🔐 INCIDENT: Broad Reach Retail Partners, LLC
📅 Date of attackers' claim: February 10, 2026 (the Clop group claimed responsibility; the publication of the file dump has been confirmed by analysis)
🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: brrp.local (Broad Reach Retail Partners' internal domain)

🏢 About the company: Broad Reach Retail Partners, LLC — a US private commercial real estate company (headquartered in Millersville, Maryland). Founded in 2006. Manages 68 shopping centers totaling over 6 million square feet. Specializes in acquiring, managing, leasing, and redeveloping shopping centers. Headcount: 10–50 employees. Estimated annual revenue: $1.7M–$10M.

📦 Total leaked archive size: 440 MB (judging by the file structure — a compressed copy of the cloud/network drive of several employees)

📂 WHAT WAS LEAKED

The following data categories were discovered:

- Personal folders of at least 6 employees with usernames: ajones@brrp.local, cretag@brrp.local, drogers@brrp.local, eroberts@brrp.local, ktodd@brrp.local, wstanwick@brrp.local
- Banking and payment documents — wire notifications with fraud alerts, executed purchase and sale agreements, interest-bearing account details
- Complete due diligence for the Fairview Centre property (Cleveland, Ohio) — environmental reports (Phase I ESA), Property Condition Assessment (PCA), zoning analysis, roof condition report, void analysis
- All lease agreements and lease abstracts for dozens of tenants including: Giant Eagle, Dollar Tree, PNC Bank, Goldfish Swim School, Onyx Health Club, UPS Store, and others
- Financial reports — general ledgers (GL) for all months of 2024, rent rolls, CAM reconciliations, accounts receivable, pre-acquisition tax estimates
- Seller due diligence — including internal accounting, reserves, tenant improvement allowances
- Insurance loss runs for 2020–2025
- Employee health and dental insurance data (handouts with rate tables)
- Folders for other real estate assets — Henderson Pointe (including soft cost tracker), development projects in Canton (GA), Davenport (FL), Worcester (MA)
- Internal SOPs and instructions — including CentreStack recover deleted files SOP.docx (indicating possible use of the CentreStack cloud service)

🧾 ANALYST'S NOTE:

> *This is not just a "document leak" — it is a complete snapshot of the company's operational activities. The attackers gained access to banking details, current and planned transactions, tenant negotiations, and employee insurance data. Particularly dangerous is the presence of files containing wire fraud alerts — hackers could use these to precisely substitute payment details in future transactions. Also notable is the absence of a public acknowledgment of the incident by the company, more than three months after the attackers' claim.*

⚠️ STATUS:
Leak status: Published / Data has been published (the file dump has been confirmed and analyzed; the folder structure and file list are publicly available).

💫 👽 ❄️

🔐 Dhanarak Asset Development Co., Ltd.

📅 Date of attackers' claim: February 10, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: dad.co.th

🏢 About the company: Dhanarak Asset Development Co., Ltd. (DAD) is a state-owned enterprise, fully owned by the Ministry of Finance of Thailand. The company was established to develop, manage, and operate government facilities, primarily the Chaeng Watthana government office complex in Bangkok. DAD is responsible for implementing the "Smart City" concept within this complex, including access control systems, smart parking, and a unified super-application.

📦 Total leaked archive size: 694 Gb

📂 WHAT WAS LEAKED

* The following data categories have been confirmed:
* Contracts and commercial proposals
* Financial documentation
* Internal corporate documents
* Employee personal data
* Technical documentation and configurations
* Customer information
* Operational data

🧾 NOTE:

Data is in the Thai language.

⚠️ STATUS:

Leak status: Published / Data has been published (the file dump has been confirmed and analyzed; the folder structure and file list are publicly available).

💫 👽

🔐 INCIDENT: Conwest Developments

📅 Date of attackers' claim: February 7, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: conwest.com

🏢 About the company: Conwest Developments is a Canadian private real estate development company founded in 1985. Headquarters are located in Vancouver, British Columbia. The company specializes in commercial, industrial, and residential projects in the Greater Vancouver region. Employee count: 100–250. Annual revenue: $10–50 million.

