Trimaco (founded in 1906) is a manufacturer and worldwide distributor of surface protection and cleaning supplies to the construction, home improvement, and marine industries. Trimaco corporate office is located in 2300 Gateway Centre Blvd Ste 200, Morrisville, North Carolina, 27560, United States and has 224 employees. The total amount of data leakage is 228.10 GB”. The leaked data includes personal data of employees, access to work accounts, email newsletters, certificates, licenses, manuals, presentations of new products, technical and lab documentation, financial statements, accounting, invoices, customer, supplier and partner documentation, insurance agreements, confidential information and reporting, import and export data, as well as all contracts and agreements from 2014 to the current period.
💫
Trindel Insurance Fund – organization providing fiscal stability and effective risk control for Northern California Rural Counties. The Fund’s office is located at 51 Arbuckle Court, Weaverville, CA 96093.
Formed over 40 years ago by two counties to address an insurance crisis, Trindel now serves 12 member counties through a blend of banking and self-insurance pooling. The Fund operates under a Board of Directors, with two representatives from each county, and an executive committee elected annually. Day-to-day operations are managed by an Executive Director and a team of risk management professionals.
🇺🇸 US 51 Arbuckle Court, Weaverville, CA 96093
Trindel Insurance Fund – organization providing fiscal stability and effective risk control for Northern California Rural Counties. The Fund’s office is located at 51 Arbuckle Court, Weaverville, CA 96093.
Formed over 40 years ago by two counties to address an insurance crisis, Trindel now serves 12 member counties through a blend of banking and self-insurance pooling. The Fund operates under a Board of Directors, with two representatives from each county, and an executive committee elected annually. Day-to-day operations are managed by an Executive Director and a team of risk management professionals.
🇺🇸 US 51 Arbuckle Court, Weaverville, CA 96093
💫
JP Express is a large transport company providing cargo transportation. JP Express corporate office is located in PO Box 819, Deer Park, New York, 11729, United States and has 260 employees. The total amount of data leakage is 77.40 GB. (61,8 GB arc) The leaked data includes personal information of employees, driver’s licenses, photos, resumes, employment contracts, access to work accounts, email newsletters, certificates, licenses, financial statements, accounting, invoices, customer documentation, insurance agreements, logistics reports, confidential information and cargo reports, destinations and addresses, reports on completed trips, as well as all contracts and agreements of the company. 🇺🇸
❄️
JP Express is a large transport company providing cargo transportation. JP Express corporate office is located in PO Box 819, Deer Park, New York, 11729, United States and has 260 employees. The total amount of data leakage is 77.40 GB. (61,8 GB arc) The leaked data includes personal information of employees, driver’s licenses, photos, resumes, employment contracts, access to work accounts, email newsletters, certificates, licenses, financial statements, accounting, invoices, customer documentation, insurance agreements, logistics reports, confidential information and cargo reports, destinations and addresses, reports on completed trips, as well as all contracts and agreements of the company. 🇺🇸
❄️
💫
McFarland Commercial Insurance Services
McFarland Commercial Insurance Services – a company providing commercial insurance services in California since 2002. The company’s office is located at 833 Mistletoe Lane, Suite 102, Redding, CA 96002. The total amount of data leakage is 22 GB (arc). The leak includes employees' personal data, access to work accounts, email correspondence, logins and passwords, insurance licenses, client databases, financial records, accounting documents, invoices, contracts, commercial proposals, as well as confidential client and supplier data.
Redding City Hall, California, US 🇺🇸
McFarland Commercial Insurance Services
McFarland Commercial Insurance Services – a company providing commercial insurance services in California since 2002. The company’s office is located at 833 Mistletoe Lane, Suite 102, Redding, CA 96002. The total amount of data leakage is 22 GB (arc). The leak includes employees' personal data, access to work accounts, email correspondence, logins and passwords, insurance licenses, client databases, financial records, accounting documents, invoices, contracts, commercial proposals, as well as confidential client and supplier data.
Redding City Hall, California, US 🇺🇸
Dutch police with FBI support shut down AVCheck virus testing service
Dutch police, with support from the US and Finland, blocked the AVCheck service
🔹 AVCheck allowed checking if commercial antiviruses detected the virus. This is a key step before an attack.
