🔐 INCIDENT: Augustea SpA
📅 Date of attackers' claim: February 7, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: augustea.com
🏢 About the company:
Augustea SpA is a traditional shipping company from Naples, Italy, whose history dates back to 1629. The company operates a modern fleet of about 50 vessels, tugs, and barges, employing approximately 630 people. The group is also known for its activities in Malta.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
Leak via a third-party service
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
📅 Date of attackers' claim: February 7, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: augustea.com
🏢 About the company:
Augustea SpA is a traditional shipping company from Naples, Italy, whose history dates back to 1629. The company operates a modern fleet of about 50 vessels, tugs, and barges, employing approximately 630 people. The group is also known for its activities in Malta.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
Leak via a third-party service
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
🔐 INCIDENT: Labinf Sistemi S.r.l.
📅 Date of attackers' claim: February 7, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: labinf.it
🏢 About the company:
Labinf Sistemi S.r.l. is an Italian IT company and software developer founded in 1978 and based in Chivasso, Italy. The company provides comprehensive integrated IT solutions, including ERP systems (open-source iDempiere), cloud computing, cybersecurity, network infrastructure design, and custom software development for private companies and public institutions.
📦 Total size of the leaked archive: 80,3 Gb
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
The leak is categorized under the technology sector.
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
📅 Date of attackers' claim: February 7, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: labinf.it
🏢 About the company:
Labinf Sistemi S.r.l. is an Italian IT company and software developer founded in 1978 and based in Chivasso, Italy. The company provides comprehensive integrated IT solutions, including ERP systems (open-source iDempiere), cloud computing, cybersecurity, network infrastructure design, and custom software development for private companies and public institutions.
📦 Total size of the leaked archive: 80,3 Gb
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
The leak is categorized under the technology sector.
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
🔐 INCIDENT: AIG Healthcare
📅 Date of attackers' claim: March 11, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: aighealthcare.in
🏢 About the company:
AIG Healthcare is an Indian healthcare company.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
Leak via a third-party service
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
📅 Date of attackers' claim: March 11, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: aighealthcare.in
🏢 About the company:
AIG Healthcare is an Indian healthcare company.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
🧾 Analyst's note:
Leak via a third-party service
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
🔐 INCIDENT: AIG Business Solutions Pvt. Ltd.
📅 Date Reported: February 10, 2026
🦠 Attacking Group: Clop ransomware group
🎯 Compromised Domain: aigbusiness.com
🏢 About the company: AIG Business Solutions Pvt. Ltd. is a business solutions provider headquartered in India.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
📅 Date Reported: February 10, 2026
🦠 Attacking Group: Clop ransomware group
🎯 Compromised Domain: aigbusiness.com
🏢 About the company: AIG Business Solutions Pvt. Ltd. is a business solutions provider headquartered in India.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
🔐 INCIDENT: Bureaux Solutions
📅 Date of attackers' claim: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: bureaux.fr
🏢 About the company:
Bureaux Solutions is a French company providing office solutions for businesses. Their services include renting fully equipped workspaces, meeting rooms, and virtual offices. The company serves startups, freelancers, and large enterprises, offering flexible and affordable solutions. Bureaux operates in several locations across France and in Belgium.
📦 Total size of the leaked archive: ~ 90 Gb
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
📅 Date of attackers' claim: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: bureaux.fr
🏢 About the company:
Bureaux Solutions is a French company providing office solutions for businesses. Their services include renting fully equipped workspaces, meeting rooms, and virtual offices. The company serves startups, freelancers, and large enterprises, offering flexible and affordable solutions. Bureaux operates in several locations across France and in Belgium.
📦 Total size of the leaked archive: ~ 90 Gb
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Customer information
• Operational data
⚠️ Status:
Leak status: Claimed / Data partially published
💫 👽
🔐 INCIDENT: BOYDEN
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: boyden.com
🏢 ABOUT THE COMPANY:
Boyden is an American company in the field of executive search and management consulting. The company was founded in 1946, and its headquarters are located in Tarrytown, New York. The number of employees is approximately 1,000.