📦 Total leaked archive size: 450 MB

📂 WHAT WAS LEAKED

* Personal folders of at least 5 employees
* Video reports and visual data (drone or site inspection footage)
* Technical and project documentation (construction drawings)
* Permitting documentation and codes
* Financial and tax documents — BC Hydro bills, payment receipts
* Legal documents and agreements
* Correspondence and presentations for investors/boards
* Rezoning and land development documents
* Environmental and regulatory requirements

🧾 ANALYST'S NOTE:

The leak constitutes a complete copy of the cloud storage of several key Conwest employees. Documents submitted for permit approval (Issued_for_Permit) contain precise engineering solutions.

⚠️ STATUS:

Leak status: Published

💫 👽

🔐 INCIDENT: Augustea SpA
📅 Date of attackers' claim: February 7, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: augustea.com

🏢 About the company:
Augustea SpA is a traditional shipping company from Naples, Italy, whose history dates back to 1629. The company operates a modern fleet of about 50 vessels, tugs, and barges, employing approximately 630 people. The group is also known for its activities in Malta.

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data

🧾 Analyst's note:

Leak via a third-party service

⚠️ Status:
Leak status: Claimed / Data partially published

💫 👽

🔐 INCIDENT: Labinf Sistemi S.r.l.
📅 Date of attackers' claim: February 7, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: labinf.it

🏢 About the company:
Labinf Sistemi S.r.l. is an Italian IT company and software developer founded in 1978 and based in Chivasso, Italy. The company provides comprehensive integrated IT solutions, including ERP systems (open-source iDempiere), cloud computing, cybersecurity, network infrastructure design, and custom software development for private companies and public institutions.

📦 Total size of the leaked archive: 80,3 Gb

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data

🧾 Analyst's note:

The leak is categorized under the technology sector.

⚠️ Status:
Leak status: Claimed / Data partially published

💫 👽

🔐 INCIDENT: AIG Healthcare

📅 Date of attackers' claim: March 11, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: aighealthcare.in

🏢 About the company:
AIG Healthcare is an Indian healthcare company.

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data

🧾 Analyst's note:

Leak via a third-party service

⚠️ Status:
Leak status: Claimed / Data partially published

💫 👽

🔐 INCIDENT: AIG Business Solutions Pvt. Ltd.

📅 Date Reported: February 10, 2026

🦠 Attacking Group: Clop ransomware group

🎯 Compromised Domain: aigbusiness.com

🏢 About the company: AIG Business Solutions Pvt. Ltd. is a business solutions provider headquartered in India.

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data

⚠️ Status:
Leak status: Claimed / Data partially published

💫 👽

🔐 INCIDENT: Bureaux Solutions

📅 Date of attackers' claim: January 21, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: bureaux.fr

🏢 About the company:

Bureaux Solutions is a French company providing office solutions for businesses. Their services include renting fully equipped workspaces, meeting rooms, and virtual offices. The company serves startups, freelancers, and large enterprises, offering flexible and affordable solutions. Bureaux operates in several locations across France and in Belgium.

📦 Total size of the leaked archive: ~ 90 Gb

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data

⚠️ Status:
Leak status: Claimed / Data partially published

💫 👽

🔐 INCIDENT: BOYDEN
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: boyden.com

🏢 ABOUT THE COMPANY:
Boyden is an American company in the field of executive search and management consulting. The company was founded in 1946, and its headquarters are located in Tarrytown, New York. The number of employees is approximately 1,000.

📂 WHAT IS KNOWN ABOUT THE LEAK:
In mid-February 2026, the Clop group claimed responsibility for a cyberattack on Boyden's infrastructure. Information about the incident was published on the group's darknet site.