🔹 Related services Cryptor.biz and Crypt.guru were also disabled (one seized, the other not working).
🔹 Undercover agents posing as clients participated in the operation.
Law enforcement shut down AVCheck servers and seized a user database containing their information (including usernames, email addresses, payment details, and more).
☝️ An authorization script was modified to activate webcams and determine locations.
Exercise caution and refrain from visiting.
Dutch police, with support from the US and Finland, blocked the AVCheck service
🔹 AVCheck allowed checking if commercial antiviruses detected the virus. This is a key step before an attack.
🔹 Related services Cryptor.biz and Crypt.guru were also disabled (one seized, the other not working).
🔹 Undercover agents posing as clients participated in the operation.
Law enforcement shut down AVCheck servers and seized a user database containing their information (including usernames, email addresses, payment details, and more).
☝️ An authorization script was modified to activate webcams and determine locations.
Exercise caution and refrain from visiting.
😈2
💫
eVent Medical – a company founded in March 2000 by respiratory therapists and engineers specializing in high-performance, cost-effective ventilators.
The company’s data breach includes 32 GB of leaked documents, primarily containing financial records related to equipment purchases and sales, as well as internal transaction details, vendor agreements, and procurement contracts.
60 Empire Dr, Lake Forest, CA 92630, United States 🇺🇸
👽 ❄️
eVent Medical – a company founded in March 2000 by respiratory therapists and engineers specializing in high-performance, cost-effective ventilators.
The company’s data breach includes 32 GB of leaked documents, primarily containing financial records related to equipment purchases and sales, as well as internal transaction details, vendor agreements, and procurement contracts.
60 Empire Dr, Lake Forest, CA 92630, United States 🇺🇸
👽 ❄️
💫
Automha (founded in 1979) is a company that develops automated data storage systems for warehouses. Automha's corporate office is located at Via Emilia, 6, Azzano San Paolo, Lombardy, 24052, Italy and has 114 employees. The total volume of leaked data is 308.9 GB. The leaked data includes personal data of employees, access to work accounts, email newsletters, certificates, licenses, financial statements, accounting records, invoices, customer documentation, confidential information and reporting, data on the contents of warehouses and storage facilities, a list of owners and regular customers.
👽
Automha (founded in 1979) is a company that develops automated data storage systems for warehouses. Automha's corporate office is located at Via Emilia, 6, Azzano San Paolo, Lombardy, 24052, Italy and has 114 employees. The total volume of leaked data is 308.9 GB. The leaked data includes personal data of employees, access to work accounts, email newsletters, certificates, licenses, financial statements, accounting records, invoices, customer documentation, confidential information and reporting, data on the contents of warehouses and storage facilities, a list of owners and regular customers.
👽
On January 21, 2026, the Clop group claimed responsibility for the attack on mcmathlaw.com.
McMath Woods P.A. (allegedly founded in 1953, Little Rock, Arkansas. Actual documents confirm activity since 2006) — a personal injury and consumer protection law firm. Staff: 7 partners + associated attorneys (12+ employees total). Offices in Little Rock and Fayetteville.
Leaked archive size: 855 GB
More than 350 GB is useless junk (police bodycam videos, police photos, etc.)
What leaked:
* Personal data of clients (including medical records) and employees
* Documentation of 5,000+ personal injury claims
* Internal correspondence and case strategy
* Financials, accounting, invoices, contracts, fee data
* Access to work accounts and corporate email
* Insurance payout databases, expert reports, client lists
* Litigation records and unpublished rulings
📌 Publication status:
The dataset has been published in open access.
💫
McMath Woods P.A. (allegedly founded in 1953, Little Rock, Arkansas. Actual documents confirm activity since 2006) — a personal injury and consumer protection law firm. Staff: 7 partners + associated attorneys (12+ employees total). Offices in Little Rock and Fayetteville.
Leaked archive size: 855 GB
More than 350 GB is useless junk (police bodycam videos, police photos, etc.)
