Skip to content

💻 Technology & Software

Software, SaaS, IT services, semiconductors, electronics · a shareable slice of the daily brief for stakeholders who only care about this industry · RSS feed

Victims L30D11▼ −2
Prior 30D13
Active actor L90DUnknown · 7
Active actor L90DN0n · 3
Active actor L90DQilin · 3

Today — 03 Nov 2026

No industry-tagged items in today's briefing — see recent activity below.

Last 14 days

GMO Internet Group's Onamae.com "Desktop Cloud" service — company-confirmed breach with direct financial-market fallout.CriticalFinancial ServicesTechnology & SoftwareAttackers compromised the Windows VPS service retail FX/forex traders use to run automated trading bots, planting malware and using the access to place unauthorized trades on customer accounts; GMO says up to 26,739 servers may have been affected. The attacker demanded a reported $50M in crypto (single-sourced figure, flagged 🟥); GMO refused and reported the incident to police, and the attacker's leak/payment site was reportedly shut down Oct 28. GMO will cover realized customer trading losses, pay a flat ¥5,000 goodwill payment to every current customer of the affected service, and offer free alternative services for six months; further compensation details are due by Nov 6. GMO shares fell roughly 16% to a four-month low on the disclosure. More than 70 securities/FX firms were reportedly threatened with knock-on exposure — an attacker claim, not yet independently confirmed scope. Two named brokers surfaced in coverage: OANDA Securities Japan (precautionary withdrawal delays) and AvaTrade Japan (confirmed unauthorized account access, no confirmed technical link to GMO established yet). MLex · Euronews
One further ransomware-claim lead, flagged as a claim only:MediumTechnology & SoftwareHisense is listed by WhiteArmor, a newly-emerged extortion brand (first victim Oct 21, six total listings so far), claiming ~19GB of Malaysia/Singapore warranty and customer records and demanding $5M in BTC. Hisense has not confirmed; single-sourced beyond the leak-site listing itself. Cybernews
Stolen UpdraftCentral keys are being used to backdoor WordPress sites at scale; fix released but doesn't remove existing implants.HighTechnology & SoftwareTeamUpdraft disclosed unauthorized access to its own site (Oct 17–18), exposing its customer database — names, emails, hashed passwords, 2FA settings, and the connection keys UpdraftCentral uses to manage linked WordPress installs. Attackers used stolen keys to execute commands and plant backdoors; Patchstack observed active abuse from Oct 18–19 continuing into this week. Up to ~400,000 sites carry an active key (a potential-exposure ceiling, not a confirmed-compromise count); payment data was unaffected. UpdraftPlus 1.26.13/2.26.13 (released Oct 19) auto-disconnects from UpdraftCentral but does not clean up any backdoor already planted — sites that connected before the fix need a manual compromise check. The Hacker News · BleepingComputer
GMO Internet confirms unauthorized access to its Onamae.com Desktop Cloud VPS service; up to 26,739 servers in the exposure pool.HighTechnology & SoftwareThe Japanese hosting giant confirmed malicious-program installation on Oct 20 and began suspending the service across all plans Oct 21. The company says it has not confirmed any leak of personal data and holds no payment-card data, but is urging all users to rotate IDs and passwords stored on affected servers — notable given the service's popularity for hosting forex/trading-bot setups, where credential theft has direct financial consequences distinct from a typical data breach. ASCII.jp
Railway discloses possible exposure of customer environment variables, says it is part of a wider campaign targeting AI-inference-provider credentials.HighTechnology & SoftwareThe cloud/PaaS platform's Oct 21 security disclosure reports an unauthorized party may have accessed encrypted environment variables and, for some, their decrypted contents — API keys and database/registry credentials. Railway paused deployments during the investigation, proactively notified upstream providers to revoke keys, and says early analysis points to a subset of users though it is advising all users to rotate credentials as a precaution. Railway · RuntimeWire
OVHcloud contains a supply-chain compromise of its CLI tool within 94 minutes (catch-up, Oct 19).MediumTechnology & SoftwareA compromised developer GitHub account swapped release binaries (CLI versions 0.11.0–0.15.0) for a secret-stealing payload; OVHcloud says it detected and shut it down the same day, shipped a clean 0.16.0, and found no other repository affected. One day outside the strict window but flagged as a catch-up given the supply-chain angle. The Stack
New extortion brand Mimori lists two notable software vendors — Aveva and OpenText — on its leak site the same week, 🟥 unverified.MediumTechnology & SoftwareAveva (the Schneider Electric-owned industrial/OT software vendor) and OpenText (enterprise software) both appear on Mimori's DLS via a single tracked aggregator (HookPhish); neither company has issued a statement and no second source corroborates either claim — treat strictly as claims, not confirmed breaches. HookPhish — Aveva · HookPhish — OpenText
A stolen application credential let attackers reach Microsoft 365 tenants through ConnectWise's Cloud Backup service, forcing the company to take the product offline.HighTechnology & SoftwareConnectWise disabled seven application identities and revoked associated certificates after Microsoft flagged unauthorized authentication attempts from an IP address on Oct 15; the attacker used the app's own identity to request Microsoft Entra ID access tokens rather than stealing individual passwords. Huntress identified at least 162–173 affected partner/customer tenants, with one report citing activity from the attacker's address against nearly 1,000. ConnectWise says it has found no evidence stored backups were accessed, but customers could not restore data while the service remained offline as of Oct 18. Company-confirmed. BleepingComputer · The Hacker News
Taiwanese cloud-deployment platform Zeabur confirms a second, broader breach in two months and is shutting down as a result.MediumTechnology & SoftwareThe founder says an external attacker gained unauthorized access to internal systems and some customer services on Oct 14, affecting account data, environment variables and tokens, with some Google Cloud dedicated servers also touched; this follows a narrower late-August incident. Zeabur says services wind down from Dec 1 with a full shutdown by Dec 31, and it will accept compensation claims from customers who suffered losses. Company-confirmed. Zeabur
Meta confirms a stolen employee credential let an outside party into some of its GitHub repositories, taking mostly source code plus personal data on roughly 1,500 people — a catch-up item disclosed Oct 13 and missed last week.MediumTechnology & SoftwareAbout 99% of what was taken was business data; Meta says its internal systems weren't touched, cut off the attacker, and has engaged GitHub's security team, regulators and law enforcement. SecurityWeek

