accounting documents, contracts and confidential files. ID 9142
Ransomware	Inventum Øst id9141 View details	2023-10-19	Norway	Other	—	pending
Inventum Øst AS is a supplier that supplies "Everything for the office" to companies all over Eastern Norway. We will make available 20Gb of this company data soon. May be even some Norwegians could find something interested there about local companies. ID 9141
Ransomware	QuadraNet Enterprises id9139 View details	2023-10-19	—	Communication / Marketing	—	pending
QuadraNet, since 2001, has been a leader in hosting and data center solutions as a telecommunications provider in Los Angeles and the surrounding areas. They don't want their data back so 640Gb will be uploaded here soon. Passports, ssns and everything we loveis inside. ID 9139
Ransomware	Healix id8991 View details	2023-10-07	—	Healthcare / Pharma	—	leaked
Healix provides physician office-based infusion services. We obtained 642Gb of this company data and there is a probability that the files will be available here for downloading next week. Complete personal information set with medical records of thousands patients could be found in the data. Medical staff personal info is presented as well, Wait for the update. ID 8991
Ransomware	Terwilliger Land Survey Engineers id8968 View details	2023-10-05	—	Services	—	pending
Terwilliger Land Survey Engineers offer drone, land survey, and engineering services across multiple business sectors. We will share their 25Gb data here as they don't care about it. You can findthere much of projects information, court documents and other files. ID 8968
Ransomware	Gruskin Group id8956 View details	2023-10-04	—	Construction / Real Estate	—	leaked
Gruskin Group is an integrated design firm that builds unified brand experiences through architecture, brand development, visual communications, web/interactive, industrial design, interior design, strategic consulting, and sustainable design. They've lost 37 Gb of data and we wanted help them but they refused. As a result,their files (accounting, HR, projects and so on) will be uploaded here and available for downloading. ID 8956
Ransomware	Vertical Development id8899 View details	2023-09-29	—	IT	—	pending
Vertical Development has helped companies design parts catalogs for over 30 years, both in paper and digital formats. Numerous contracts and agreement, NDAs, confidential docs and employee information of the company will be available soon. ID 8899
Ransomware	Civic San Diego id8876 View details	2023-09-27	—	Communication / Marketing	—	pending
CCDC is the public, non-profit corporation created by the City ofSan Diego to staff and implement Downtown redevelopment projectsand programs. Almost 200Gb of files. Confidential documents, personal information etc. Uploading soon. ID 8876
Ransomware	The Polish AmericanAssociation id8873 View details	2023-09-27	Poland	NGOs / Associations	—	pending
Have you ever been interested in the US-Poland friendship details? The Polish American Association is ready to share it's internallive secrets. 185GB SQL will be available for downloading soon. Who cares of immigrants, right? ID 8873
Ransomware	CLX Logistics id8747 View details	2023-09-22	—	Transportation / Travel / Logistics	—	pending
CLX Logistics, LLC is a global 3PL provider of transportation management systems, managed services, supply chain consulting and intermodal transportation services for a broad base of industry verticals. We almost finished their data transportation and will upload 26GB of their data soon. Tons of business information: clients, personal information, a few confidential docs. We will update. ID 8747
Ransomware	Glovis America id8676 View details	2023-09-18	—	Finance / Legal / Insurance	—	pending
The company offers technical jobs, human resources support roles,safety supervisors and managers, or strategic management and leadership positions. 10 GB of data will be available for downloading here soon. Some projects info, personal employee documents, financial and accounting papers. ID 8676
Ransomware	Fuji Seal International (US branch) id8674 View details	2023-09-18	—	Communication / Marketing	—	pending
Fuji Seal Group provides shrink sleeve labels, self-adhesive labels, spouted pouches and label-application systems. The US branch of the company has been recently breached and the management refuses to negotiate. So we are informing you about the upcoming uploading of 30GB size data here. There are numerous confidential docs, contracts, agreements etc. ID 8674
Ransomware	American Steel & Aluminum id8619 View details	2023-09-14	—	Manufacturing / Engineering	—	pending
American Steel & Aluminum Co., Inc. was founded in 1967 with 3 employees, a small fabrication shop, and some big dreams for the future. Today they have 70 employees and 70Gb of data that will be uploaded here. There is much project information and financial docs. Employee information is also will be available. ID 8619
Ransomware	Accuride id8600 View details	2023-09-12	India	Finance / Legal / Insurance	—	pending
Accuride, founded in 1986 and headquartered in Evansville, Indiana, manufactures and supplies vehicle components. Almost terabyte of files will be available for you. Of course there will be many interesting ones. For instance, engineering drawings and photo for TESLA, Mirelli and other sound names. Besides that many confidential documents, personal information of employees with private photo and docs, medical information etc. And finally there is muchinfo about clients and their orders and projects with detailed description (drawings, 3D models). Should I note tons of financialand accounting information? Wait for the release. ID 8600