🧾 ANALYST'S NOTE:

At the time of analysis, there is no data on the volume of the leaked archive or the types of compromised files. It is important to note that in May 2024 (long before the current Clop attack), another group, Medusa, released a data dump of Boyden amounting to 79.3 GB and demanded a ransom. The current Clop attack may be either a new data theft or an attempt at repeat extortion using old vulnerabilities.

The data that the Clop group released in connection with the leak relates to Media World (Hong Kong) and Stones International, not to Boyden. Boyden appears only as a counterparty in a few files. Only a file containing a list or structure of files has been published, not the actual data.

⚠️ STATUS:
Leak status: Claimed / Data not published — the attack has been confirmed, but the files have not been made publicly available.

🫥 👺

🔐 INCIDENT: RBD CONSTRUCTION

📅 Attacker's claim date: February 10, 2026

🦠 Attacker group: CL0P ransomware group

🎯 Compromised domain: rbdconstruction.com


🏢 About the company:
RBD Construction is an American construction company specializing in steel structures and industrial construction. It executes projects for Amazon, Lockheed Martin, Nucor, and US military facilities (LRAFB).

📦 Total size of the leaked archive: 1.32 Tb

📂 WHAT WAS LEAKED:

• Contracts and bidding documentation (2017-2025)
• Financial documentation (bank statements, taxes, invoices)
• Internal corporate documents (reports, meeting minutes, budgets)
• Employee personal data (passports, W-4, I-9, H-2B visas)
• Technical documentation (AutoCAD/Tekla drawings, software configurations)
• Client information (contracts, NDAs, subcontractors)
• Operational data (construction schedules, logistics)

🧾 ANALYST NOTE:

1. Critical data exposure: The company stored everything in plaintext, including banking information, contractor W-9 forms, employee I-9 and W-4 forms, as well as passport data of foreign workers under the H-2B program. The lack of encryption or data segregation is a gross violation of compliance requirements (SOC2, GDPR for European clients).

2. Industrial espionage as a key threat: The presence of a complete history of controlled drawings (Controlled files, REV 1/2/3, Archived) and bidding documentation spanning 8 years allows competitors to reconstruct the company's pricing policies, estimating norms, and technical solutions for major projects (including Amazon, Nucor, and defense contracts).

⚠️ Status:
Fully published — the file listing contains the complete structure of the corporate server with all key data categories.

💫 👽

👺

🔐 INCIDENT: CFDT

📅 Attackers' claim date: February 10, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: cfdt.fr

🏢 ABOUT THE COMPANY: CFDT (Confédération Française Démocratique du Travail) is the largest trade union in France by number of members. Founded in 1964. It represents workers across various sectors, including healthcare, social services, finance, education, and public services.

📂 WHAT WAS LEAKED:

According to analysis:
- Names and contact details of trade union members
- Trade union membership data
- Employee accounts: 23 employees
- User accounts: 735 users
- Third-party credentials: 9 records
- External attack surface: 116 nodes

The exact list of compromised file types and the total volume of the leak have not been established at this time.

🧾 NOTE:

- CFDT has begun notifying affected union members and is working with cybersecurity experts to assess the damage
- The attack is part of a broader Clop campaign in February 2026 — the group has claimed to have breached at least 25 organizations worldwide
- The leak poses a particular risk given the sensitive nature of trade union membership data (participation in collective bargaining, labor activity information)

🧾 STATUS:

⚠️ Leak status: Published (attack has been claimed, data has not been publicly released — the group is demanding a ransom)

😂

👺

🔐 INCIDENT: SPOHN ASSOCIATES

📅 Attackers' claim date: February 10, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: spohnassociates.com

🏢 ABOUT THE COMPANY: Spohn Associates is an American company specializing in architectural solutions, including acoustics, navigation systems, sun protection, as well as equipment for skate parks and playgrounds. The company provides design, project management, and installation services.

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data

🧾 NOTE:

- The attack is part of a larger Clop campaign in February 2026, when the group claimed to have hacked at least 25 organizations worldwide.