What leaked:
* Personal data of clients (including medical records) and employees
* Documentation of 5,000+ personal injury claims
* Internal correspondence and case strategy
* Financials, accounting, invoices, contracts, fee data
* Access to work accounts and corporate email
* Insurance payout databases, expert reports, client lists
* Litigation records and unpublished rulings
📌 Publication status:
The dataset has been published in open access.
💫
On January 25, 2026, the ransomware group Clop claimed responsibility for the attack on excelas1.com.
Excelas LLC (founded in 2005, Cleveland, Ohio, USA) is a medical-legal company that provides medical record analysis and organization services for insurance firms, lawyers, and healthcare institutions. The company has 35 employees.
Total leaked archive size: 250 GB
What leaked:
* Medical records and patient medical histories
* Personal data of employees and patients
* Legal documentation related to medical claims and lawsuits
* Internal correspondence and case strategy
* Contracts, invoices, financial statements
* Access to work accounts and corporate email
* Insurance payout databases and expert reports
The full leak has been published.
Excelas LLC (founded in 2005, Cleveland, Ohio, USA) is a medical-legal company that provides medical record analysis and organization services for insurance firms, lawyers, and healthcare institutions. The company has 35 employees.
Total leaked archive size: 250 GB
What leaked:
* Medical records and patient medical histories
* Personal data of employees and patients
* Legal documentation related to medical claims and lawsuits
* Internal correspondence and case strategy
* Contracts, invoices, financial statements
* Access to work accounts and corporate email
* Insurance payout databases and expert reports
The full leak has been published.
📅 Date: January 21, 2026
(date of Clop group's public claim)
🦠 Attacker: Clop ransomware group
🎯 Compromised domain: KCDWORLDWIDE.COM
🏢 About the company:
KCD Worldwide is an international communications agency specializing in PR, event production, and digital marketing for the fashion, beauty, and luxury goods industries. The company has offices in New York, London, and Paris and works with leading global brands and designers.
📦 Total leaked archive size: ~ 6.79 TB
📂 What leaked:
• Contracts and commercial proposals
• Personal data of employees and freelancers
• Applicant resumes
• Event plans and promotional materials
• Installation and fashion show schematics
• Financial documentation — mostly useless garbage like taxi and hotel receipts
📸 Leak highlight:
The majority of the leak consists of photo materials. But if you look at them — don't be surprised that the company refused to pay the ransom. Because the photographers working for this company have two left hands. 🤷♂️
👽
(date of Clop group's public claim)
🦠 Attacker: Clop ransomware group
🎯 Compromised domain: KCDWORLDWIDE.COM
🏢 About the company:
KCD Worldwide is an international communications agency specializing in PR, event production, and digital marketing for the fashion, beauty, and luxury goods industries. The company has offices in New York, London, and Paris and works with leading global brands and designers.
📦 Total leaked archive size: ~ 6.79 TB
📂 What leaked:
• Contracts and commercial proposals
• Personal data of employees and freelancers
• Applicant resumes
• Event plans and promotional materials
• Installation and fashion show schematics
• Financial documentation — mostly useless garbage like taxi and hotel receipts
📸 Leak highlight:
The majority of the leak consists of photo materials. But if you look at them — don't be surprised that the company refused to pay the ransom. Because the photographers working for this company have two left hands. 🤷♂️
👽
🚨 In early 2026, Match Group, the owner of major dating apps, faced two major incidents: a hacker attack and a regulatory settlement with US authorities. Here's what you need to know.
1️⃣ Data breach (January 2026)
The hacker group ShinyHunters breached Match Group's systems using a vishing (voice phishing) attack.
➖ Hackers tricked an employee into giving up login credentials for Okta (single sign-on platform).
➖ This allowed access to internal dashboards and the AppsFlyer marketing platform.
What was stolen:
▫️ ~85,000 user email addresses
▫️ ~2 million mobile advertising IDs (MAIDs)
▫️ Internal documents, OkCupid logs, Hinge subscription transaction data
Important: passwords, financial data, and personal chat history were not compromised.
⚠️ Main risk: phishing emails sent to the leaked email addresses.