Ransomware	Energy One id8512 View details	2023-09-06	United Kingdom	Energy	—	pending
Energy One Limited provides various software products and services to wholesale energy, environmental, and carbon trading markets in the Asia-Pacific, the United Kingdom, and Europe. The company will provide you all with its 77GB data where you will find information on their projects with big business names, financial documents, contracts, and HR information as well. ID 8512
Ransomware	New York & Company id8405 View details	2023-08-31	—	Communication / Marketing	—	pending
New York & Company is a leading specialty manufacturer and retailer of women's fashion apparel and accessories providing women with modern, wear to work solutions that are multi-functional at affordable prices. The company's website has a list of its best deals, with more to be added soon. But I wouldn't say it will be one of the best deals for them. They have broken off the dialog, and at this point we have no choice but to post their corporate fileshere for everyone to see. Stand by for the release. ID 8405
Ransomware	Children's Home of Wyoming Conference id8404 View details	2023-08-31	—	Healthcare / Pharma	—	pending
The Children's Home is a family-centered agency with 16 programs,nearly 300 employees and more than 8 locations. CHWC offer six areas of assistance:Behavioral & Emotional Health, Therapeutic Intervention & Clinical Treatment, Leadership & Development, Physical Health & Wellness, Community Outreach & Civic Engagement, Academic Success & Career Readiness.More than 70Gb personal and company documentation data. ID 8404
Ransomware	Rivers Casino id8401 View details	2023-08-31	—	Hospitality / Food & Beverage / Tourism	—	leaked
Rivers Casino is a casino and hotel, that in addition to gambling, offers promotions, dining and entertainment. This is our new client that seems to be offering soon its internal secrets. We willlet you know soon about the breach more detailed. There will be uploaded about 140Gb. ID 8401
Ransomware	O'Brien Steel Service id8365 View details	2023-08-30	—	Manufacturing / Engineering	—	pending
O’Brien Steel Service is stocked and equipped to service customers of all sizes, ranging from small job shops to the largest OEMs in the USA. More than 70 GB of data will be published soon, including:- Financial documents and reports for 22-23 years;- HR;- Projects;- Employment contracts and documents;- IT documents;- Administrative documents.And also: -Contacts.csv - 5069 lines Clietns data;-Customers.csv - 3596 lines of the Companies data; -Competitors.csv - 3470 lines Suppliers data.Wait for the release. ID 8365
Ransomware	Renton School District id8362 View details	2023-08-30	—	Education	—	pending
Renton School District is a public school district serving Renton, Washington. 200Gb of Renton schools will be shared here soon. Business docs, projects information and personal information (e.g.medical staff). Wait for the release. ID 8362
Ransomware	Green Diamond Resource id8330 View details	2023-08-29	—	Services	—	leaked
Green Diamond is a fifth-generation, family-owned forest productscompany that owns and manages working forests in nine states throughout the western and southern U.S. Working the forest for so long seems to have taken away the management of this company of their ability to communicate with people. They didn't utter a word for about two weeks after the hack.We found some interesting data on their network and are posting over 30GB of their business information, including personal information, here. ID 8330
Ransomware	Jasper High School id8319 View details	2023-08-28	—	Education	—	pending
Another one school that doesn't care about its students documents. More than 60Gb of data will be released here soon. Many confidential documents of students and employees and even some confidential files. Wait for the release. ID 8319
Ransomware	Intertek id8317 View details	2023-08-28	—	Services	—	pending
Intertek is an international provider of quality and safety services to a wide range of global and local industries. In the pack of more than 300Gb of data you can find all set of information: personal documents, business partners info, confidential agreementsand reports. There is also information about their US affiliate Professional Service Industries. ID 8317
Ransomware	Penny Publications id8316 View details	2023-08-28	—	Public Sector	—	pending
Penny Publications is recognized as North America’s leading puzzle magazine company and is dedicated to providing family-friendly puzzle entertainment of unsurpassed quality. We will make Penny Publications a bit more recognizable for people and upload the data we've taken from this company. 100 Gb will be available for downloading soon. Employee information, confidential documents and financial files can be found in the data as always. ID 8316
Ransomware	Voss Enterprises, Divvies id8315 View details	2023-08-28	—	Communication / Marketing	—	leaked
Voss Enterprises (real estate) and Divvies (retail) are two more companies with no hint of a desire to keep their company data safe. We'll post the files of both companies this week. ID 8315
Ransomware	Cutler-Smith id8314 View details	2023-08-28	—	Finance / Legal / Insurance	—	pending
Cutler-Smith, P.C. is a uniquely positioned to deliver big law firm results with the attention, service and efficiencies that onlya boutique law firm can provide. They've lost 50Gb of their clients' data that will be provided here in our blog within this week. ID 8314
