🔐 INCIDENT: RBD CONSTRUCTION
📅 Attacker's claim date: February 10, 2026
🦠 Attacker group: CL0P ransomware group
🎯 Compromised domain: rbdconstruction.com
🏢 About the company:
RBD Construction is an American construction company specializing in steel structures and industrial construction. It executes projects for Amazon, Lockheed Martin, Nucor, and US military facilities (LRAFB).
📦 Total size of the leaked archive: 1.32 Tb
📂 WHAT WAS LEAKED:
• Contracts and bidding documentation (2017-2025)
• Financial documentation (bank statements, taxes, invoices)
• Internal corporate documents (reports, meeting minutes, budgets)
• Employee personal data (passports, W-4, I-9, H-2B visas)
• Technical documentation (AutoCAD/Tekla drawings, software configurations)
• Client information (contracts, NDAs, subcontractors)
• Operational data (construction schedules, logistics)
🧾 ANALYST NOTE:
1. Critical data exposure: The company stored everything in plaintext, including banking information, contractor W-9 forms, employee I-9 and W-4 forms, as well as passport data of foreign workers under the H-2B program. The lack of encryption or data segregation is a gross violation of compliance requirements (SOC2, GDPR for European clients).
2. Industrial espionage as a key threat: The presence of a complete history of controlled drawings (Controlled files, REV 1/2/3, Archived) and bidding documentation spanning 8 years allows competitors to reconstruct the company's pricing policies, estimating norms, and technical solutions for major projects (including Amazon, Nucor, and defense contracts).
⚠️ Status:
Fully published — the file listing contains the complete structure of the corporate server with all key data categories.
💫 👽
📅 Attacker's claim date: February 10, 2026
🦠 Attacker group: CL0P ransomware group
🎯 Compromised domain: rbdconstruction.com
🏢 About the company:
RBD Construction is an American construction company specializing in steel structures and industrial construction. It executes projects for Amazon, Lockheed Martin, Nucor, and US military facilities (LRAFB).
📦 Total size of the leaked archive: 1.32 Tb
📂 WHAT WAS LEAKED:
• Contracts and bidding documentation (2017-2025)
• Financial documentation (bank statements, taxes, invoices)
• Internal corporate documents (reports, meeting minutes, budgets)
• Employee personal data (passports, W-4, I-9, H-2B visas)
• Technical documentation (AutoCAD/Tekla drawings, software configurations)
• Client information (contracts, NDAs, subcontractors)
• Operational data (construction schedules, logistics)
🧾 ANALYST NOTE:
1. Critical data exposure: The company stored everything in plaintext, including banking information, contractor W-9 forms, employee I-9 and W-4 forms, as well as passport data of foreign workers under the H-2B program. The lack of encryption or data segregation is a gross violation of compliance requirements (SOC2, GDPR for European clients).
2. Industrial espionage as a key threat: The presence of a complete history of controlled drawings (Controlled files, REV 1/2/3, Archived) and bidding documentation spanning 8 years allows competitors to reconstruct the company's pricing policies, estimating norms, and technical solutions for major projects (including Amazon, Nucor, and defense contracts).
⚠️ Status:
Fully published — the file listing contains the complete structure of the corporate server with all key data categories.
💫 👽
👺
🔐 INCIDENT: CFDT
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: cfdt.fr
🏢 ABOUT THE COMPANY: CFDT (Confédération Française Démocratique du Travail) is the largest trade union in France by number of members. Founded in 1964. It represents workers across various sectors, including healthcare, social services, finance, education, and public services.
📂 WHAT WAS LEAKED:
According to analysis:
- Names and contact details of trade union members
- Trade union membership data
- Employee accounts: 23 employees
- User accounts: 735 users
- Third-party credentials: 9 records
- External attack surface: 116 nodes
The exact list of compromised file types and the total volume of the leak have not been established at this time.
🧾 NOTE:
- CFDT has begun notifying affected union members and is working with cybersecurity experts to assess the damage
- The attack is part of a broader Clop campaign in February 2026 — the group has claimed to have breached at least 25 organizations worldwide
- The leak poses a particular risk given the sensitive nature of trade union membership data (participation in collective bargaining, labor activity information)
🧾 STATUS:
⚠️ Leak status: Published (attack has been claimed, data has not been publicly released — the group is demanding a ransom)
😂
🔐 INCIDENT: CFDT
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: cfdt.fr
🏢 ABOUT THE COMPANY: CFDT (Confédération Française Démocratique du Travail) is the largest trade union in France by number of members. Founded in 1964. It represents workers across various sectors, including healthcare, social services, finance, education, and public services.