Recent victim claims

Newest first, mapped to this industry from the victim database. Most are leak-site claims — verify before acting.

October 2026

Oct 21 GMO Internet (Onamae.com Desktop Cloud) Unknown Ransomware · technology · Japan GMO Internet disclosed unauthorized third-party access to its Onamae.com Desktop Cloud VPS service; malicious program installation confirmed Oct 20, 2026. Up to 26,739 servers potentially affected (exposure pool, not confirmed compromises) across all service plans, which GMO began suspending Oct 21. Company says it has not confirmed any leak of personal data and holds no payment-card data, but is urging all users to rotate IDs/passwords stored on affected servers given the service's popularity for forex/trading-bot hosting. · Sources: ASCII.jp
Oct 21 Railway Unknown Ransomware · technology · USA Cloud/PaaS platform disclosed Oct 21 anomalous activity on systems storing customer environment variables; an unauthorized party may have accessed encrypted variables and, for some, their decrypted contents (API keys, database/registry credentials). Railway says it believes this is part of a wider series of attacks on platform companies aimed at compromising AI-inference-provider credentials, has proactively notified upstream providers to revoke keys, and paused deployments during the investigation. Early analysis points to a subset of users; company urges all users to rotate environment variables as a precaution. · Sources: Railway · RuntimeWire
Oct 21 Hisense WhiteArmor Ransomware · consumer electronics · China WhiteArmor, a newly-emerged extortion group (first listing Oct 21, six total victims so far), claims ~19GB exfiltrated covering Malaysia/Singapore warranty records, customer data, invoices and contracts; demands $5M in BTC. Hisense has not confirmed. · Sources: Cybernews · SOCRadar
Oct 20 Aveva Mimori Ransomware · industrial automation software · UK Mimori leak-site listing claims data exfiltration from the Schneider Electric-owned industrial/OT software vendor; no company statement, no independent corroboration found beyond the single tracked aggregator listing -- treat as unverified claim. · Sources: HookPhish
Oct 20 OpenText Mimori Ransomware · software · Canada Mimori leak-site listing claims data exfiltration from the enterprise-software vendor; no company statement, no independent corroboration found beyond the single tracked aggregator listing -- treat as unverified claim. · Sources: HookPhish
Oct 18 SMIC US Company N0n Ransomware · technology (semiconductors) · USA N0n claims to have taken corporate files, payroll and financial documents from this Sunnyvale, CA entity described as the US arm of Semiconductor Manufacturing International Corporation; single-source claim, unconfirmed by the company. Both ransomware.live and RedPacket Security's own reporting note N0n's listings have included unverified or possibly fabricated victim claims -- treat this one as low-confidence even by DLS-claim standards. · Sources: RedPacket Security
Oct 18 ConnectWise (Cloud Backup / SkyKick) Unknown Ransomware · Technology · USA ConnectWise suspended customer access to its Cloud Backup service (formerly SkyKick Cloud Backup) after attackers used a stolen/compromised application identity -- not individual passwords -- to request Microsoft Entra ID access tokens and reach Microsoft 365 tenants. Microsoft reported unauthorized authentication attempts from an IP address on Oct 15; ConnectWise disabled seven application identities and revoked associated certificates. Huntress identified at least 162-173 affected partner/customer tenants; one report cites nearly 1,000 tenants showing activity from the attacker's address. ConnectWise says it has found no evidence stored backups were accessed, but customers could not restore data while the service remained offline as of Oct 18. · Sources: BleepingComputer · The Hacker News
