💫
eVent Medical – a company founded in March 2000 by respiratory therapists and engineers specializing in high-performance, cost-effective ventilators.
The company’s data breach includes 32 GB of leaked documents, primarily containing financial records related to equipment purchases and sales, as well as internal transaction details, vendor agreements, and procurement contracts.
60 Empire Dr, Lake Forest, CA 92630, United States 🇺🇸
👽 ❄️

💫
Automha (founded in 1979) is a company that develops automated data storage systems for warehouses. Automha's corporate office is located at Via Emilia, 6, Azzano San Paolo, Lombardy, 24052, Italy and has 114 employees. The total volume of leaked data is 308.9 GB. The leaked data includes personal data of employees, access to work accounts, email newsletters, certificates, licenses, financial statements, accounting records, invoices, customer documentation, confidential information and reporting, data on the contents of warehouses and storage facilities, a list of owners and regular customers.

👽

On January 21, 2026, the Clop group claimed responsibility for the attack on mcmathlaw.com.

McMath Woods P.A. (allegedly founded in 1953, Little Rock, Arkansas. Actual documents confirm activity since 2006) — a personal injury and consumer protection law firm. Staff: 7 partners + associated attorneys (12+ employees total). Offices in Little Rock and Fayetteville.

Leaked archive size: 855 GB
More than 350 GB is useless junk (police bodycam videos, police photos, etc.)

What leaked:

* Personal data of clients (including medical records) and employees
* Documentation of 5,000+ personal injury claims
* Internal correspondence and case strategy
* Financials, accounting, invoices, contracts, fee data
* Access to work accounts and corporate email
* Insurance payout databases, expert reports, client lists
* Litigation records and unpublished rulings

📌 Publication status:
The dataset has been published in open access.

💫

On January 25, 2026, the ransomware group Clop claimed responsibility for the attack on excelas1.com.

Excelas LLC (founded in 2005, Cleveland, Ohio, USA) is a medical-legal company that provides medical record analysis and organization services for insurance firms, lawyers, and healthcare institutions. The company has 35 employees.

Total leaked archive size: 250 GB

What leaked:

* Medical records and patient medical histories
* Personal data of employees and patients
* Legal documentation related to medical claims and lawsuits
* Internal correspondence and case strategy
* Contracts, invoices, financial statements
* Access to work accounts and corporate email
* Insurance payout databases and expert reports

The full leak has been published.

📅 Date: January 21, 2026
(date of Clop group's public claim)

🦠 Attacker: Clop ransomware group

🎯 Compromised domain: KCDWORLDWIDE.COM

🏢 About the company:
KCD Worldwide is an international communications agency specializing in PR, event production, and digital marketing for the fashion, beauty, and luxury goods industries. The company has offices in New York, London, and Paris and works with leading global brands and designers.

📦 Total leaked archive size: ~ 6.79 TB

📂 What leaked:

• Contracts and commercial proposals
• Personal data of employees and freelancers
• Applicant resumes
• Event plans and promotional materials
• Installation and fashion show schematics
• Financial documentation — mostly useless garbage like taxi and hotel receipts

📸 Leak highlight:
The majority of the leak consists of photo materials. But if you look at them — don't be surprised that the company refused to pay the ransom. Because the photographers working for this company have two left hands. 🤷‍♂️

👽

🚨 In early 2026, Match Group, the owner of major dating apps, faced two major incidents: a hacker attack and a regulatory settlement with US authorities. Here's what you need to know.

1️⃣ Data breach (January 2026)

The hacker group ShinyHunters breached Match Group's systems using a vishing (voice phishing) attack.

➖ Hackers tricked an employee into giving up login credentials for Okta (single sign-on platform).
➖ This allowed access to internal dashboards and the AppsFlyer marketing platform.

What was stolen:
▫️ ~85,000 user email addresses
▫️ ~2 million mobile advertising IDs (MAIDs)
▫️ Internal documents, OkCupid logs, Hinge subscription transaction data

Important: passwords, financial data, and personal chat history were not compromised.