📂 WHAT WAS LEAKED:
According to analysis:
- Names and contact details of trade union members
- Trade union membership data
- Employee accounts: 23 employees
- User accounts: 735 users
- Third-party credentials: 9 records
- External attack surface: 116 nodes
The exact list of compromised file types and the total volume of the leak have not been established at this time.
🧾 NOTE:
- CFDT has begun notifying affected union members and is working with cybersecurity experts to assess the damage
- The attack is part of a broader Clop campaign in February 2026 — the group has claimed to have breached at least 25 organizations worldwide
- The leak poses a particular risk given the sensitive nature of trade union membership data (participation in collective bargaining, labor activity information)
🧾 STATUS:
⚠️ Leak status: Published (attack has been claimed, data has not been publicly released — the group is demanding a ransom)
😂
👺
🔐 INCIDENT: SPOHN ASSOCIATES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: spohnassociates.com
🏢 ABOUT THE COMPANY: Spohn Associates is an American company specializing in architectural solutions, including acoustics, navigation systems, sun protection, as well as equipment for skate parks and playgrounds. The company provides design, project management, and installation services.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
- The attack is part of a larger Clop campaign in February 2026, when the group claimed to have hacked at least 25 organizations worldwide.
- According to DNS analysis, the domain spohnassociates.com uses arsmtp.com mail servers and includes SPF records from edgepilot.com.
⚠️ STATUS:
Leak status: Published (attack has been confirmed, data has not been publicly released — the group is demanding a ransom)
💫 👽
🔐 INCIDENT: SPOHN ASSOCIATES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: spohnassociates.com
🏢 ABOUT THE COMPANY: Spohn Associates is an American company specializing in architectural solutions, including acoustics, navigation systems, sun protection, as well as equipment for skate parks and playgrounds. The company provides design, project management, and installation services.
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
- The attack is part of a larger Clop campaign in February 2026, when the group claimed to have hacked at least 25 organizations worldwide.
- According to DNS analysis, the domain spohnassociates.com uses arsmtp.com mail servers and includes SPF records from edgepilot.com.
⚠️ STATUS:
Leak status: Published (attack has been confirmed, data has not been publicly released — the group is demanding a ransom)
💫 👽
🔐 INCIDENT: INTEGRITEK
📅 Attackers' claim date: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: integritek.net
🏢 ABOUT THE COMPANY: Integritek is an American IT company specializing in managed IT services. The company provides solutions in IT support, cybersecurity, cloud services, and disaster recovery. Integritek focuses on business process optimization, security enhancement, and IT risk reduction, offering a tailored approach to each client.
📦 Total volume of leaked archive: 2.63 Tb (Terabytes)
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
* On January 21, 2026, the Clop group publicly announced a cyberattack on Integritek's infrastructure and threatened to publish the stolen data.
* The date the attack was detected in open sources is January 25, 2026.
* Integritek updated its Privacy Policy on March 18, 2026, which may be indirectly related to the incident (legal recommendation following the leak).
* The company is based in the US and operates in the IT services sector, making the leak particularly sensitive due to potential access to client infrastructure and data.
* The leak may contain data from Perpetual Financial Group and Garner Group.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.63 Tb)
💫 👽
📅 Attackers' claim date: January 21, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: integritek.net
🏢 ABOUT THE COMPANY: Integritek is an American IT company specializing in managed IT services. The company provides solutions in IT support, cybersecurity, cloud services, and disaster recovery. Integritek focuses on business process optimization, security enhancement, and IT risk reduction, offering a tailored approach to each client.
📦 Total volume of leaked archive: 2.63 Tb (Terabytes)
📂 WHAT WAS LEAKED (attackers' claims)
• Contracts and commercial proposals
• Financial documentation
• Internal corporate documents
• Employee personal data
• Technical documentation and configurations
• Client information
• Operational data
🧾 NOTE:
* On January 21, 2026, the Clop group publicly announced a cyberattack on Integritek's infrastructure and threatened to publish the stolen data.
* The date the attack was detected in open sources is January 25, 2026.
* Integritek updated its Privacy Policy on March 18, 2026, which may be indirectly related to the incident (legal recommendation following the leak).
* The company is based in the US and operates in the IT services sector, making the leak particularly sensitive due to potential access to client infrastructure and data.
* The leak may contain data from Perpetual Financial Group and Garner Group.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.63 Tb)
💫 👽
🔐 INCIDENT: CHEHARDY, SHERMAN, WILLIAMS, RECILE & HAYES
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: chehardy.com
🏢 ABOUT THE COMPANY: Chehardy, Sherman, Williams, Recile & Hayes is a US law firm founded in 1989 in Louisiana. The firm specializes in corporate law, personal injury litigation, maritime law, and family disputes, representing both large businesses and private individuals.