Ransomware	Edmonds School District id8284 View details	2023-08-24	United States	Education	—	pending
Edmonds School District's 35 schools cover approximately 36 square miles within the communities of Brier, Edmonds, Lynnwood, Mountlake Terrace, Woodway and portions of unincorporated Snohomish County. Edmonds School District's data covers approximately 10GB ( sql file) on our server and seems not to be very interested in saving it. So we are ready to share it with everyone interested. I think you can imagine what data will be released: personal students documents, employees info, financials, accounting and much other. We are working on the release. ID 8284
Ransomware	RIMSS id8182 View details	2023-08-17	—	Agriculture / Food	—	pending
RIMSS provides dealer support services to agricultural, truck, construction, and bus dealerships throughout the U.S. RIMSS is one of that companies who doesn't care when their corporate information is open to public. Why shouldn't we share it with people who are interested in such data? Wait for upload. ID 8182
Ransomware	Camino Nuevo CharterAcademy id8173 View details	2023-08-17	—	Education	—	pending
Camino Nuevo Charter Academy educates students in a college preparatory program. We will be uploading their 75GB data shortly. Youwill find some personal information there: ssns, passports, and other business documents. Please expect it soon. ID 8173
Ransomware	The Clifton Public Schools id8171 View details	2023-08-17	—	Education	—	pending
The Clifton Public Schools is a comprehensive community public school district that serves students in pre-kindergarten through twelfth grade. The leadership of this district has priced their school information too cheaply, which is the reason their internal information is here. As always, 60 GB of school documents with detailed personal information will be posted here. ID 8171
Ransomware	Cequint id8155 View details	2023-08-16	—	Telecommunications	—	pending
Cequint Inc. provides caller identification (ID) solutions for mobile devices. 880 GB of data is what we got from their network. Alarge number of different documents. The most interesting in this case are the source codes and information about the company's projects. In addition, as you realize, there are a lot of personaland financial documents. Please wait for the release. ID 8155
Ransomware	Tally Energy Services id8154 View details	2023-08-16	—	Energy	—	pending
Tally Energy Services is an integrated oilfield services company committed to helping our customers “make better wells.” We wantedto help these folks make their cyber defenses a little better, but we failed. Soon you're going to see 130GB of their data here. As always, there's a bunch of personal employee records with medical information and emergency contacts. Financial and incident reports are also prominently displayed. ID 8154
Ransomware	Rite Technology id8116 View details	2023-08-11	—	IT	—	pending
Rite Technology company offers products including copiers, printers, HP products and Sharp Aquos white boards. We will share a zipwith their data of about 15 GB containing good HR data with passport and ssns information of employees. There are also interesting accidents information and business documentation. ID 8116
Ransomware	The Belt Railway Company of Chicago id8111 View details	2023-08-10	—	Transportation / Travel / Logistics	—	pending
The Belt Railway Company of Chicago has a strong safety foundation and history, and employees continuously strive for zero incidents. But there was an incident that caused 85 GB of their data appearing on our server. BRC management decided to stay silent with us so we will upload all their documents soon. ID 8111
Ransomware	Optimum Technology id8110 View details	2023-08-10	—	IT	—	pending
Optimum Technology is dedicated to developing solutions that helpkeep law enforcement and communities safe. They haven't developed any solutions for cyber security yet so we will share 77Gb of their data soon. SQLs, personal docs, and other business information. ID 8110
Ransomware	Boson id8109 View details	2023-08-10	—	Education	—	leaked
Boson offers IT learning software to individuals, businesses, academic institutions and government entities around the world. We gained access to their network found some files there. We will upload the soon. ID 8109
Ransomware	TIMECO id8095 View details	2023-08-09	—	Services	—	pending
Thousands of business owners use TIMECO to maximize their billable hours, eliminate time theft, decrease operating costs, and process payroll in minutes. As we've managed to penetrate to the network of this company, some of that businesses are at risk now. Currently, we working on gaining accesses to them. ID 8095
Ransomware	Räddningstjänsten Västra Blekinge id8077 View details	2023-08-07	—	Public Sector	—	pending
Räddningstjänsten Västra Blekinge is a sweden municipal association with three member municipalities: Karlshamn, Olofström and Sölvesborg. As these associations are not interested in saving theircitizens data, we will upload the everything we have on this company here soon. Please wait for an update. ID 8077
Ransomware	Papel Prensa SA id8076 View details	2023-08-07	Argentina	Communication / Marketing	—	pending
Papel Prensa SA is an Argentina-based company engaged in the manufacture of newsprint paper. Confidential contracts, agreements, personal employee information and other business docs. About 120GB. Please wait for the release. ID 8076