⚠️ Main risk: phishing emails sent to the leaked email addresses.
2️⃣ FTC settlement (March 2026)
The US Federal Trade Commission reached a settlement with OkCupid (a Match Group subsidiary) over hidden data sharing.

🔐 FROST BANK DATA LEAK

📅 Incident date: April 20, 2026
(date of data sample publication by the Everest group)

🦠 Attacker: Everest ransomware group (Russian-speaking RaaS operation)

🎯 Affected organization: Frost Bank — a major bank headquartered in San Antonio, Texas, with branches across the state

👥 Customers affected: Over 250,000 people (according to hackers)

📂 What leaked (based on data samples):

• Full customer names
• Social Security numbers (SSN)
• Tax Identification Numbers (TIN)
• Home addresses
• Income and taxable amount data
• Mortgage interest rates
• Investment profits

⚠️ Important note: Experts from Cybernews who analyzed the data samples could not confirm with absolute certainty that the data belongs to Frost Bank.

🏢 Bank's official position:
A Frost Bank representative stated that a third-party vendor notified the bank of "unauthorized access to their systems." According to the bank, its own systems were not compromised.

⚖️ Legal consequences:
The law firm Goldenberg Schneider, LPA is investigating the incident and is already accepting inquiries from affected customers to assess their rights to compensation.

📌 Publication status:
Data samples were published on the Dark Web. The total volume of the leaked archive has not been disclosed at this time.

🔄 Update as of April 27, 2026:
The notice about this leak has been removed from the Everest group's website.

🔐 INCIDENT: ANSTECHINC.COM

📅 Date: February 10, 2026
(date of Clop group's public claim)

🎯 Compromised domain: ANSTECHINC.COM

🏢 About the company:
A US-based company.

📦 Total leaked archive size: 232 (259) GB

📂 What leaked:

• Contracts and commercial proposals
• Personal data of employees (fewer than 10 people)
• Financial documentation
• Credit card statements
• Candidate resumes
!?! • Product photos and prices from a small retail chain !?! (160 GB of garbage)
• Certificates of Insurance

⚠️ Leak status:
The full leak has been published — which is quite expected, because the archive contains nothing valuable enough to pay for.

🤷 The only mystery about this little outfit is that it amounts to nothing.
I think these idiots were hacked just for laughs.

🔐 INCIDENT: MCDONALD'S INDIA

📅 Incident date: January 20, 2026
(date of Everest group's dark web claim)

🎯 Affected organization: McDonald's India — Indian subsidiary of the fast-food giant. Operates through two entities: Connaught Plaza Restaurants (North & East) and Hardcastle Restaurants (West & South)

📦 Alleged leaked archive size: 861 GB

📂 What allegedly leaked (according to hackers):

• Financial reports and audit trails
• Pricing data
• Sensitive internal communications
• Contact database of investors and partners from the US, UK, Singapore, and India
• Internal store-level data including manager names and contact numbers for dozens of outlets
• Customer personal data
• Access to accounting/ERP systems (month-by-month directory breakdown)

⚠️ Leak status:
The full leak has been published.

📜 Context (previous incidents):
• 2017: ~2.2 million customer records leaked via McDelivery app
• 2024: API vulnerabilities in delivery system allowed ordering for $0.01, order hijacking, and driver tracking (fixed in September)

📡 FLYBOYS FLIGHT CENTER DATA BREACH

🎯 Organization: FlyBoys Flight Center (USA)

📂 Leak volume: 5.41 GB

📅 Incident date: July 2024

🦠 Attacker: Medusa ransomware group

📄 Content: According to the source, the archive contains training programs, courses, certificates, financial reports, and other internal documentation.

📌 Publication status: The data was published on Medusa's leak site in July 2024. A 5.41 GB file archive is currently in open access.