📂 WHAT IS KNOWN ABOUT THE LEAK:
In mid-February 2026, the Clop group claimed responsibility for a cyberattack on Boyden's infrastructure. Information about the incident was published on the group's darknet site.
🧾 ANALYST'S NOTE:
At the time of analysis, there is no data on the volume of the leaked archive or the types of compromised files. It is important to note that in May 2024 (long before the current Clop attack), another group, Medusa, released a data dump of Boyden amounting to 79.3 GB and demanded a ransom. The current Clop attack may be either a new data theft or an attempt at repeat extortion using old vulnerabilities.
The data that the Clop group released in connection with the leak relates to Media World (Hong Kong) and Stones International, not to Boyden. Boyden appears only as a counterparty in a few files. Only a file containing a list or structure of files has been published, not the actual data.
⚠️ STATUS:
Leak status: Claimed / Data not published — the attack has been confirmed, but the files have not been made publicly available.
🫥 👺
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: boyden.com
🏢 ABOUT THE COMPANY:
Boyden is an American company in the field of executive search and management consulting. The company was founded in 1946, and its headquarters are located in Tarrytown, New York. The number of employees is approximately 1,000.
📂 WHAT IS KNOWN ABOUT THE LEAK:
In mid-February 2026, the Clop group claimed responsibility for a cyberattack on Boyden's infrastructure. Information about the incident was published on the group's darknet site.
🧾 ANALYST'S NOTE:
At the time of analysis, there is no data on the volume of the leaked archive or the types of compromised files. It is important to note that in May 2024 (long before the current Clop attack), another group, Medusa, released a data dump of Boyden amounting to 79.3 GB and demanded a ransom. The current Clop attack may be either a new data theft or an attempt at repeat extortion using old vulnerabilities.
The data that the Clop group released in connection with the leak relates to Media World (Hong Kong) and Stones International, not to Boyden. Boyden appears only as a counterparty in a few files. Only a file containing a list or structure of files has been published, not the actual data.
⚠️ STATUS:
Leak status: Claimed / Data not published — the attack has been confirmed, but the files have not been made publicly available.
🫥 👺
🔐 INCIDENT: RBD CONSTRUCTION
📅 Attacker's claim date: February 10, 2026
🦠 Attacker group: CL0P ransomware group
🎯 Compromised domain: rbdconstruction.com
🏢 About the company:
RBD Construction is an American construction company specializing in steel structures and industrial construction. It executes projects for Amazon, Lockheed Martin, Nucor, and US military facilities (LRAFB).
📦 Total size of the leaked archive: 1.32 Tb
📂 WHAT WAS LEAKED:
• Contracts and bidding documentation (2017-2025)
• Financial documentation (bank statements, taxes, invoices)
• Internal corporate documents (reports, meeting minutes, budgets)
• Employee personal data (passports, W-4, I-9, H-2B visas)
• Technical documentation (AutoCAD/Tekla drawings, software configurations)
• Client information (contracts, NDAs, subcontractors)
• Operational data (construction schedules, logistics)
🧾 ANALYST NOTE:
1. Critical data exposure: The company stored everything in plaintext, including banking information, contractor W-9 forms, employee I-9 and W-4 forms, as well as passport data of foreign workers under the H-2B program. The lack of encryption or data segregation is a gross violation of compliance requirements (SOC2, GDPR for European clients).
2. Industrial espionage as a key threat: The presence of a complete history of controlled drawings (Controlled files, REV 1/2/3, Archived) and bidding documentation spanning 8 years allows competitors to reconstruct the company's pricing policies, estimating norms, and technical solutions for major projects (including Amazon, Nucor, and defense contracts).
⚠️ Status:
Fully published — the file listing contains the complete structure of the corporate server with all key data categories.
💫 👽
📅 Attacker's claim date: February 10, 2026
🦠 Attacker group: CL0P ransomware group
🎯 Compromised domain: rbdconstruction.com
🏢 About the company:
RBD Construction is an American construction company specializing in steel structures and industrial construction. It executes projects for Amazon, Lockheed Martin, Nucor, and US military facilities (LRAFB).
