Ransomware Group intelligence
Emperador
ActiveTrack Emperador with 49 published victims and 1 known leak locations in a single intelligence view.
BREACH HOUSE ALERTS
Want an alert every time a new ransomware post is published?
Choose the feeds and the countries you care about — we email you when they move.
Overview
Emperador is tracked by Breach House as a ransomware group with 49 published victims.
United States is currently the most targeted country in this dataset.
1 known leak locations are currently associated with this group.
Leak Status Distribution
49
- Leaked 29 59.2%
- Pending 12 24.5%
- Deleted 8 16.3%
Top Countries
Interactive distribution based on the currently visible victims list.
Known Leak Locations (1)
| Label | Type | Availability | Links |
|---|---|---|---|
| Leak location 1 | Onion service | Up checked 1h ago | emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion |
Top Activity Sectors (13)
Typical Attacks (10)
▼MITRE ATT&CK does not currently catalogue Emperador, so this is our assessment of the techniques it uses, drawn from public reporting. The techniques themselves, and every "what that means" definition below, come from MITRE ATT&CK v20.0. Confidence: medium. Treat it as orientation, not attribution.
-
T1059.001 PowerShell Execution
What they do: emporador executes PowerShell scripts to automate credential access and system reconnaissance.
What that means: Adversaries may abuse PowerShell commands and scripts for execution.
-
What they do: emporador persists via Registry Run Keys to ensure recurring execution after reboots.
What that means: Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key.
-
T1685 Disable or Modify Tools Defense Impairment
What they do: emporador disables security tools by terminating or modifying antivirus and monitoring utilities.
What that means: Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities.
-
T1070.004 File Deletion Stealth
What they do: emporador deletes Volume Shadow Copies and backup directories to prevent recovery.
What that means: Adversaries may delete files left behind by the actions of their intrusion activity.
-
T1018 Remote System Discovery Discovery
What they do: emporador performs remote system discovery to identify additional victims within the network.
What that means: Adversaries may attempt to get a listing of other systems by IP address, hostname, or other logical identifier on a network that may be used for Lateral Movement from the current system.
-
T1049 System Network Connections Discovery Discovery
What they do: emporador discovers system network connections to locate exposed services for exploitation.
What that means: Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
-
T1083 File and Directory Discovery Discovery
What they do: emporador uses file and directory discovery to enumerate user data and system paths before encryption.
What that means: Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
-
T1021.002 SMB/Windows Admin Shares Lateral Movement
What they do: emporador moves laterally through SMB/Windows Admin Shares to compromise additional hosts.
What that means: Adversaries may use Valid Accounts to interact with a remote network share using Server Message Block (SMB).
-
T1486 Data Encrypted for Impact Impact
What they do: emporador encrypts victim files using its ransomware payload to hold data hostage.
What that means: Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources.
-
T1490 Inhibit System Recovery Impact
What they do: emporador inhibits system recovery by corrupting restore points and disabling backup services.
What that means: Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery.
Victims (49)
Search, filter and paginate the victim timeline for Emperador. Showing 1–49 of 49.