2️⃣ FTC settlement (March 2026)
The US Federal Trade Commission reached a settlement with OkCupid (a Match Group subsidiary) over hidden data sharing.
1️⃣ Data breach (January 2026)
The hacker group ShinyHunters breached Match Group's systems using a vishing (voice phishing) attack.
➖ Hackers tricked an employee into giving up login credentials for Okta (single sign-on platform).
➖ This allowed access to internal dashboards and the AppsFlyer marketing platform.
What was stolen:
▫️ ~85,000 user email addresses
▫️ ~2 million mobile advertising IDs (MAIDs)
▫️ Internal documents, OkCupid logs, Hinge subscription transaction data
Important: passwords, financial data, and personal chat history were not compromised.
⚠️ Main risk: phishing emails sent to the leaked email addresses.
2️⃣ FTC settlement (March 2026)
The US Federal Trade Commission reached a settlement with OkCupid (a Match Group subsidiary) over hidden data sharing.
🔐 FROST BANK DATA LEAK
📅 Incident date: April 20, 2026
(date of data sample publication by the Everest group)
🦠 Attacker: Everest ransomware group (Russian-speaking RaaS operation)
🎯 Affected organization: Frost Bank — a major bank headquartered in San Antonio, Texas, with branches across the state
👥 Customers affected: Over 250,000 people (according to hackers)
📂 What leaked (based on data samples):
• Full customer names
• Social Security numbers (SSN)
• Tax Identification Numbers (TIN)
• Home addresses
• Income and taxable amount data
• Mortgage interest rates
• Investment profits
⚠️ Important note: Experts from Cybernews who analyzed the data samples could not confirm with absolute certainty that the data belongs to Frost Bank.
🏢 Bank's official position:
A Frost Bank representative stated that a third-party vendor notified the bank of "unauthorized access to their systems." According to the bank, its own systems were not compromised.
⚖️ Legal consequences:
The law firm Goldenberg Schneider, LPA is investigating the incident and is already accepting inquiries from affected customers to assess their rights to compensation.
📌 Publication status:
Data samples were published on the Dark Web. The total volume of the leaked archive has not been disclosed at this time.
🔄 Update as of April 27, 2026:
The notice about this leak has been removed from the Everest group's website.
📅 Incident date: April 20, 2026
(date of data sample publication by the Everest group)
🦠 Attacker: Everest ransomware group (Russian-speaking RaaS operation)
🎯 Affected organization: Frost Bank — a major bank headquartered in San Antonio, Texas, with branches across the state
👥 Customers affected: Over 250,000 people (according to hackers)
📂 What leaked (based on data samples):
• Full customer names
• Social Security numbers (SSN)
• Tax Identification Numbers (TIN)
• Home addresses
• Income and taxable amount data
• Mortgage interest rates
• Investment profits
⚠️ Important note: Experts from Cybernews who analyzed the data samples could not confirm with absolute certainty that the data belongs to Frost Bank.
🏢 Bank's official position:
A Frost Bank representative stated that a third-party vendor notified the bank of "unauthorized access to their systems." According to the bank, its own systems were not compromised.
⚖️ Legal consequences:
The law firm Goldenberg Schneider, LPA is investigating the incident and is already accepting inquiries from affected customers to assess their rights to compensation.
📌 Publication status:
Data samples were published on the Dark Web. The total volume of the leaked archive has not been disclosed at this time.
🔄 Update as of April 27, 2026:
The notice about this leak has been removed from the Everest group's website.
🔐 INCIDENT: ANSTECHINC.COM
📅 Date: February 10, 2026
(date of Clop group's public claim)
🎯 Compromised domain: ANSTECHINC.COM
🏢 About the company:
A US-based company.
📦 Total leaked archive size: 232 (259) GB
📂 What leaked:
• Contracts and commercial proposals
• Personal data of employees (fewer than 10 people)
• Financial documentation
• Credit card statements
• Candidate resumes
!?! • Product photos and prices from a small retail chain !?! (160 GB of garbage)
• Certificates of Insurance
⚠️ Leak status:
The full leak has been published — which is quite expected, because the archive contains nothing valuable enough to pay for.
🤷 The only mystery about this little outfit is that it amounts to nothing.