🔐 TOKOPARTS.COM DATA BREACH — 79 GB

🎯 Organization: Tokoparts (PT Suku Cadang Oto Sejahtera) — Indonesian auto parts supplier

📂 Volume: 79 GB, 29,425 files

📅 Data period: 2020–2026

📂 What leaked:

• Financial reports: P&L, balance sheets for 2024–2025, consolidation package for Mitsubishi Corporation (April 10, 2026)
• Banking data: BCA and MUFG statements, all transactions
• Taxes: SPT PPh 21,23,26 filings, VAT (PPN) for 2022–2024
• Customer database: 463 corporate clients, 11,272 invoices, AR outstanding 10.5 billion IDR (87% overdue)
• Orders: 33,041 orders from 381 buyers (66 fields per record)
• Delivery documents: 15,000+ photos of delivery slips (signatures, addresses, couriers) — latest dated April 7, 2026
• Supplier pricing: Toyota, Honda, Mitsubishi, Mercedes-Benz, Shell, Denso, Isuzu, Mazda, and others
• Active NDAs: with Mitsubishi Corp (valid until June 2026), with MUC Consulting (perpetual term)
• Personal data: passport of President Director (Japanese national), KTP IDs, bank account details of supplier directors, data of 20+ Tokoparts employees
• SAP HANA, WMS, supply chain data, business plans, forecasts

⚠️ Note: All three NDAs were active at the time of the breach. Data includes documents submitted to Mitsubishi Corporation just days before publication.

📌 Status: 79 GB archive is publicly available.

🔐 BEST PRICE FINANCIAL SERVICES DATA BREACH
📅 Incident date: July 23–25, 2025

🦠 Attacker: Everest ransomware group

🎯 Affected organization: Best Price Financial Services — a UK-based independent financial services provider, regulated by the Financial Conduct Authority (FCA). The company offers life insurance, income protection, critical illness coverage, and operates an online price comparison tool.

📂 What leaked (based on initial publication):

• Internal documents (screenshots published on dark web leak site)
• Potentially client data, internal communications, financial records

⚠️ Important note: The full dataset has been published.

📌 Publication status: The victim was added to Everest's dark web leak site on July 25, 2025.

⚖️ Regulatory consequences: As an FCA-regulated financial services provider, the company handles sensitive client financial data. A full leak could trigger regulatory fines and client compensation claims.

🔐 CITIZENS BANK DATA BREACH
📅 Incident date: April 2026

🦠 Attacker: Everest ransomware group

🎯 Organization affected: Citizens Bank (major U.S. bank, corporate HQ in Providence, Rhode Island)

👥 Customers affected (bank's statement): "several thousand"
📊 Attackers' claim: ~3.4 million records (bank calls this figure "generally inaccurate")

📂 What leaked (per Citizens Bank's official statement):

• Customer names
• Home addresses
• Bank account numbers (data found on a paper check)

❌ Social Security numbers (SSN) — NOT compromised

Customer class-action lawsuits claim that credit card numbers and passport numbers may also have been affected, but there is no official confirmation from the bank.

📌 Publication status:
The publication timer on Everest's leak site has been reset twice. As of now, no public links to the stolen data have been released.

🔄 Note: The breach occurred at a third-party vendor, not within Citizens Bank's own network.

🔐 NISSAN MOTOR CORPORATION DATA BREACH
📅 Incident date: January 10, 2026 (attackers' public disclosure)

🦠 Attacker: Everest ransomware group

🎯 Organization affected: Nissan Motor Corporation (Japanese automaker, North American operations – USA and Canada)

👥 Affected (attackers' claim): 900–910 GB of data (17+ million VIN numbers)

Based on DataBreach.com analysis of leaked files:
• 17,119,482 VIN numbers
• 4,193,509 full names
• 4,055,146 postal addresses
• 2,685,720 phone numbers
• 2,045,754 email addresses
• 2,736 dates of birth

⚠️ IMPORTANT NOTE:

The breach occurred at a third-party vendor (GCSSD) that serviced Nissan and Infiniti dealerships in North America — not at Nissan itself.