Oct 14 Zeabur Unattributed Breach · Technology · Taiwan Cloud/app-deployment platform's founder confirmed an external attacker gained unauthorized access to internal systems and some customer services on Oct 14 -- a second, broader-scope breach following one in late August; account data, environment variables and tokens affected, with some Google Cloud dedicated servers also touched. Company-confirmed; the breach precipitated Zeabur's announced shutdown (services winding down from Dec 1, full shutdown by Dec 31). · Sources: Zeabur
Oct 13 Meta Platforms (employee GitHub data) Unknown Ransomware · technology · USA Meta disclosed Oct 13 that an outside party used a stolen employee credential to access some of Meta's GitHub repositories; about 99% of what was taken was business data (principally source code), with personal data on roughly 1,500 people (mostly US employees) in the remainder. Meta says its internal systems were not compromised, cut off the attacker's access, and is working with GitHub's security team, regulators and law enforcement; it is offering affected individuals credit and dark-web monitoring. · Sources: SecurityWeek
Oct 07 IDC Frontier (IDCF Cloud) Unattributed Breach · cloud services · Japan Ransomware attack triggered an automatic shutdown on IDCF Cloud (SoftBank Group subsidiary), affecting 495 companies and local governments; confirmed impacts include the Ibaraki Prefecture government and police websites, Kodaira city (Tokyo) website, and Nissui's logistics subsidiary order processing. IDC Frontier's own status reports say data in the 4 affected zones may only be recoverable from customers' own backups. No actor has claimed credit. · Sources: Nippon.com
Oct 07 Chibitek N0n Ransomware · IT services · USA N0n ransomware group claimed Chibitek, a New Jersey managed-IT and cybersecurity-services provider, alleging client financial records, network credentials and internal documents taken; a roughly four-day publication deadline was set for Oct 11. No independent corroboration -- SOCRadar found no supporting infostealer-log evidence -- and no company statement. Treat as an unverified claim. · Sources: SOCRadar
Oct 03 Aware, Inc. The Gentlemen Ransomware · Technology & Software · USA Biometrics/identity-verification SaaS vendor serving ~80 government agencies plus commercial clients; ~400GB claimed exfiltrated. Unverified DLS claim. · Sources: Ransomware.live
Oct 02 Mat Bao Corporation Rhysida Ransomware · IT Services · VN Vietnamese hosting/domain registrar; Rhysida claims ~746,108 files/106.8GB incl. government inspection records, business-registration records, national ID (CCCD) and passport data. Unverified claim. · Sources: Ransomware.live · RedPacket Security
Oct 02 Paessolucoes Panzer Ransomware · IT Services · BR Brazilian IT-services firm; listed on Panzer's leak site. Unverified claim. · Sources: Hendry Adrian
Oct 01 Fakturownia Unknown Ransomware · Technology · PL Polish e-invoicing platform (600K+ customers) confirms a breach of account/password-hash data and pre-2023 invoices. Poland's Finance Ministry confirms the national KSeF e-invoicing system itself was not affected. Company-confirmed, no attacker named. · Sources: The Record · TVP World
Oct 01 ProMind IT AuditTeam Ransomware · IT Services · IT Italian Odoo-ERP/IT consulting firm; listed on AuditTeam's leak site (a smaller group expanding from Asia into Europe), company website reportedly offline. Catch-up record, missed by the Oct1-3 sweeps. Unverified claim, no company confirmation. · Sources: HendryAdrian