📦 Total size of the leaked archive: 1.32 Tb
📂 WHAT WAS LEAKED:
• Contracts and bidding documentation (2017-2025)
• Financial documentation (bank statements, taxes, invoices)
• Internal corporate documents (reports, meeting minutes, budgets)
• Employee personal data (passports, W-4, I-9, H-2B visas)
• Technical documentation (AutoCAD/Tekla drawings, software configurations)
• Client information (contracts, NDAs, subcontractors)
• Operational data (construction schedules, logistics)
🧾 ANALYST NOTE:
1. Critical data exposure: The company stored everything in plaintext, including banking information, contractor W-9 forms, employee I-9 and W-4 forms, as well as passport data of foreign workers under the H-2B program. The lack of encryption or data segregation is a gross violation of compliance requirements (SOC2, GDPR for European clients).
2. Industrial espionage as a key threat: The presence of a complete history of controlled drawings (Controlled files, REV 1/2/3, Archived) and bidding documentation spanning 8 years allows competitors to reconstruct the company's pricing policies, estimating norms, and technical solutions for major projects (including Amazon, Nucor, and defense contracts).
⚠️ Status:
Fully published — the file listing contains the complete structure of the corporate server with all key data categories.
💫 👽
👺
🔐 INCIDENT: CFDT
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: cfdt.fr
🏢 ABOUT THE COMPANY: CFDT (Confédération Française Démocratique du Travail) is the largest trade union in France by number of members. Founded in 1964. It represents workers across various sectors, including healthcare, social services, finance, education, and public services.
📂 WHAT WAS LEAKED:
According to analysis:
- Names and contact details of trade union members
- Trade union membership data
- Employee accounts: 23 employees
- User accounts: 735 users
- Third-party credentials: 9 records
- External attack surface: 116 nodes
The exact list of compromised file types and the total volume of the leak have not been established at this time.
🧾 NOTE:
- CFDT has begun notifying affected union members and is working with cybersecurity experts to assess the damage
- The attack is part of a broader Clop campaign in February 2026 — the group has claimed to have breached at least 25 organizations worldwide
- The leak poses a particular risk given the sensitive nature of trade union membership data (participation in collective bargaining, labor activity information)
🧾 STATUS:
⚠️ Leak status: Published (attack has been claimed, data has not been publicly released — the group is demanding a ransom)
😂
🔐 INCIDENT: CFDT
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: cfdt.fr
🏢 ABOUT THE COMPANY: CFDT (Confédération Française Démocratique du Travail) is the largest trade union in France by number of members. Founded in 1964. It represents workers across various sectors, including healthcare, social services, finance, education, and public services.
📂 WHAT WAS LEAKED:
According to analysis:
- Names and contact details of trade union members
- Trade union membership data
- Employee accounts: 23 employees
- User accounts: 735 users
- Third-party credentials: 9 records
- External attack surface: 116 nodes
The exact list of compromised file types and the total volume of the leak have not been established at this time.
🧾 NOTE:
- CFDT has begun notifying affected union members and is working with cybersecurity experts to assess the damage
- The attack is part of a broader Clop campaign in February 2026 — the group has claimed to have breached at least 25 organizations worldwide
- The leak poses a particular risk given the sensitive nature of trade union membership data (participation in collective bargaining, labor activity information)
🧾 STATUS:
⚠️ Leak status: Published (attack has been claimed, data has not been publicly released — the group is demanding a ransom)
😂
👺
🔐 INCIDENT: SPOHN ASSOCIATES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: spohnassociates.com
🏢 ABOUT THE COMPANY: Spohn Associates is an American company specializing in architectural solutions, including acoustics, navigation systems, sun protection, as well as equipment for skate parks and playgrounds. The company provides design, project management, and installation services.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
- The attack is part of a larger Clop campaign in February 2026, when the group claimed to have hacked at least 25 organizations worldwide.