🔐 INCIDENT: ITARCHITECHS.COM

📅 Attacker's claim date: February 10, 2026 (Clop group)
📅 Data publication date: February 14, 2026

🎯 Compromised domain: ITARCHITECHS.COM

🏢 About the company: Technology services provider / IT company based in the United States.

📦 Total leaked archive size: 52.2 GB

📂 What leaked:

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data

⚠️ Leak status: Fully published. As of now, 52.2 GB of data is publicly available.

🔐 INCIDENT: HUDSON EXECUTIVE CAPITAL LP

📅 Attacker's claim date: February 10, 2026 (Clop group)

🎯 Compromised domain: HUDSONEXECUTIVE.COM

🏢 About the company: Hudson Executive Capital LP — SEC-registered investment adviser based in New York, USA. Specializes in strategic investments across Financials, Healthcare, Technology, and Media sectors.

📦 Total leaked archive size: Not specified (detailed corporate compliance dump)

📂 What leaked (based on detailed analysis of published data):

The attackers have released a detailed dump of the corporate compliance department folder — practically a complete copy of Hudson Executive Capital's internal documentation.

1. Full Compliance Control Structure (Crown Jewel)
Documents revealing how the company monitors employees and reports to regulators (SEC, FINRA):

Personal Trading / Code of Ethics:

Detailed logs of employee trading requests for approval (HEC - Employee Trading Requests)

Employee personal brokerage account statements (with account numbers)

Annual holdings certifications — showing what employees owned and traded

CEO Partners:

Folder dedicated to former CEOs serving as fund advisors

Personal data including affiliations, signed conflict of interest certificates, conflict clearances for deal participation

Passport copies / photos (CEO Partners - Photos)

Policies & Procedures:

Complete archive of internal policies: Code of Ethics, Compliance Manual, AML Policy, Cybersecurity Policy, Business Continuity Plan — the blueprint of their compliance system

Internal Investigations and Incidents:

"Memos to File" and "Violation of compliance policy" folders

Contains memos about unintentional information disclosure, trading errors, potential internal rule violations (e.g., trading on spouse's personal account)

2. Confidential Correspondence and External Communications
Email files (.msg) revealing sensitive discussions:

Marketing Material Approvals:

Email chains where CEO or CCO approve investor presentations and fact sheets (Marketing Review folders) — revealing what and how they told investors

Regulator and Auditor Communications:

Correspondence with SEC, FINRA, Walkers lawyers (Cayman Islands) regarding AML, FATCA, Private Funds Law

Draft responses to FINRA requests

3. Investment Structure and Financial Information
SPV and Fund Details:

HEC SPV I, II, III, IV folders containing incorporation documents, PPMs (Private Placement Memorandums), side letters with investors — revealing deal structures and terms for specific LPs

Valuation of Private Assets:

Compliance - Committee - Valuation folder containing memos and Excel models explaining how private portfolio companies (e.g., Flexis, Paige) were valued — revealing how the fund calculates NAV

Deal-Specific Correspondence and Documents:

PDF presentations and working models for Pluto, Akoya, HeartFlow, Mindmaze (from user Sai.Nanduri files) — operational analysis of current and potential deals

4. Operational and Technical Information
Cybersecurity:

Penetration test reports, phishing campaign results, external scan results, cybersecurity briefs — essentially a map of their vulnerabilities

Data Privacy:

GDPR and Cayman Islands Data Privacy Law (DPL) documents

SPAC Website Backups:

Complete backup of their corporate websites (archive copies) in the Website\SPAC websites folder

👽💫

🔐 INCIDENT: Proactive Medical Inc

📅 Attacker's claim date: February 10, 2026 (Clop group)

🦠 Attacker: CLOP (Clop) ransomware group — Russian-speaking RaaS group

🎯 Compromised domain: PROACTIVEMEDICAL.COM

🏢 About the company: Proactive Medical Products / Proactive Medical Inc. — medical equipment and healthcare products. Headquarters: Lindenhurst, New York, USA. Proactive Medical Products was founded in 2008, specializing in patient care products that help prevent and treat conditions such as bedsores and infections.