| Type | Target | Discovered | Country | Business Category | Intel Link | Leak status |
|---|---|---|---|---|---|---|
| Ransomware | Bruin Group LLC id35358 View details | United States | Services | pending | ||
|
Bruin Group LLC 19d 23h 39m 20s Bruin Group LLC is a telecom expense management (TEM) and communications auditing firm. Companies hand them carrier invoices, circuit inventories, wire instructions, letters of authorization, and internal ticket correspondence so Bruin can audit and recover overcharges. Bruin sits on a concentrated pile of third-party financial and telecom data for every client they serve. We have your entire ticket repository. Wire instructions, account numbers, W-9s, EINs, signed LOAs, Tenet patient call traces, all of it, for every client you manage. Tenet. Welltower. USDA. MarineMax. Allegis. Lincare. Salvation Army. Realogy. Delek. Quiktrip. CubeSmart. SRS. Baymark. Partial list. $1,000,000 in BTC or XMR. Pay and it ends. Don't and we contact your clients directly with their own documents, then publish one company at a time. [email protected] [email protected] Session: 05651c732327b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Oct 21, 2026 12:16 AM 119.0 MB 23 |
||||||
| Ransomware | GTL Concreto e Logística LTDA id35198 View details | Brazil | Construction / Real Estate | pending | ||
|
GTL Concreto e Logística LTDA 13d 09h 25m 05s Production and preparation of ready-mixed concrete and mortars. Production of cement products for construction. Construction of buildings and other construction works. Rental of vehicles and industrial equipment without an operator. IN THE ARCHIVE FINANCIAL DOCUMENTS, PERSONAL AND CUSTOMER DATA, EMPLOYEE CREDENTIALS. Oct 19, 2026 9:53 AM 2.0 GB 1058 |
||||||
| Ransomware | Luzco Ilumination id35024 View details | Spain | null | pending | ||
|
Luzco Ilumination 12d 06h 12m 13s Spanish company that specializes in professional lighting for shops and commercial spaces. There are many customer documents and employee data. Oct 18, 2026 6:40 AM 1.4 GB 2963 |
||||||
| Ransomware | Electrolux id34074 View details | Sweden | Manufacturing / Engineering | leaked | ||
|
Electrolux PUBLISHED Hello Electrolux, Still no response from you. When we called your IT helpdesk posing as threat researchers and asked about the breach, we were told, "We cannot talk about it." You have one week before we release more data - starting with information on your employees. We'd prefer to settle this directly. EMAIL: [email protected] SESSION: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Sep 26, 2026 10:47 AM 50.1 KB 17284 |
||||||
| Ransomware | SitePro Rentals id34073 View details | Germany | Construction / Real Estate | leaked | ||
|
SitePro Rentals PUBLISHED Greetings. Following our negotiations with SitePro Rentals, we are proceeding on the assumption that they will not pay the ransom demand. Should they change their minds after this post, they now have 15 hours to respond and pay, otherwise, EVERYTHING gets leaked. You know where to contact us. Oct 14, 2026 3:05 PM 6.2 MB 1246 |
||||||
| Ransomware | MPI LTDA id33878 View details | Brazil | — | pending | ||
|
Colombian asphalt company. The company has been operating in the field of asphalt materials since 1974. It produces ordinary bitumen, asphalt with polymer additives and asphalt modified with rubber crumb. The archives contain several thousand documents with personnel and customer data. [Sector: Manufacturing] |
||||||
| Ransomware | MyM ODONTOCLINICA S.A id33852 View details | Brazil | — | pending | ||
|
Сompany from Paraguay operating in the field of dentistry. Financial documents, personal and customer data. The archive contains the most important documents [Sector: Medical, Other] |
||||||
| Ransomware | CMC AUDITORES SRL id33803 View details | Argentina | — | pending | ||
|
An Argentine auditing and accounting consulting company that works with businesses in the field of accounting, taxes and financial audit. The archives contain several thousand documents with personnel and customer data. [Sector: Finance] |
||||||
| Ransomware | Spelman Logistics id33717 View details | — | — | pending | ||
|
Dear Spelman Logistics, We are now in possession of 1.2M contact records (emails and phone numbers), 245K carrier profiles complete with EIN and SSN, 57K bank accounts including routing numbers, 334K live document URLs, and 4.5M carrier registry entries pulled from your MVMNT TMS. Your exposure extends well beyond your own walls. We have also reached into the systems of your partners, including: ALG Canada Inc Line Transportation Inc Maverick Acquisition Ventures Inc Reliable Freight Solutions Rhode Sense and more. If you would rather not have us contact your partners and make life difficult for your employees, we suggest you pay the following: $500,000 in BTC or XMR. You will shortly receive an email explaining how to reach us. If that fails, contact us at: Email: [email protected] / [email protected] Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Manufacturing, Transportation] |