September 2026

Sep 30 Software Answers PEAR Ransomware · software · USA Long-term-stay/corporate-housing vertical-market software company, a Banyan Software portfolio company; data-theft/extortion claim, no encryption, no scope disclosed, no company confirmation. · Sources: ransomware.live · DeXpose
Sep 28 BCX (Business Connexion) Incransom Ransomware · Technology · South Africa Telkom subsidiary ICT-services provider listed on Incransom's leak site; claim covers ~500GB (4.2M files/596K folders) including source code and technical documentation. Unverified claim, no company confirmation. · Sources: Ransomware.live
Sep 28 Groupe Proxitel Vexy Ransomware · Technology · France Avignon-based B2B connectivity/telecom/IT-services firm listed on Vexy's (new/emerging group) leak site; claim covers ~35GB exfiltrated with a roughly 31-day publication countdown. Unverified claim, no company confirmation. · Sources: Ransomware.live · FrenchBreaches
Sep 22 FinSoft (Kolibri retail back-office software) N0n Ransomware · technology & software · Uzbekistan N0n listed FinSoft, an Uzbek retail back-office software vendor, on its leak site, claiming client databases and platform data for 10+ retail chains (sales, stock, pricing, financial records) and threatening to publish one client database per day starting with 'keddo'. No company confirmation. DLS claim only. · Sources: SOCRadar
Sep 20 Acilnet Krybit Ransomware · technology & software · Turkey Krybit listed Acilnet, a Turkish technology firm, on its leak site Sep 20. No data scope or company confirmation disclosed. DLS claim only. · Sources: RedPacket Security
Sep 19 Schneider's Computing Arcus Media Ransomware · Technology & Software · Canada Arcus Media leak-site listing of the Canadian technology-sector firm; unverified DLS claim, no scope or sample data disclosed · Sources: https://www.hendryadrian.com/ransom-schneiders-computing-sep-2026/
Sep 18 Gyazo (Helpfeel) Unknown Ransomware · Technology & Software · Japan Helpfeel disclosed Sep 18 that an unidentified attacker exploited a vulnerability in Gyazo's image-upload server (initial access Sep 11, detected the same evening, vulnerability patched and access cut by early Sep 12) to run arbitrary commands and access Gyazo's database, exposing 23.62M user-related records and metadata tied to roughly 490M images. Company confirmed and reported to Japan's Personal Information Protection Commission Sep 15. · Sources: BleepingComputer · TheHackerNews
Sep 10 i2k2 Networks Vexy Ransomware · IT services / cloud hosting · IN New Delhi-based Indian cloud computing, web hosting, managed IT and disaster-recovery provider listed on Vexy's leak site Sep 10; over 100GB claimed exfiltrated, scope reported as employee and user records. Vexy is a newly observed group with only a handful of named victims to date; no vendor statement. 🟥 unverified DLS claim. · Sources: Ransomware.live
Sep 03 IDScan.net Unknown Ransomware · technology · US 153M+ US and Canadian driver's license scans (front/back, IR, UV images) offered on dark web via Nexus marketplace. FBI New Orleans field office opened investigation. Krebs traced data to IDScan.net (New Orleans, Louisiana). Nexus site went dark after Krebs reporting. Breach ongoing for over a year per seller claim. Clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment. · Sources: https://krebsonsecurity.com/2026/09/fbi-probes-service-selling-153m-drivers-licenses/ https://www.securityweek.com/153-million-driver-license-images-offered-on-dark-web/