I think these idiots were hacked just for laughs.
📅 Date: February 10, 2026
(date of Clop group's public claim)
🎯 Compromised domain: ANSTECHINC.COM
🏢 About the company:
A US-based company.
📦 Total leaked archive size: 232 (259) GB
📂 What leaked:
• Contracts and commercial proposals
• Personal data of employees (fewer than 10 people)
• Financial documentation
• Credit card statements
• Candidate resumes
!?! • Product photos and prices from a small retail chain !?! (160 GB of garbage)
• Certificates of Insurance
⚠️ Leak status:
The full leak has been published — which is quite expected, because the archive contains nothing valuable enough to pay for.
🤷 The only mystery about this little outfit is that it amounts to nothing.
I think these idiots were hacked just for laughs.
😁1
🔐 INCIDENT: MCDONALD'S INDIA
📅 Incident date: January 20, 2026
(date of Everest group's dark web claim)
🎯 Affected organization: McDonald's India — Indian subsidiary of the fast-food giant. Operates through two entities: Connaught Plaza Restaurants (North & East) and Hardcastle Restaurants (West & South)
📦 Alleged leaked archive size: 861 GB
📂 What allegedly leaked (according to hackers):
• Financial reports and audit trails
• Pricing data
• Sensitive internal communications
• Contact database of investors and partners from the US, UK, Singapore, and India
• Internal store-level data including manager names and contact numbers for dozens of outlets
• Customer personal data
• Access to accounting/ERP systems (month-by-month directory breakdown)
⚠️ Leak status:
The full leak has been published.
📜 Context (previous incidents):
• 2017: ~2.2 million customer records leaked via McDelivery app
• 2024: API vulnerabilities in delivery system allowed ordering for $0.01, order hijacking, and driver tracking (fixed in September)
📅 Incident date: January 20, 2026
(date of Everest group's dark web claim)
🎯 Affected organization: McDonald's India — Indian subsidiary of the fast-food giant. Operates through two entities: Connaught Plaza Restaurants (North & East) and Hardcastle Restaurants (West & South)
📦 Alleged leaked archive size: 861 GB
📂 What allegedly leaked (according to hackers):
• Financial reports and audit trails
• Pricing data
• Sensitive internal communications
• Contact database of investors and partners from the US, UK, Singapore, and India
• Internal store-level data including manager names and contact numbers for dozens of outlets
• Customer personal data
• Access to accounting/ERP systems (month-by-month directory breakdown)
⚠️ Leak status:
The full leak has been published.
📜 Context (previous incidents):
• 2017: ~2.2 million customer records leaked via McDelivery app
• 2024: API vulnerabilities in delivery system allowed ordering for $0.01, order hijacking, and driver tracking (fixed in September)
📡 FLYBOYS FLIGHT CENTER DATA BREACH
🎯 Organization: FlyBoys Flight Center (USA)
📂 Leak volume: 5.41 GB
📅 Incident date: July 2024
🦠 Attacker: Medusa ransomware group
📄 Content: According to the source, the archive contains training programs, courses, certificates, financial reports, and other internal documentation.
📌 Publication status: The data was published on Medusa's leak site in July 2024. A 5.41 GB file archive is currently in open access.
🎯 Organization: FlyBoys Flight Center (USA)
📂 Leak volume: 5.41 GB
📅 Incident date: July 2024
🦠 Attacker: Medusa ransomware group
📄 Content: According to the source, the archive contains training programs, courses, certificates, financial reports, and other internal documentation.
📌 Publication status: The data was published on Medusa's leak site in July 2024. A 5.41 GB file archive is currently in open access.