- According to DNS analysis, the domain spohnassociates.com uses arsmtp.com mail servers and includes SPF records from edgepilot.com.
⚠️ STATUS:
Leak status: Published (attack has been confirmed, data has not been publicly released — the group is demanding a ransom)
💫 👽
🔐 INCIDENT: SPOHN ASSOCIATES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: spohnassociates.com
🏢 ABOUT THE COMPANY: Spohn Associates is an American company specializing in architectural solutions, including acoustics, navigation systems, sun protection, as well as equipment for skate parks and playgrounds. The company provides design, project management, and installation services.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
- The attack is part of a larger Clop campaign in February 2026, when the group claimed to have hacked at least 25 organizations worldwide.
- According to DNS analysis, the domain spohnassociates.com uses arsmtp.com mail servers and includes SPF records from edgepilot.com.
⚠️ STATUS:
Leak status: Published (attack has been confirmed, data has not been publicly released — the group is demanding a ransom)
💫 👽
🔐 INCIDENT: INTEGRITEK
📅 Attackers' claim date: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: integritek.net
🏢 ABOUT THE COMPANY: Integritek is an American IT company specializing in managed IT services. The company provides solutions in IT support, cybersecurity, cloud services, and disaster recovery. Integritek focuses on business process optimization, security enhancement, and IT risk reduction, offering a tailored approach to each client.
📦 Total volume of leaked archive: 2.63 Tb (Terabytes)
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
* On January 21, 2026, the Clop group publicly announced a cyberattack on Integritek's infrastructure and threatened to publish the stolen data.
* The date the attack was detected in open sources is January 25, 2026.
* Integritek updated its Privacy Policy on March 18, 2026, which may be indirectly related to the incident (legal recommendation following the leak).
* The company is based in the US and operates in the IT services sector, making the leak particularly sensitive due to potential access to client infrastructure and data.
* The leak may contain data from Perpetual Financial Group and Garner Group.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.63 Tb)
💫 👽
📅 Attackers' claim date: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: integritek.net
🏢 ABOUT THE COMPANY: Integritek is an American IT company specializing in managed IT services. The company provides solutions in IT support, cybersecurity, cloud services, and disaster recovery. Integritek focuses on business process optimization, security enhancement, and IT risk reduction, offering a tailored approach to each client.
📦 Total volume of leaked archive: 2.63 Tb (Terabytes)
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
* On January 21, 2026, the Clop group publicly announced a cyberattack on Integritek's infrastructure and threatened to publish the stolen data.
* The date the attack was detected in open sources is January 25, 2026.
* Integritek updated its Privacy Policy on March 18, 2026, which may be indirectly related to the incident (legal recommendation following the leak).
* The company is based in the US and operates in the IT services sector, making the leak particularly sensitive due to potential access to client infrastructure and data.
* The leak may contain data from Perpetual Financial Group and Garner Group.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.63 Tb)
💫 👽
🔐 INCIDENT: CHEHARDY, SHERMAN, WILLIAMS, RECILE & HAYES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: chehardy.com
🏢 ABOUT THE COMPANY: Chehardy, Sherman, Williams, Recile & Hayes is a US law firm founded in 1989 in Louisiana. The firm specializes in corporate law, personal injury litigation, maritime law, and family disputes, representing both large businesses and private individuals.
📂 WHAT WAS LEAKED (attackers' claims)
Based on an analysis of the published file structure, the leak includes:
* Client medical records: Complete medical histories, MRI/CT referrals, operative reports (e.g., "Operative Report"), examination results, correspondence with physicians.
* Client financial documentation: Tax returns (Form 1040), payroll stubs, medical bills, insurance payouts, and injury compensation documents.
* Legal documents: Complaints, court orders, discovery responses, strategic case notes.
* Employee personal data: Internal correspondence, OneNote notes (containing case analysis and personal comments), assignments.
* Industrial incident data: Incident scene photographs, maritime incident investigations (e.g., "TapRoot Investigation"), technical reports.