August 2026

Aug 27 Displaydata Qilin Ransomware · Technology · UK DLS posting Aug 27; UK-based tech company specialising in electronic shelf labels; no data volume or proof of exfiltration provided; 🟥 unverified claim · Sources: https://www.redpacketsecurity.com/qilin-ransomware-victim-displaydata/ · https://ransomware.live/id/RGlzcGxheWRhdGFAcWlsaW4=
Aug 23 Clear Align Qilin Ransomware · Technology · USA Optical engineering company; Qilin DLS claim Aug 23 threatening data exposure · Sources: https://www.dexpose.io/qilin-ransomware-attack-on-clear-align/
Aug 22 PenLink Qilin Ransomware · Technology / Surveillance · USA Qilin ransomware DLS claim August 2026; PenLink is a US surveillance technology company providing investigative tools to law enforcement; data scope unconfirmed · Sources: https://www.galaxywarden.com/blog/breach/penlink-qilin-2026-08
Aug 22 Promatrix The Gentlemen Ransomware · Technology / IT Services · USA TheGentlemen ransomware DLS claim August 22 2026; Promatrix is a US IT services firm; data scope unconfirmed · Sources: https://www.ransomware.live/
Aug 20 Kingston Technology Everest Ransomware · Technology / Data Storage · USA Everest ransomware DLS claim August 20 2026; 9,438 files / 138.49 GB claimed exfiltrated; data described as APAC-focused (Taiwan, Japan, Korea, Thailand, Vietnam, India, Australia, NZ, Malaysia, Singapore); Kingston said operations unaffected; Kingston manufactures DRAM and flash storage · Sources: https://www.cyberdaily.au/security/14078-exclusive-ram-maker-kingston-technology-investigating-ransomware-claims
Aug 20 Capgemini Engineering Everest Ransomware · Technology / Professional Services · France Everest ransomware DLS listing August 20 2026 against Capgemini Engineering (formerly Altran, global engineering and technology services firm); data scope and impact unconfirmed · Sources: https://cypro.co.uk/insights/cyber-bulletins/everest-ransomware-claims-capgemini-engineering-listing/
Aug 18 Zebra Technologies Clop Extortion · Technology / RFID and Barcode Solutions · USA Clop listed Zebra Technologies (ZEBRA.COM; global provider of RFID, barcode, and enterprise mobile computing solutions; ~.6B annual revenue) on its DLS around August 18, 2026, claiming exfiltration of 8TB of sensitive data including critical databases and CAD files, consistent with the PTC Windchill/FlexPLM campaign (CVE-2026-12569). 8TB would be the largest single-organization claim in this campaign. DLS claim — extent of access and veracity unverified. · Sources: https://www.dexpose.io/clop-ransomware-targets-zebra-com-in-major-data-breach/
Aug 18 Logitech ShinyHunters Extortion · Technology / Consumer Electronics · USA ShinyHunters DLS claim August 18 2026 against Logitech and its Streamlabs streaming platform; payment deadline set for August 21; data scope and scale unconfirmed; no public statement from Logitech as of August 21 · Sources: https://www.cyberdaily.au/security/14076-pay-or-leak-shinyhunters-delivers-ultimatum-to-logitech
Aug 05 Allied Telesis Everest Ransomware · Networking / Technology · JPN Everest posted Allied Telesis (global networking solutions provider, Tokyo) on its DLS on August 5 2026; estimated attack date July 17 2026. Group threatened data leak unless demands met. DLS claim — scope unverified. · Sources: https://www.dexpose.io/everest-ransomware-group-targets-allied-telesis/