📦 Publication status: 1.08 TB — data published in full

📂 WHAT LEAKED — DETAILED ANALYSIS
🚨 Scale: Catastrophic
Full copies of work folders, including system directories, were exposed in the breach. This is a classic sign of total encryption and theft, not a single email account compromise.

1. HIGHLY SENSITIVE CLIENT AND PARTNER DATA
What leaked Examples / Details
Direct contracts and purchase orders TWIN MED PO# PO057528_files, FEDEX SHIPPING LABEL SO#114439_files, Invoice for Order #21... — complete transaction data
Patient data (indirect) POD_files (Proof of Delivery) and BOL FOR PALLETS folders — delivery addresses violate medical confidentiality (HIPAA)
2. COMPLETE BUSINESS AND REPUTATIONAL DAMAGE
What leaked Details
Trade secrets Customer Price List, BENT METAL DME AND MANUALS (training materials, product assembly instructions)
Competitor data Folders named McKesson, Medline, AdaptHealth inside CUSTOMERS - yossi — pricing policy and strategy
Internal documentation HR DEPARTMENT - UPDATED (employee personal data), Payroll Reports (salaries), FDA (regulatory documents), Instruction Manuals (intellectual property)
3. EMPLOYEE AND MANAGEMENT PERSONAL DATA
What leaked Details
Employee work folders Folders by name: JANET, BRIAN, KRISTINA Stuff, PATRICIA, MIKE, YOSSI — personal correspondence, notes
Document scans scans\Yossi\Yossi iphone\DCIM — photos from employee's phone
Personal files Music, videos (movies\Game of Thrones), workout programs (Workout\P90X) — employees used work computers for personal purposes, expanding the scope of the leak

📝 VERDICT
This is not just a "document leak."

This is a digital copy of the entire enterprise.

From this archive, one could reconstruct all commercial, financial, operational, and personnel activities of Proactive Medical Products, as well as a significant portion of their relationships with partners.

## 🔐 INCIDENT: Smith IP Services

📅 Attacker’s Claim Date: February 10, 2026 (CL0P group)

🦠 Attacker: CL0P ransomware group

🎯 Compromised Domain: SMITHIPSERVICES.COM

🏢 About the Company: Smith IP Services — a U.S.-based company specializing in Intellectual Property (IP)

📦 Total size of the leaked archive: 97 GB

## 📂 WHAT WAS LEAKED :

✅ Thousands of patent applications
(US, Europe, China, Brazil, Australia, Canada, Argentina, Mexico, and others)
✅ Trademarks in dozens of countries
✅ Correspondence with clients — including strategy, financials, and legal recommendations
✅ Patent assignment records
✅ Internal company documents (HR, payroll, etc.)
✅ Personal files of employees

---

## 🧾 STATUS

The leak is complete and total — not only current cases have been compromised, but also archived files and those previously transferred to other law firms.

The archive allows for a full reconstruction of the commercial, financial, and patent activities of the IP firm and its clients.

⚠️ Leak status: Published

🔐 INCIDENT: ENVIRONMENTAL CORPORATION OF AMERICA (ECA)

📅 Attacker's claim date: January 2026

🦠 Attacker: CLOP (Clop) ransomware group — Russian-speaking RaaS group

🎯 Compromised domain: ECA-USA.COM

🏢 About the company:

Environmental Corporation of America (ECA) — technology and aerospace industry company

Headquarters: USA

📂 WHAT LEAKED :

✅ Client data - Contracts, purchase orders (PO), invoices, shipping/delivery information
✅ Aerospace industry -Technical documentation, specifications, drawings (ITAR/EAR sensitive data)
✅ Finance - Pricing, payment data, salaries, financial reports
✅ HR / Personnel - Employee personal data, document scans, resumes
✅ Internal documentation - Policies, procedures, internal correspondence
✅ IP / Intellectual Property - Patents, technological developments, source code

⚠️ SECTOR RISK — CRITICAL
The aerospace industry is particularly vulnerable due to:
* High value of intellectual property
* Export control regulations (ITAR / EAR)

ITAR (International Traffic in Arms Regulations) — sensitive defense-related data. Leak of ITAR-controlled information can have national security implications and result in massive regulatory fines.