🧾 NOTE:
Analysis of the leaked folder structure confirms that the attackers copied the working folders of key employees (kcrawford, lbostick, sbowls, and others). The compromised data includes client cases containing sensitive medical information (including names of medical institutions: Jefferson Ambulatory Surgery Center, Metairie Orthopedics), tax returns, and privileged defense strategy documents.
⚠️ STATUS:
Leak status: Confirmed. Some of the confidential information (including medical records) may already be considered compromised.
💫 👽
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: chehardy.com
🏢 ABOUT THE COMPANY: Chehardy, Sherman, Williams, Recile & Hayes is a US law firm founded in 1989 in Louisiana. The firm specializes in corporate law, personal injury litigation, maritime law, and family disputes, representing both large businesses and private individuals.
📂 WHAT WAS LEAKED (attackers' claims)
Based on an analysis of the published file structure, the leak includes:
* Client medical records: Complete medical histories, MRI/CT referrals, operative reports (e.g., "Operative Report"), examination results, correspondence with physicians.
* Client financial documentation: Tax returns (Form 1040), payroll stubs, medical bills, insurance payouts, and injury compensation documents.
* Legal documents: Complaints, court orders, discovery responses, strategic case notes.
* Employee personal data: Internal correspondence, OneNote notes (containing case analysis and personal comments), assignments.
* Industrial incident data: Incident scene photographs, maritime incident investigations (e.g., "TapRoot Investigation"), technical reports.
🧾 NOTE:
Analysis of the leaked folder structure confirms that the attackers copied the working folders of key employees (kcrawford, lbostick, sbowls, and others). The compromised data includes client cases containing sensitive medical information (including names of medical institutions: Jefferson Ambulatory Surgery Center, Metairie Orthopedics), tax returns, and privileged defense strategy documents.
⚠️ STATUS:
Leak status: Confirmed. Some of the confidential information (including medical records) may already be considered compromised.
💫 👽
🔐 INCIDENT: GIACARE INC.
📅 Attackers' claim date: October 16–20, 2025.
Disclosure: Starting January 23, 2026, the company began sending official notifications to affected individuals and filing reports with state attorneys general (including New Hampshire).
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: giacare.com, giamedjv.com, giacare.local
🏢 ABOUT THE COMPANY:
GiaCare Inc. is a US company operating in healthcare and staffing outsourcing. GiaCare is a contractor for the US government, providing medical personnel (physicians, nurses, paramedics) for the Department of Defense (including SAMMC, Ft. Bragg, Ft. Campbell army hospitals), the US Air Force (Keesler, Travis, Nellis, Eglin bases), and NASA.
The company also participates in joint ventures (GiaMed JV, GiaMed Alliance JV) and works with subcontractors across the United States.
📂 WHAT WAS LEAKED (based on file structure analysis)
* Complete accounting and financial documentation
* Monthly and annual financial reports (Monthly close, Financial Statements).
* Bank statements (BB&T, Salem Bank).
* Corporate credit card statements (Amex, Chase).
* Tax forms (940, 941, W-2, Tax Returns).
* Accounts payable and accounts receivable.
* Employee HR data
* Personnel files of GiaCare employees and partner entities (PERSONNEL FILES — hundreds of folders with names).
* Medical insurance and leave documentation (Medical Leave, FMLA).
* Termination documents (TERMINATION.EXIT DOCUMENTS, COBRA).
* Workers' compensation records (WORKERS COMP).
* I-9 forms and E-Verify data.
* US government contracts (CUI)
* Contract documentation with the US Army, US Air Force, and NASA.
* Contract numbers (e.g., W81K00-13-C0006, FA301016C0021, NNL15AB70P).
* Subcontractor agreements and invoices through the WAWF system.
* Internal correspondence and operational data
* Meetings, audits, weekly reports (Weekly meeting, Audits, Quality).
* Project management data (Project Manager).
* System administrator personal data
* Contents of the desktop (My Desktop).
* Personal documents and photographs (My Documents, My Pictures).