||||||
| Ransomware | Imperial Diamond Jewellery id33610 View details | — | — | pending | ||
|
Engaged in the sale of jewelry made of precious metals, diamond jewelry and the manufacture of custom jewelry. Country: Hong Kong, China. Year of foundation: 2011 Financial documents, personal and customer data. [Sector: Manufacturing, Finance] |
||||||
| Ransomware | PANCARIBBEAN LOGISTICS GROUP id33466 View details | Trinidad and Tobago | Transportation / Travel / Logistics | leaked | ||
|
Panamanian logistics company operating in the field of international cargo transportation. Financial documents, personal and customer data. [Sector: Transportation] |
||||||
| Ransomware | METROCOLOR S.A. id33465 View details | Spain | Retail / E-commerce | leaked | ||
|
A Peruvian company from the printing industry. Commercial printing, packaging, labels, boxes, books, magazines, booklets and promotional products. The archives contain several thousand documents with personnel and customer data. [Sector: Manufacturing, Technology] |
||||||
| Ransomware | OMUR HIRDAVAT LTD id33451 View details | Türkiye | Manufacturing / Engineering | pending | ||
|
A Turkish company engaged in the wholesale and retail trade of construction and household fittings The archives contain several thousand documents with personnel and customer data [Sector: Manufacturing] |
||||||
| Ransomware | LA PONDEROSA id33361 View details | Mexico | Other | leaked | ||
|
GRANJA AVICOLA LA PONDEROSA Venezuela The corporate purpose is mainly the purchase, sale, import, export, breeding, processing and marketing of all types of poultry and/or domestic animals in general. The archives contain several thousand documents with personnel and customer data. [Sector: Manufacturing] |
||||||
| Ransomware | SitePro Rentals id33335 View details | Germany | Construction / Real Estate | deleted | ||
|
I have yet to hear a response from SitePro Rentals regarding the data breach. I have heard rumors that a law firm is investigating the incident(https://classlawdc.com/2026/09/28/sitepro-rentals-data-breach-investigation/). I am giving you 72 hours to contact me, otherwise I will leak the active employee details. The information includes: IsTotalItem, Department_ShortName, Employee_FirstName, Employee_LastName, EmployeeEmploymentStatus_EmployeeNumber, Employee_HireDate, EmploymentStatus_ShortName, OrgUnit_ShortName, DeptJob_ShortName, EmployeeManager_ManagerDisplayName, PayType_ShortName, PayClass_ShortName, Employee_SocialSecurityNumber, Department_ShortName2, Employee_Gender, Employee_MiddleName, PersonAddress_Address1, PersonAddress_Address2, PersonAddress_City, PersonAddress_PostalCode, PersonAddress_StateCode, Employee_BirthDate, OrgUnit_ContactBusinessPhone, OrgUnit_ContactCellPhone, EmployeeManager_ManagerEmployeeNumber, EmployeeEmploymentStatus_BaseRate, EmployeeEmploymentStatus_BaseSalary, Department_LedgerCode, Department_XRefCode, and OrgUnit_XRefCode. Contact me at [email protected] Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358. [Sector: Construction] |
||||||
| Ransomware | Polikem id33286 View details | Türkiye | Manufacturing / Engineering | leaked | ||
|
Polikem is a Colombian company dedicated to the development, manufacture, and marketing of chemical products for industrial and automotive applications. With decades of experience, the company provides practical and reliable solutions tailored to the needs of various industries and consumers. This leak includes sensitive information, such as the company’s financial status, inventory records, and other internal data. [Sector: Manufacturing] |
||||||
| Ransomware | Amazon Informatica id33248 View details | Brazil | IT | pending | ||
|