- According to DNS analysis, the domain spohnassociates.com uses arsmtp.com mail servers and includes SPF records from edgepilot.com.

⚠️ STATUS:
Leak status: Published (attack has been confirmed, data has not been publicly released — the group is demanding a ransom)

💫 👽

🔐 INCIDENT: INTEGRITEK

📅 Attackers' claim date: January 21, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: integritek.net

🏢 ABOUT THE COMPANY: Integritek is an American IT company specializing in managed IT services. The company provides solutions in IT support, cybersecurity, cloud services, and disaster recovery. Integritek focuses on business process optimization, security enhancement, and IT risk reduction, offering a tailored approach to each client.

📦 Total volume of leaked archive: 2.63 Tb (Terabytes)

📂 WHAT WAS LEAKED (attackers' claims)

• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data

🧾 NOTE:

* On January 21, 2026, the Clop group publicly announced a cyberattack on Integritek's infrastructure and threatened to publish the stolen data.
* The date the attack was detected in open sources is January 25, 2026.
* Integritek updated its Privacy Policy on March 18, 2026, which may be indirectly related to the incident (legal recommendation following the leak).
* The company is based in the US and operates in the IT services sector, making the leak particularly sensitive due to potential access to client infrastructure and data.
* The leak may contain data from Perpetual Financial Group and Garner Group.

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.63 Tb)

💫 👽

🔐 INCIDENT: CHEHARDY, SHERMAN, WILLIAMS, RECILE & HAYES

📅 Attackers' claim date: February 10, 2026

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: chehardy.com

🏢 ABOUT THE COMPANY: Chehardy, Sherman, Williams, Recile & Hayes is a US law firm founded in 1989 in Louisiana. The firm specializes in corporate law, personal injury litigation, maritime law, and family disputes, representing both large businesses and private individuals.

📂 WHAT WAS LEAKED (attackers' claims)

Based on an analysis of the published file structure, the leak includes:

* Client medical records: Complete medical histories, MRI/CT referrals, operative reports (e.g., "Operative Report"), examination results, correspondence with physicians.
* Client financial documentation: Tax returns (Form 1040), payroll stubs, medical bills, insurance payouts, and injury compensation documents.
* Legal documents: Complaints, court orders, discovery responses, strategic case notes.
* Employee personal data: Internal correspondence, OneNote notes (containing case analysis and personal comments), assignments.
* Industrial incident data: Incident scene photographs, maritime incident investigations (e.g., "TapRoot Investigation"), technical reports.

🧾 NOTE:

Analysis of the leaked folder structure confirms that the attackers copied the working folders of key employees (kcrawford, lbostick, sbowls, and others). The compromised data includes client cases containing sensitive medical information (including names of medical institutions: Jefferson Ambulatory Surgery Center, Metairie Orthopedics), tax returns, and privileged defense strategy documents.

⚠️ STATUS:

Leak status: Confirmed. Some of the confidential information (including medical records) may already be considered compromised.

💫 👽

🔐 INCIDENT: GIACARE INC.

📅 Attackers' claim date: October 16–20, 2025.
Disclosure: Starting January 23, 2026, the company began sending official notifications to affected individuals and filing reports with state attorneys general (including New Hampshire).

🦠 Attacking group: CL0P ransomware group

🎯 Compromised domain: giacare.com, giamedjv.com, giacare.local

🏢 ABOUT THE COMPANY:
GiaCare Inc. is a US company operating in healthcare and staffing outsourcing. GiaCare is a contractor for the US government, providing medical personnel (physicians, nurses, paramedics) for the Department of Defense (including SAMMC, Ft. Bragg, Ft. Campbell army hospitals), the US Air Force (Keesler, Travis, Nellis, Eglin bases), and NASA.

The company also participates in joint ventures (GiaMed JV, GiaMed Alliance JV) and works with subcontractors across the United States.