📂 WHAT WAS LEAKED (attackers' claims)
Based on an analysis of the published file structure, the leak includes:
* Client medical records: Complete medical histories, MRI/CT referrals, operative reports (e.g., "Operative Report"), examination results, correspondence with physicians.
* Client financial documentation: Tax returns (Form 1040), payroll stubs, medical bills, insurance payouts, and injury compensation documents.
* Legal documents: Complaints, court orders, discovery responses, strategic case notes.
* Employee personal data: Internal correspondence, OneNote notes (containing case analysis and personal comments), assignments.
* Industrial incident data: Incident scene photographs, maritime incident investigations (e.g., "TapRoot Investigation"), technical reports.
🧾 NOTE:
Analysis of the leaked folder structure confirms that the attackers copied the working folders of key employees (kcrawford, lbostick, sbowls, and others). The compromised data includes client cases containing sensitive medical information (including names of medical institutions: Jefferson Ambulatory Surgery Center, Metairie Orthopedics), tax returns, and privileged defense strategy documents.
⚠️ STATUS:
Leak status: Confirmed. Some of the confidential information (including medical records) may already be considered compromised.
💫 👽
📅 Attackers' claim date: February 10, 2026
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: chehardy.com
🏢 ABOUT THE COMPANY: Chehardy, Sherman, Williams, Recile & Hayes is a US law firm founded in 1989 in Louisiana. The firm specializes in corporate law, personal injury litigation, maritime law, and family disputes, representing both large businesses and private individuals.
📂 WHAT WAS LEAKED (attackers' claims)
Based on an analysis of the published file structure, the leak includes:
* Client medical records: Complete medical histories, MRI/CT referrals, operative reports (e.g., "Operative Report"), examination results, correspondence with physicians.
* Client financial documentation: Tax returns (Form 1040), payroll stubs, medical bills, insurance payouts, and injury compensation documents.
* Legal documents: Complaints, court orders, discovery responses, strategic case notes.
* Employee personal data: Internal correspondence, OneNote notes (containing case analysis and personal comments), assignments.
* Industrial incident data: Incident scene photographs, maritime incident investigations (e.g., "TapRoot Investigation"), technical reports.
🧾 NOTE:
Analysis of the leaked folder structure confirms that the attackers copied the working folders of key employees (kcrawford, lbostick, sbowls, and others). The compromised data includes client cases containing sensitive medical information (including names of medical institutions: Jefferson Ambulatory Surgery Center, Metairie Orthopedics), tax returns, and privileged defense strategy documents.
⚠️ STATUS:
Leak status: Confirmed. Some of the confidential information (including medical records) may already be considered compromised.
💫 👽
🔐 INCIDENT: GIACARE INC.
📅 Attackers' claim date: October 16–20, 2025.
Disclosure: Starting January 23, 2026, the company began sending official notifications to affected individuals and filing reports with state attorneys general (including New Hampshire).
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: giacare.com, giamedjv.com, giacare.local
🏢 ABOUT THE COMPANY:
GiaCare Inc. is a US company operating in healthcare and staffing outsourcing. GiaCare is a contractor for the US government, providing medical personnel (physicians, nurses, paramedics) for the Department of Defense (including SAMMC, Ft. Bragg, Ft. Campbell army hospitals), the US Air Force (Keesler, Travis, Nellis, Eglin bases), and NASA.
The company also participates in joint ventures (GiaMed JV, GiaMed Alliance JV) and works with subcontractors across the United States.
📂 WHAT WAS LEAKED (based on file structure analysis)
* Complete accounting and financial documentation
* Monthly and annual financial reports (Monthly close, Financial Statements).
* Bank statements (BB&T, Salem Bank).
* Corporate credit card statements (Amex, Chase).
* Tax forms (940, 941, W-2, Tax Returns).
* Accounts payable and accounts receivable.
* Employee HR data
* Personnel files of GiaCare employees and partner entities (PERSONNEL FILES — hundreds of folders with names).
* Medical insurance and leave documentation (Medical Leave, FMLA).
* Termination documents (TERMINATION.EXIT DOCUMENTS, COBRA).
* Workers' compensation records (WORKERS COMP).
* I-9 forms and E-Verify data.
* US government contracts (CUI)
* Contract documentation with the US Army, US Air Force, and NASA.
* Contract numbers (e.g., W81K00-13-C0006, FA301016C0021, NNL15AB70P).
* Subcontractor agreements and invoices through the WAWF system.
* Internal correspondence and operational data
* Meetings, audits, weekly reports (Weekly meeting, Audits, Quality).