July 2026

Jul 29 StellarRAD Systems Space Bears Ransomware · Technology · US Posted to Space Bears DLS July 29; sector and data scope unconfirmed · Sources: https://www.ransomware.live/
Jul 29 Analog Devices ExfilSquad Ransomware · Technology (Semiconductors) · US Analog Devices filed SEC 8-K disclosing breach detected June 23 2026; ExfilSquad claimed 570,000+ records stolen; ADI says operations unaffected and no evidence data leaked or misused; investigation ongoing · Sources: https://www.securityweek.com/semiconductor-firm-analog-devices-discloses-data-breach/ https://www.bloomberg.com/news/articles/2026-07-29/analog-devices-discloses-data-breach-after-unauthorized-access
Jul 26 Wesco International ExfilSquad Ransomware · Technology/Distribution · USA Data extortion group ExfilSquad claims to have exfiltrated 2.6M records from Wesco cloud CRM environment (Jul 26 attack); leaked via torrents Aug 7; customer lists, shipment details, project pricing exposed; Wesco confirmed incident Aug 11; no ransomware encryption · Sources: https://www.bleepingcomputer.com/news/security/wesco-confirms-security-incident-after-exfilsquad-claims-data-theft/
Jul 25 SistNet Nova Ransomware · IT Services · Unknown DLS posting July 25 2026 by Nova group. IT services firm. Country and data scope unconfirmed. · Sources: https://www.ransomware.live/
Jul 20 Adventus LockBit Ransomware · IT services · SG Singapore-based IT company claimed on LockBit DLS July 20; no confirmation from organization · Sources: https://www.ransomware.live/ · https://www.breachsense.com/breaches/
Jul 20 Alzone Software Everest Ransomware · software/IT · IN India-based IT and software company claimed on Everest ransomware DLS July 20; no confirmation from organization · Sources: https://www.ransomware.live/ · https://www.breachsense.com/breaches/
Jul 18 NewNet S.A. DragonForce Ransomware · IT services · CO Colombian IT/business-services company claimed on DragonForce DLS July 18; no confirmation from organization · Sources: https://www.ransomware.live/group/dragonforce
Jul 14 Momenta DragonForce Ransomware · technology · CN Chinese AI and autonomous-driving company claimed on DragonForce DLS July 14; group claims access to source code, financial documents, and configuration files; unconfirmed · Sources: https://www.ransomware.live/group/dragonforce
Jul 14 Edison Global Networks Limited DragonForce Ransomware · Technology/MSP · Hong Kong Hong Kong-based IT systems integrator and MSP claimed on DragonForce DLS July 14; internal files alleged exfiltrated. No public statement. · Sources: https://www.hookphish.com/blog/ransomware-group-dragonforce-hits-edison-global-networks-limited/
Jul 12 Retelit SpA Qilin Ransomware · technology · Italy Italian IT services and telecommunications infrastructure provider claimed on Qilin DLS; data type and volume unconfirmed · Sources: ransomware.live · undercodenews.com
Jul 09 Inter Power Engineering Qilin Ransomware · electronics manufacturing · Singapore Qilin DLS claim July 9, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]
Jul 08 Accelirate Inc. Qilin Ransomware · IT services · intelligent automation/US Qilin DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/qilin · Sources: [SharkStriker] · [ransomware.live]
Jul 08 Printronix Brain Cipher Ransomware · technology · printer-hardware manufacturing/US industrial printer manufacturer; Brain Cipher DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/braincipher · Sources: [ransomware.live]
Jul 08 Conway Data Everest Ransomware · IT services · US Everest DLS claim July 8, 2026; data scope and impact unconfirmed; 🟥 unverified · https://sharkstriker.com/blog/ransomware-roundup/ · https://www.ransomware.live/group/everest · Sources: [SharkStriker] · [ransomware.live]