Ransomware	Koury Engineering id8050 View details	2023-08-04	—	Manufacturing / Engineering	—	pending
Koury Engineering provides geotechnical engineering, material testing, and inspection services for residential and commercial construction projects throughout Southern California. More that 80GB of confidential contracts, agreements and NDAs, complete employeedata, projects information and much other documents will be uploaded later. All questions to messages section please. ID 8050
Ransomware	Venture General Agency id8033 View details	2023-08-03	—	Communication / Marketing	—	pending
Venture General Agency, LLC (VGA) is a family run Texas based Managing General Agency. These guys are not very talkative. All the data we have from this company will be released here next week. Personal docs and customer information, contracts and payments details - everything will be shared. If you are interested in something specific, let us know in messages section. ID 8033
Ransomware	Datawatch Systems id8031 View details	2023-08-03	—	Communication / Marketing	—	leaked
Datawatch Systems experts work in partnership with you to design,install, and operate a security system to safeguard your facility. It's frustrating when one tries to save someone's property andbecome a victim for himself. We took from these experts 100 GB of data containing confidential agreements and contracts, personal documents, customers data and their projects details. Watch your data! Uploading is coming. ID 8031
Ransomware	TGRWA id8019 View details	2023-08-02	—	Communication / Marketing	—	leaked
TGRWA is a structural engineering firm that specializes in new construction, renovation, and investigation services. All the information of employees, projects, financials, and business processesinformation will be released soon. ID 8019
Ransomware	Guido id8018 View details	2023-08-02	—	Finance / Legal / Insurance	—	pending
Guido Companies is a privately held Commercial Construction and Building Materials firm. We hold 115 GB of their corporate data including HR, accounting, financials and so on and so forth. Feel free to check soon! ID 8018
Ransomware	Parathon by JDA eHealth Systems id8002 View details	2023-08-01	—	Healthcare / Pharma	—	pending
Parathon is a full-scale healthcare Revenue Cycle Management dataintegrator. We're almost ready to share the 560GB of data we'vetaken from their network . Contracts, employee personal information, and confidential documents will be posted shortly. ID 8002
Ransomware	Frost & Sullivan id7958 View details	2023-07-28	—	Services	—	leaked
Frost & Sullivan, the Growth Consulting Company, partners with clients to accelerate their growth. Planning is always not an easy process and sometimes leads to a failure. These guys underestimated their data and we suppose their clients won't be happy seeing news of this leak. Tons of contracts with big names of international businesses, personal documents including top management and more. >90GBs of data will be available soon. ID 7958
Ransomware	Handi Quilter id7949 View details	2023-07-27	—	Finance / Legal / Insurance	—	leaked
Handi Quilter is the worldwide leader and quilters’ choice for longarm machines for both stand-up and sit-down quilting. More than100GB of this company data will be available for downloading soon. They are not of those who want to keep their data confidentially, so we will share their business information with you. Source codes, contracts, financials... Wait for the release. ID 7949
Ransomware	Morehead State University (MSU) id7948 View details	2023-07-27	—	Education	—	leaked
Morehead State University is a comprehensive public university with undergraduate and graduate programs, emerging doctoral programs, and an emphasis on regional engagement. This university underwent our attack and lost a lot of data. President Jay Morgan said "no personal data has been compromised" (https://www.wmky.org/news/2023-07-13/morehead-state-university-hit-by-cyber-attack). But that was only a matter of time. Since we haven't been contacted from their part, we will upload every file of this university we have. Complete personal information of students and employees, finance and marketing data will be available soon. ID 7948
Ransomware	Offutt Nord id7947 View details	2023-07-27	—	Finance / Legal / Insurance	—	pending
Offutt Nord is a group of insurance attorneys that represent clients involved in general civil litigation statewide in many statesand regions. Their clients' information will be released soon here as always. There are about 70GB of personal documents, judicial processes and much other. ID 7947
Ransomware	Becht Engineering id7440 View details	2023-07-25	—	Manufacturing / Engineering	—	leaked
Becht provides technically excellent engineering solutions, plantservices, and software tools to our worldwide clients. This is the company a client will go to when they see their data in open access. All the information of employees, projects, financials, and business processes information will be released soon. ID 7440

Akira

Overview

Leak Status Distribution

Top Countries

Known Leak Locations (2)

Top Activity Sectors (18)

Typical Attacks (29)

Tools Observed (41)

Credential theft

Defense evasion

Discovery

Discovery & enumeration

Exfiltration

Networking & tunnelling

OffSec

Offensive security tooling

RMM Tools

Remote monitoring & management

Crypto Wallets (15)

Ransom Notes (3)

Victims (1670)

Restricted Access

Now you can see the leak, not just the listing