🚨 Leak status: Published

📋 INFORMATIONAL: THE CLOP GROUP

Context of CLOP Activity in 2025–2026
The CLOP (Clop) ransomware group is one of the most active and dangerous Russian-speaking RaaS (Ransomware-as-a-Service) groups. They specialize in mass-scale attacks using zero-day vulnerabilities in popular enterprise software:

Target Software Number of Victims Period
MOVEit Transfer ~2,773 organizations 2023
GoAnywhere MFT 100+ organizations 2023
Accellion FTA Dozens of organizations 2020–2021
Oracle E-Business Suite Dozens of organizations 2025
In 2025, CLOP exploited a zero-day vulnerability in Oracle E-Business Suite (CVE-2025-61882) , stealing data from dozens of organizations worldwide.

Confirmed victims of that campaign include:

* Harvard University
* The Washington Post
* Logitech
* Schneider Electric
* Emerson
* American Airlines (Envoy Air)
* GlobalLogic (data breach of 10,500+ employees)

CLOP's tactic: "Double extortion" — data theft + threat of public release. The group gives victims a limited window for negotiations, after which they publish the stolen data in open access on their Tor leak site.

Why the Presence of Microsoft 365 Is Important Context, Not Proof of a Breach

CLOP is not just a ransomware operator — it is a group engaged in data theft and extortion. Their target model is to infiltrate the victim's network by any means and exfiltrate as much information as possible. If the victim's network includes Microsoft 365, then gaining access to it is a "gold mine": C-level emails, Teams discussions of deals, SharePoint, OneDrive.

In 2026, there are at least three documented methods to gain full access to Microsoft 365 without hacking Microsoft's own servers:

1. Session Interception via Compromised Routers (APT28)
In April 2026, an operation by Russian hackers (GRU) was confirmed: between 18,000 and 40,000 routers were compromised worldwide. The technique — DNS spoofing and adversary-in-the-middle (AiTM). An employee thinks they are logging into Outlook, but in reality, they are sending their login, password, and MFA token directly to the hackers. This works even with two-factor authentication enabled.

2. Device Code Phishing (OAuth 2.0 Attack)
A user receives a phishing email asking them to go to the legitimate Microsoft site https://aka.ms/devicelogin and enter a short code. Once they do, they authorize a malicious application (e.g., "Microsoft Security Scanner"). The hackers receive a Refresh Token and gain full access to the victim's email, Teams, and files. The user voluntarily and legitimately completes the MFA process.

3. Vulnerabilities in "Edge" File Transfer Systems (MOVEit, GoAnywhere)
This is classic CLOP. They don't break into Microsoft 365 directly. Instead, they compromise a vendor or an adjacent system (e.g., a corporate portal), and from there "move laterally" into Microsoft 365 using legitimate integrations.

4. What "Victim Uses Microsoft 365" Means — An Indicator of the Scale of Damage
The presence of Microsoft 365 at a victim organization is not proof that the breach occurred through it. However, it is a critically important indicator for assessing potential damage.

In the context of the "What leaked" section:

Scenario - What leaked?
* Victim does NOT use M365 Only server files (standard documents)
* Victim DOES use M365 In addition to server folders — all corporate correspondence (Outlook), chat history (Teams), files from OneDrive and SharePoint
Thus, "uses Microsoft 365" is not evidence of the hack itself — it is a marker of potential catastrophe. If CLOP gains access to a victim's network that includes M365, the volume of the leak increases exponentially due to cloud-based communications.