Jul 04 Sisint Qilin Ransomware · technology · Portugal Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]
Jul 04 Sitmatic GmbH Qilin Ransomware · IT services · Germany Qilin DLS claim July 4, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/qilin · Sources: [ransomware.live]
Jul 03 MakoLab S.A. The Gentlemen Ransomware · IT consulting · Poland Polish IT and digital transformation consultancy providing software development, cloud, and data analytics services; The Gentlemen DLS claim July 3, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]
Jul 02 Service IT WorldLeaks Ransomware · IT services · Brazil Brazilian IT services company; WorldLeaks DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.hendryadrian.com/ransom-service-it-jul-2026/ · https://www.ransomware.live/group/worldleaks · Sources: [hendryadrian.com] · [ransomware.live]
Jul 02 Fluke Corporation ShinyHunters Extortion · electronics · test-and-measurement manufacturing/US global manufacturer of electronic test and measurement equipment (subsidiary of Fortive Corporation; >3,000 employees); ShinyHunters DLS claim July 2, 2026 — over 21 million Salesforce records claimed including employee/customer PII; group described failed negotiations with victim before publishing; data scope unconfirmed; no Fluke or Fortive public statement; 🟥 unverified · https://www.redpacketsecurity.com/shinyhunters-ransomware-victim-fluke-corporation/ · https://www.ransomware.live/group/shinyhunters · Sources: [RedPacket Security] · [ransomware.live]
Jul 02 AAI Krybit Ransomware · electronics · manufacturing/Taiwan Krybit DLS claim July 2, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.ransomware.live/group/krybit · Sources: [ransomware.live]
Jul 01 Digital Dynamics Inc. Brain Cipher Ransomware · technology · US US technology company; Brain Cipher DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/ · Sources: [DeXpose]
Jul 01 CQCRM Icarus Ransomware · technology · unknown Icarus DLS claim July 1, 2026; 🟥 unverified · https://www.darkreading.com/cyberattacks-data-breaches/scope-salesforce-attacks-expands-icarus-leaks-data · Sources: [Dark Reading]
Jul 01 DISS Corporation / DISS Analytics KRYBIT Ransomware · analytics · digital solutions/US KRYBIT DLS claim July 1, 2026; data scope and impact unconfirmed; 🟥 unverified · https://socradar.io/free-tools/ransomware-intelligence/victims/diss-analytics · https://www.ransomware.live/group/krybit · Sources: [SOCRadar] · [ransomware.live]
Jul 01 Nidec Chaun Choung Technology Co., Ltd. Blackfield Ransomware · electronics manufacturing · Taiwan Taiwan-based subsidiary of Japan's Nidec Corporation (global precision motor and electronics manufacturer; Tokyo Stock Exchange Prime Market); Blackfield DLS claim confirmed July 1, 2026 (BleepingComputer); attack date June 22, 2026; $2M ransom demand; 2TB exfiltrated claimed; no Nidec public statement; 🟥 unverified · https://www.bleepingcomputer.com/news/security/blackfield-ransomware-targets-nidec-subsidiary-with-2m-ransom-demand/ · https://www.dexpose.io/ · Sources: [BleepingComputer] · [DeXpose]
Jul 01 ComTRI GmbH LockBit Ransomware · IT Services · Germany German IT services provider listed on LockBit 5.0 DLS approximately July 1 2026. DLS claim unverified by independent source. · Sources: https://www.ransomware.live/

June 2026

Jun 30 On-us Gunra Ransomware · technology · US DLS claim June 30, 2026; data scope and impact unconfirmed; 🟥 unverified · https://www.dexpose.io/gunra-strikes-on-us-in-new-ransomware-attack/ · Sources: [DeXpose]

← All industries · Victim database →