Amazon Informática LTDA is a prominent Information Technology (IT) solutions integrator and managed services provider founded in Brazil in 1995. Amazon Informática's primary market focus is the public sector and government agencies, serving various state and federal entities in Brazil.To support these operations, they maintain strategic corporate offices in Brasília/DF (to service the federal government cluster) and Belém/PA. Furthermore, the company has expanded its footprint internationally with operational branches in Latin America and Europe (Portugal), where they deliver customized government tech solutions and enterprise infrastructure support to large private corporations in those regions. Full commitment of the network having full access to infrastructure, thus ensuring full access to the databases containing confidential and financial information! Virtual Infrastructure and Database Cluster with active administrative master credentials exposed in text clear inside get_bk.bat. Hosts compromised. The targets contain production and integration databases with sensitive PII schemas, employee registries, banking credentials, CPF, and RG data. TOX ID: 3D6EF83C3C4517FE42B212A934D4B08579A5F20522828C4E4818EA117F53063377C4D769640B SESSION: 052a5fe97f7b1822c2225ba884b5f719c07ec99da7d838421a20958938f54cb539 [Sector: Government, Technology] |
||||||
| Ransomware | SiteProRentals id33224 View details | United States | Services | deleted | ||
|
SitePro Rentals is a Texas-based construction and industrial equipment rental company founded in 2021. A subsidiary of Sammons Industrial, it rents aerial lifts, forklifts, and earthmoving equipment, serving contractors across the U.S. from over 30 locations. We have every employee's Social Security number. Home addresses. Birth dates. Salaries. We know who's sick, who's on leave, who got fired and why. We also have 338,000 pay records.... Shortly, you will receive an email containing the instructions on how to proceed with this situation. The ransom is relatively small, just $150k USD in XMR... If you do not receive the email, contact us at: Email: [email protected] Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Construction] |
||||||
| Ransomware | Electrolux 2... id33225 View details | Sweden | Manufacturing / Engineering | leaked | ||
|
Hi Electrolux, im getting kind of inpatient, therefore i might just leak something. If i hear nothing from you in the next 3 days, more data WILL be leaked. Thanks. Emails: [email protected] Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Retail, Manufacturing, Transportation] |
||||||
| Ransomware | Car Service Abschlepp id33212 View details | Germany | Transportation / Travel / Logistics | leaked | ||
|
CSA Car Service Abschlepp- & Bergungsdienst GmbH Genslerstraße 72, 13055 Berlin Archived personal and corporate data of employees and customers Here are the most important documents [Sector: Transportation] |
||||||
| Ransomware | Electrolux & Ontrac id33178 View details | — | null | deleted | ||
|
Hello Electrolux & OnTrac, Still no response from you. When we called your IT helpdesk posing as threat researchers and asked about the breach, we were told, "We cannot talk about it." You have one week before we release more data - starting with information on your employees. We'd prefer to settle this directly. Same goes for OnTrac. We recently learned that OnTrac has been paying employees as little as $14.50 an hour. As a result, we will be releasing salary information for all of their employees. I also managed to get in touch with a former OnTrac employee, chill guy. Said his time there was horrible. EMAIL: [email protected] SESSION: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 [Sector: Retail, Manufacturing, Transportation] |
||||||
| Ransomware | OnTrac id33124 View details | United States | Transportation / Travel / Logistics | deleted | ||
|
OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. It positions itself as a direct alternative to FedEx and UPS, offering coast-to-coast coverage, 7-day-a-week operations, and competitive rates to reach over 75% of the U.S. population. We hold your full employee database, 197k records of employee PII: employeeNumber,xrefCode,firstName,middleName,lastName,loginId,employeeId,hireDate,originalHireDate,startDate,terminated,roles,legalEntity,legalEntityAddress,homePhone,mobilePhone,businessPhone,businessMobile,pager,personalFax,personalEmail,businessEmail,facebook,linkedin,addressPrimary1,addressPrimary2,addressMailing1,addressMailing2,userApproved,nativeAuth,culture We demand an amount of 1 million, otherwise your data WILL be publicly posted. Instructions will be emailed to you shortly. If you do not receive them, contact me on session, or email me. Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Email: [email protected], [email protected] (I prefer session.) If you do not cooperate, your partners and employees will be targeted. Emails were sent to: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected] [Sector: Retail, Transportation] |
||||||
| Ransomware | RECEITA FEDERAL DO BRASIL id33083 View details | Brazil | Public Sector | leaked | ||
|