* Game saves (Deus Ex, Civilization VI, Final Fantasy VII), confirming the mixing of work and personal information.
🧾 NOTE:
The complete directory listing (ls -R) of the $admin@cloud.backup backup has been analyzed. The backup itself was likely compromised through a breach of cloud storage or the administrator's workstation.
The leak is not limited to a single company's data — it affects the entire GiaCare Inc. ecosystem, including the joint ventures GiaMed, GiaMed Alliance, GiaMed Resources, as well as partners MedTrust LLC and subcontractors (CCMS, Advantage, REACH, Inomedic).
⚠️ STATUS:
Leak status: The complete data set has been compromised and is likely in the possession of the attackers. In the Clop ransomware model, this precedes the publication of data if negotiations fail.
💫 🫥
📅 Attackers' claim date: October 16–20, 2025.
Disclosure: Starting January 23, 2026, the company began sending official notifications to affected individuals and filing reports with state attorneys general (including New Hampshire).
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: giacare.com, giamedjv.com, giacare.local
🏢 ABOUT THE COMPANY:
GiaCare Inc. is a US company operating in healthcare and staffing outsourcing. GiaCare is a contractor for the US government, providing medical personnel (physicians, nurses, paramedics) for the Department of Defense (including SAMMC, Ft. Bragg, Ft. Campbell army hospitals), the US Air Force (Keesler, Travis, Nellis, Eglin bases), and NASA.
The company also participates in joint ventures (GiaMed JV, GiaMed Alliance JV) and works with subcontractors across the United States.
📂 WHAT WAS LEAKED (based on file structure analysis)
* Complete accounting and financial documentation
* Monthly and annual financial reports (Monthly close, Financial Statements).
* Bank statements (BB&T, Salem Bank).
* Corporate credit card statements (Amex, Chase).
* Tax forms (940, 941, W-2, Tax Returns).
* Accounts payable and accounts receivable.
* Employee HR data
* Personnel files of GiaCare employees and partner entities (PERSONNEL FILES — hundreds of folders with names).
* Medical insurance and leave documentation (Medical Leave, FMLA).
* Termination documents (TERMINATION.EXIT DOCUMENTS, COBRA).
* Workers' compensation records (WORKERS COMP).
* I-9 forms and E-Verify data.
* US government contracts (CUI)
* Contract documentation with the US Army, US Air Force, and NASA.
* Contract numbers (e.g., W81K00-13-C0006, FA301016C0021, NNL15AB70P).
* Subcontractor agreements and invoices through the WAWF system.
* Internal correspondence and operational data
* Meetings, audits, weekly reports (Weekly meeting, Audits, Quality).
* Project management data (Project Manager).
* System administrator personal data
* Contents of the desktop (My Desktop).
* Personal documents and photographs (My Documents, My Pictures).
* Game saves (Deus Ex, Civilization VI, Final Fantasy VII), confirming the mixing of work and personal information.
🧾 NOTE:
The complete directory listing (ls -R) of the $admin@cloud.backup backup has been analyzed. The backup itself was likely compromised through a breach of cloud storage or the administrator's workstation.
The leak is not limited to a single company's data — it affects the entire GiaCare Inc. ecosystem, including the joint ventures GiaMed, GiaMed Alliance, GiaMed Resources, as well as partners MedTrust LLC and subcontractors (CCMS, Advantage, REACH, Inomedic).
⚠️ STATUS:
Leak status: The complete data set has been compromised and is likely in the possession of the attackers. In the Clop ransomware model, this precedes the publication of data if negotiations fail.
💫 🫥
🔐 INCIDENT: NG Attorneys Law Firm
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
🔐 INCIDENT: Solutions In Safety Inc.
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Fish Window Cleaning
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Cloud Clearway Group
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Broadreach Retail (BROADREACHRETAIL.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hudson Sustainable Group (HUDSONSUSTAINABLE.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hyde Park United Methodist Church (HYDEPARKUMC.ORG)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: The Mortgage Firm
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Dukosi (DUKOSI.COM)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