📂 WHAT WAS LEAKED (based on file structure analysis)

* Complete accounting and financial documentation
* Monthly and annual financial reports (Monthly close, Financial Statements).
* Bank statements (BB&T, Salem Bank).
* Corporate credit card statements (Amex, Chase).
* Tax forms (940, 941, W-2, Tax Returns).
* Accounts payable and accounts receivable.
* Employee HR data
* Personnel files of GiaCare employees and partner entities (PERSONNEL FILES — hundreds of folders with names).
* Medical insurance and leave documentation (Medical Leave, FMLA).
* Termination documents (TERMINATION.EXIT DOCUMENTS, COBRA).
* Workers' compensation records (WORKERS COMP).
* I-9 forms and E-Verify data.
* US government contracts (CUI)
* Contract documentation with the US Army, US Air Force, and NASA.
* Contract numbers (e.g., W81K00-13-C0006, FA301016C0021, NNL15AB70P).
* Subcontractor agreements and invoices through the WAWF system.
* Internal correspondence and operational data
* Meetings, audits, weekly reports (Weekly meeting, Audits, Quality).
* Project management data (Project Manager).
* System administrator personal data
* Contents of the desktop (My Desktop).
* Personal documents and photographs (My Documents, My Pictures).
* Game saves (Deus Ex, Civilization VI, Final Fantasy VII), confirming the mixing of work and personal information.

🧾 NOTE:

The complete directory listing (ls -R) of the $admin@cloud.backup backup has been analyzed. The backup itself was likely compromised through a breach of cloud storage or the administrator's workstation.

The leak is not limited to a single company's data — it affects the entire GiaCare Inc. ecosystem, including the joint ventures GiaMed, GiaMed Alliance, GiaMed Resources, as well as partners MedTrust LLC and subcontractors (CCMS, Advantage, REACH, Inomedic).

⚠️ STATUS:

Leak status: The complete data set has been compromised and is likely in the possession of the attackers. In the Clop ransomware model, this precedes the publication of data if negotiations fail.

💫 🫥

🔐 INCIDENT: NG Attorneys Law Firm
📅 Date of attackers' claim: February 7, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: ngattorneys.com

🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.

📦 Total leaked archive size: 2.17 Tb (Terabytes)

📂 WHAT LEAKED (attackers' statement + file analysis):

• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)

🧾 NOTES:

* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)

🔐 INCIDENT: Solutions In Safety Inc.

📅 Date of attackers' claim: February 10, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: solutionsinsafety.com

🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.

📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.

📂 WHAT LEAKED (attackers' statement + data analysis):

According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.

• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information

🧾 NOTES:

On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.

The attack was discovered on February 14, 2026 (UTC)

Only the file list and structure have been published.

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)

🔐 INCIDENT: Fish Window Cleaning

📅 Date of attackers' claim: February 10, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: fishwindowcleaning.com

🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.

📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)

📂 WHAT LEAKED (attackers' statement + data analysis):

• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information

🧾 NOTES:

Only the file list has been published.

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)

🔐 INCIDENT: Cloud Clearway Group

📅 Date of attackers' claim: March 30, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: cloud.clearwaygroup.com

🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.

📦 Total leaked archive size: 1.86 Tb

📂 WHAT LEAKED (attackers' statement + data analysis):

• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)

🧾 NOTES:

* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)

🔐 INCIDENT: Broadreach Retail (BROADREACHRETAIL.COM)

📅 Date of attackers' claim: February 10, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: broadreachretail.com

🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.

📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.

📂 WHAT LEAKED (attackers' statement + data analysis):

• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals

🧾 NOTES:

Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)

🔐 INCIDENT: Hudson Sustainable Group (HUDSONSUSTAINABLE.COM)

📅 Date of attackers' claim: February 10, 2026

🦠 Attackers: CL0P ransomware group

🎯 Compromised domain: hudsonsustainable.com

🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.

📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.

📂 WHAT LEAKED (attackers' statement + data analysis):

• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data

🧾 NOTES:

- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services

⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)