MINISTÉRIO DA FAZENDA SECRETARIA DA RECEITA FEDERAL DO BRASIL The archives contain several thousand documents with personnel and customer data, as well as all user date on gov.br with passwords. [Sector: Finance] |
||||||
| Ransomware | Alabama Woman's Health Care id33016 View details | United States | Healthcare / Pharma | leaked | ||
|
Alabama Woman's Health Care Comprehensive Consultative Medicine, Wellbeing and Aesthetic Care Organization Several thousand documents of employees and clients and an archive of photos 420 Lowell Dr Suite 400 Huntsville, AL 35801 [Sector: Medical, Other] |
||||||
| Ransomware | Studio Notarile Associato Salvatore Costantino E Anna Favarato id33006 View details | Italy | Healthcare / Pharma | leaked | ||
|
Studio Notarile Associato Salvatore Costantino E Anna Favarato, Follina +39 0438 971778 Piazza Iv Novembre, 20, 31051, Follina , Italia Notary's office several thousand documents There are many customer documents and employee data. [Sector: Finance, Other] |
||||||
| Ransomware | Electrolux id32994 View details | Sweden | Manufacturing / Engineering | pending | ||
|
Electrolux Group is a Swedish multinational home-appliance manufacturer, producing refrigerators, washing machines, ovens, dishwashers, vacuum cleaners, and other household appliances under several brands worldwide. We were able to access your azure database, and export every piece of data which adds up to ~41GB. You will receive an email shortly containing the instructions you need to proceed. Electro_backup.7z is currently password locked, but if they do not pay the ransom, the password and the data WILL be leaked Time is ticking, Pay the ransom. If you are having issues receiving instructions, contact me at: [email protected] [Size: 12.7 GB | Sector: Manufacturing] |
||||||
| Ransomware | Cassias MG Government id32991 View details | Brazil | Public Sector | leaked | ||
|
network commitment, from government credentials to justice panels, such as access to the financial sector, police, personal data, medical (SUS), RG(CIN), BIRTH CERTIFICATE, CPF (identity number in Brazil) among other data from CASSIAS.MG.GOV departments, we will give you a deadline to negotiate with us! [Size: 720.0 MB | Sector: Medical, Government, Finance] |
||||||
| Ransomware | Westbridge Institute of Technology, Inc. id32921 View details | United States | Education | leaked | ||
|
Full Employee Information Full Students Information Full Guardians Information [Size: 102.0 MB | Sector: Education] |
||||||
| Ransomware | RDA MOTORS S.P.A. id32915 View details | Italy | Transportation / Travel / Logistics | leaked | ||
|
is an Italian company engaged in premium cars. There are many customer documents and employee data [Size: 7.3 GB | Sector: Technology, Other] |
||||||
| Ransomware | SEVENOAKS s.r.o. id32907 View details | Czechia | Manufacturing / Engineering | deleted | ||
|
Sevenoaks, S.R.O. is an enterprise based in Czech Republic. Its main office is in Prague. The company operates in the Computer Systems Design and Related Services industry. [Size: 3.3 GB | Sector: Technology, Other] |
||||||
| Ransomware | Navitrans id32799 View details | United States | Transportation / Travel / Logistics | leaked | ||
|
Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. [Size: 223.2 MB | Sector: Manufacturing, Transportation] |
||||||
| Ransomware | Nexbex Solutions Private Limited id32786 View details | India | IT | leaked | ||
|
Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB. Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc. Subdomains Type staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle admin.bookings-staging, backend.academy, admin.spike.booking, etc. We have the source code for all 200+ of their projects. 10 GB +. going up. [Size: 600.0 MB | Sector: Technology] |
||||||
| Ransomware | EASY JOB S.A.S. id32730 View details | Colombia | Services | leaked | ||
|
Colombian Company. Audit and Tax Audit with more than 5 years of experience Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medellín Colombia. Llámanos o escríbenos: 310 447 2013 - 313 796 9917 The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents 17000 documents [Size: 2.7 GB | Sector: Finance] |
||||||
| Ransomware | Bosnia and Herzegovina Mine Action Center id32710 View details | Bosnia and Herzegovina | NGOs / Associations | leaked | ||
|
important documents [Size: 1.7 GB | Sector: Other] |
||||||
| Ransomware | Universal Starch-Chem Allied Ltd id32708 View details | India | Manufacturing / Engineering | leaked | ||
|
important documents [Size: 3.5 GB | Sector: Other] |
||||||
| Ransomware | BAYMER id32709 View details | United States | Healthcare / Pharma | leaked | ||