🔐 TOKOPARTS.COM DATA BREACH — 79 GB
🎯 Organization: Tokoparts (PT Suku Cadang Oto Sejahtera) — Indonesian auto parts supplier
📂 Volume: 79 GB, 29,425 files
📅 Data period: 2020–2026
📂 What leaked:
• Financial reports: P&L, balance sheets for 2024–2025, consolidation package for Mitsubishi Corporation (April 10, 2026)
• Banking data: BCA and MUFG statements, all transactions
• Taxes: SPT PPh 21,23,26 filings, VAT (PPN) for 2022–2024
• Customer database: 463 corporate clients, 11,272 invoices, AR outstanding 10.5 billion IDR (87% overdue)
• Orders: 33,041 orders from 381 buyers (66 fields per record)
• Delivery documents: 15,000+ photos of delivery slips (signatures, addresses, couriers) — latest dated April 7, 2026
• Supplier pricing: Toyota, Honda, Mitsubishi, Mercedes-Benz, Shell, Denso, Isuzu, Mazda, and others
• Active NDAs: with Mitsubishi Corp (valid until June 2026), with MUC Consulting (perpetual term)
• Personal data: passport of President Director (Japanese national), KTP IDs, bank account details of supplier directors, data of 20+ Tokoparts employees
• SAP HANA, WMS, supply chain data, business plans, forecasts
⚠️ Note: All three NDAs were active at the time of the breach. Data includes documents submitted to Mitsubishi Corporation just days before publication.
📌 Status: 79 GB archive is publicly available.
🎯 Organization: Tokoparts (PT Suku Cadang Oto Sejahtera) — Indonesian auto parts supplier
📂 Volume: 79 GB, 29,425 files
📅 Data period: 2020–2026
📂 What leaked:
• Financial reports: P&L, balance sheets for 2024–2025, consolidation package for Mitsubishi Corporation (April 10, 2026)
• Banking data: BCA and MUFG statements, all transactions
• Taxes: SPT PPh 21,23,26 filings, VAT (PPN) for 2022–2024
• Customer database: 463 corporate clients, 11,272 invoices, AR outstanding 10.5 billion IDR (87% overdue)
• Orders: 33,041 orders from 381 buyers (66 fields per record)
• Delivery documents: 15,000+ photos of delivery slips (signatures, addresses, couriers) — latest dated April 7, 2026
• Supplier pricing: Toyota, Honda, Mitsubishi, Mercedes-Benz, Shell, Denso, Isuzu, Mazda, and others
• Active NDAs: with Mitsubishi Corp (valid until June 2026), with MUC Consulting (perpetual term)
• Personal data: passport of President Director (Japanese national), KTP IDs, bank account details of supplier directors, data of 20+ Tokoparts employees
• SAP HANA, WMS, supply chain data, business plans, forecasts
⚠️ Note: All three NDAs were active at the time of the breach. Data includes documents submitted to Mitsubishi Corporation just days before publication.
📌 Status: 79 GB archive is publicly available.
🔐 BEST PRICE FINANCIAL SERVICES DATA BREACH
📅 Incident date: July 23–25, 2025
🦠 Attacker: Everest ransomware group
🎯 Affected organization: Best Price Financial Services — a UK-based independent financial services provider, regulated by the Financial Conduct Authority (FCA). The company offers life insurance, income protection, critical illness coverage, and operates an online price comparison tool.
📂 What leaked (based on initial publication):
• Internal documents (screenshots published on dark web leak site)
• Potentially client data, internal communications, financial records
⚠️ Important note: The full dataset has been published.
📌 Publication status: The victim was added to Everest's dark web leak site on July 25, 2025.
⚖️ Regulatory consequences: As an FCA-regulated financial services provider, the company handles sensitive client financial data. A full leak could trigger regulatory fines and client compensation claims.
📅 Incident date: July 23–25, 2025
🦠 Attacker: Everest ransomware group
🎯 Affected organization: Best Price Financial Services — a UK-based independent financial services provider, regulated by the Financial Conduct Authority (FCA). The company offers life insurance, income protection, critical illness coverage, and operates an online price comparison tool.
📂 What leaked (based on initial publication):
• Internal documents (screenshots published on dark web leak site)
• Potentially client data, internal communications, financial records
⚠️ Important note: The full dataset has been published.
📌 Publication status: The victim was added to Everest's dark web leak site on July 25, 2025.
⚖️ Regulatory consequences: As an FCA-regulated financial services provider, the company handles sensitive client financial data. A full leak could trigger regulatory fines and client compensation claims.