|
Important documents [Size: 1.4 GB | Sector: Other] |
||||||
| Ransomware | Judicial Branch of the Province of Jujuy id32591 View details | Argentina | Public Sector | leaked | ||
|
The official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digital case management, mediation services, legal rulings, and judicial news for legal professionals and the public. Now i have your wordpress databases, login credentials to internal systems(thanks to marcos :)), as well as your email credentials Respond to us, pay the ransom.(Check your emails & check spam as well.) [Size: 4.2 GB | Sector: Government, Law] |
||||||
| Ransomware | Uniguacu id32268 View details | Brazil | null | leaked | ||
|
full commitment of the network having full access to infrastructure, thus ensuring access to the database containing confidential and financial information! I obtained some images that compromise the financial sector. You have 13 days to trade. If the trade doesn't occur as planned, we will have to take severe measures. I sent some images to show the veracity of the attack. The warning has been given! [Size: 151.0 MB | Sector: Education] |
||||||
| Ransomware | Hanwha Renewables id32227 View details | Korea, Republic of | Energy | leaked | ||
|
The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. [Size: 11.7 GB | Sector: Energy] |
||||||
| Ransomware | Ipro.com(revealdata.com) customer DB + full database backup id32202 View details | United States | IT | deleted | ||
|
Yes, this data has been posted before by ME under a different alias, yes the individual that posted the data on cracked.st is a fraud. I am posting this just for fun. Data contains: Customer identifiers, Contact & Location, Account metadata, Internal System IDS, Client relationships. The full database backup contains everything such as transcripts, cases, though it is from 2023. [Size: 79.5 MB | Sector: Government, Law] |
||||||
| Ransomware | Capitol Mechanics id32185 View details | United States | — | leaked | ||
|
Capitol Mechanics , fresh databases, important docs [Size: 120.9 MB | Sector: Finance, Transportation] |
||||||
| Ransomware | FRUCASTRO SL id32050 View details | Spain | Manufacturing / Engineering | deleted | ||
|
Recent databases, important documents [Size: 540.1 MB | Sector: Manufacturing] |
||||||
| Ransomware | Vietnam Electricity(EVNHANOI) id31935 View details | Viet Nam | — | pending | ||
|
Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 [Size: 300.0 GB | Sector: Government, Energy] |
||||||
| Ransomware | TEST id31962 View details | — | — | deleted | ||
|
Test [Size: 740.0 KB | Sector: Other] |
||||||
| Ransomware | NetExam id31924 View details | United States | — | leaked | ||
|
NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system built for external audiences rather than internal employees. It helps companies train, certify, and enable their channel partners, customers, and association members, with features like certification tracking, self-paced and instructor-led courses, e-commerce, white-labeling, Salesforce integration, and AI-powered course authoring agents. Headquartered in Dallas, with clients including AMD, AT&T, Oracle, Trellix, and Sabre. [Size: 18.1 MB | Sector: Education, Retail, Other] |
||||||
| Ransomware | Prefeitura Municipal de Arcos id31821 View details | Brazil | — | leaked | ||
|
We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated. Critical systems have been encrypted. We have your data. You do not. You have 14 days to respond. No response = data published + permanent loss. Contact us through the provided channel. No third parties. No recovery attempts. [Size: 462.3 MB | Sector: Government] |
||||||
| Ransomware | Albania's Official National Teacher Training Portal id31782 View details | Albania | Education | leaked | ||
|
Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. [Size: 5.9 GB | Sector: Education, Government] |
||||||
| Ransomware | Albania's official national teacher training portal. id31781 View details | Albania | Education | leaked | ||
|
Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. [Size: 5.9 GB | Sector: Education, Government] |
||||||
| Ransomware | City Government of Baguio id31597 View details | Philippines | Public Sector | leaked | ||
|
The City Government of Baguio stands as one of the wealthiest and most prominent local governments in the Philippines. This leak includes highly sensitive and confidential data, such as official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals, procurement records, and other classified administrative materials. [Size: 2.9 GB | Sector: Government, Finance, Construction] |
||||||