🔐 CITIZENS BANK DATA BREACH
📅 Incident date: April 2026
🦠 Attacker: Everest ransomware group
🎯 Organization affected: Citizens Bank (major U.S. bank, corporate HQ in Providence, Rhode Island)
👥 Customers affected (bank's statement): "several thousand"
📊 Attackers' claim: ~3.4 million records (bank calls this figure "generally inaccurate")
📂 What leaked (per Citizens Bank's official statement):
• Customer names
• Home addresses
• Bank account numbers (data found on a paper check)
❌ Social Security numbers (SSN) — NOT compromised
Customer class-action lawsuits claim that credit card numbers and passport numbers may also have been affected, but there is no official confirmation from the bank.
📌 Publication status:
The publication timer on Everest's leak site has been reset twice. As of now, no public links to the stolen data have been released.
🔄 Note: The breach occurred at a third-party vendor, not within Citizens Bank's own network.
📅 Incident date: April 2026
🦠 Attacker: Everest ransomware group
🎯 Organization affected: Citizens Bank (major U.S. bank, corporate HQ in Providence, Rhode Island)
👥 Customers affected (bank's statement): "several thousand"
📊 Attackers' claim: ~3.4 million records (bank calls this figure "generally inaccurate")
📂 What leaked (per Citizens Bank's official statement):
• Customer names
• Home addresses
• Bank account numbers (data found on a paper check)
❌ Social Security numbers (SSN) — NOT compromised
Customer class-action lawsuits claim that credit card numbers and passport numbers may also have been affected, but there is no official confirmation from the bank.
📌 Publication status:
The publication timer on Everest's leak site has been reset twice. As of now, no public links to the stolen data have been released.
🔄 Note: The breach occurred at a third-party vendor, not within Citizens Bank's own network.
🔐 NISSAN MOTOR CORPORATION DATA BREACH
📅 Incident date: January 10, 2026 (attackers' public disclosure)
🦠 Attacker: Everest ransomware group
🎯 Organization affected: Nissan Motor Corporation (Japanese automaker, North American operations – USA and Canada)
👥 Affected (attackers' claim): 900–910 GB of data (17+ million VIN numbers)
Based on DataBreach.com analysis of leaked files:
• 17,119,482 VIN numbers
• 4,193,509 full names
• 4,055,146 postal addresses
• 2,685,720 phone numbers
• 2,045,754 email addresses
• 2,736 dates of birth
⚠️ IMPORTANT NOTE:
The breach occurred at a third-party vendor (GCSSD) that serviced Nissan and Infiniti dealerships in North America — not at Nissan itself.
📅 Incident date: January 10, 2026 (attackers' public disclosure)
🦠 Attacker: Everest ransomware group
🎯 Organization affected: Nissan Motor Corporation (Japanese automaker, North American operations – USA and Canada)
👥 Affected (attackers' claim): 900–910 GB of data (17+ million VIN numbers)
Based on DataBreach.com analysis of leaked files:
• 17,119,482 VIN numbers
• 4,193,509 full names
• 4,055,146 postal addresses
• 2,685,720 phone numbers
• 2,045,754 email addresses
• 2,736 dates of birth
⚠️ IMPORTANT NOTE:
The breach occurred at a third-party vendor (GCSSD) that serviced Nissan and Infiniti dealerships in North America — not at Nissan itself.
🔐 INCIDENT: ITARCHITECHS.COM
📅 Attacker's claim date: February 10, 2026 (Clop group)
📅 Data publication date: February 14, 2026
🎯 Compromised domain: ITARCHITECHS.COM
🏢 About the company: Technology services provider / IT company based in the United States.
📦 Total leaked archive size: 52.2 GB
📂 What leaked:
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
⚠️ Leak status: Fully published. As of now, 52.2 GB of data is publicly available.
📅 Attacker's claim date: February 10, 2026 (Clop group)
📅 Data publication date: February 14, 2026
🎯 Compromised domain: ITARCHITECHS.COM
🏢 About the company: Technology services provider / IT company based in the United States.
📦 Total leaked archive size: 52.2 GB
📂 What leaked:
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
⚠️ Leak status: Fully published. As of now, 52.2 GB of data is publicly available.