* Project management data (Project Manager).
* System administrator personal data
* Contents of the desktop (My Desktop).
* Personal documents and photographs (My Documents, My Pictures).
* Game saves (Deus Ex, Civilization VI, Final Fantasy VII), confirming the mixing of work and personal information.
🧾 NOTE:
The complete directory listing (ls -R) of the $admin@cloud.backup backup has been analyzed. The backup itself was likely compromised through a breach of cloud storage or the administrator's workstation.
The leak is not limited to a single company's data — it affects the entire GiaCare Inc. ecosystem, including the joint ventures GiaMed, GiaMed Alliance, GiaMed Resources, as well as partners MedTrust LLC and subcontractors (CCMS, Advantage, REACH, Inomedic).
⚠️ STATUS:
Leak status: The complete data set has been compromised and is likely in the possession of the attackers. In the Clop ransomware model, this precedes the publication of data if negotiations fail.
💫 🫥
📅 Attackers' claim date: October 16–20, 2025.
Disclosure: Starting January 23, 2026, the company began sending official notifications to affected individuals and filing reports with state attorneys general (including New Hampshire).
🦠 Attacking group: CL0P ransomware group
🎯 Compromised domain: giacare.com, giamedjv.com, giacare.local
🏢 ABOUT THE COMPANY:
GiaCare Inc. is a US company operating in healthcare and staffing outsourcing. GiaCare is a contractor for the US government, providing medical personnel (physicians, nurses, paramedics) for the Department of Defense (including SAMMC, Ft. Bragg, Ft. Campbell army hospitals), the US Air Force (Keesler, Travis, Nellis, Eglin bases), and NASA.
The company also participates in joint ventures (GiaMed JV, GiaMed Alliance JV) and works with subcontractors across the United States.
📂 WHAT WAS LEAKED (based on file structure analysis)
* Complete accounting and financial documentation
* Monthly and annual financial reports (Monthly close, Financial Statements).
* Bank statements (BB&T, Salem Bank).
* Corporate credit card statements (Amex, Chase).
* Tax forms (940, 941, W-2, Tax Returns).
* Accounts payable and accounts receivable.
* Employee HR data
* Personnel files of GiaCare employees and partner entities (PERSONNEL FILES — hundreds of folders with names).
* Medical insurance and leave documentation (Medical Leave, FMLA).
* Termination documents (TERMINATION.EXIT DOCUMENTS, COBRA).
* Workers' compensation records (WORKERS COMP).
* I-9 forms and E-Verify data.
* US government contracts (CUI)
* Contract documentation with the US Army, US Air Force, and NASA.
* Contract numbers (e.g., W81K00-13-C0006, FA301016C0021, NNL15AB70P).
* Subcontractor agreements and invoices through the WAWF system.
* Internal correspondence and operational data
* Meetings, audits, weekly reports (Weekly meeting, Audits, Quality).
* Project management data (Project Manager).
* System administrator personal data
* Contents of the desktop (My Desktop).
* Personal documents and photographs (My Documents, My Pictures).
* Game saves (Deus Ex, Civilization VI, Final Fantasy VII), confirming the mixing of work and personal information.
🧾 NOTE:
The complete directory listing (ls -R) of the $admin@cloud.backup backup has been analyzed. The backup itself was likely compromised through a breach of cloud storage or the administrator's workstation.
The leak is not limited to a single company's data — it affects the entire GiaCare Inc. ecosystem, including the joint ventures GiaMed, GiaMed Alliance, GiaMed Resources, as well as partners MedTrust LLC and subcontractors (CCMS, Advantage, REACH, Inomedic).
⚠️ STATUS:
Leak status: The complete data set has been compromised and is likely in the possession of the attackers. In the Clop ransomware model, this precedes the publication of data if negotiations fail.
💫 🫥
🔐 INCIDENT: NG Attorneys Law Firm
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
🔐 INCIDENT: Solutions In Safety Inc.
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Fish Window Cleaning
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Cloud Clearway Group
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Broadreach Retail (BROADREACHRETAIL.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hudson Sustainable Group (HUDSONSUSTAINABLE.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hyde Park United Methodist Church (HYDEPARKUMC.ORG)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: The Mortgage Firm
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Dukosi (DUKOSI.COM)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽
🔐 **INCIDENT: Crowded Island (CROWDEDISLAND.COM)
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 **Compromised domain: crowdedisland.com
🏢 About the company:** Crowded Island is an American technology company located in the United States. The exact year of foundation and field of activity are not specified in open sources, however the company is positioned as a leading tech company. According to DNS records, the company uses Microsoft 365 and Proofpoint Essentials for email security, as well as SPF protection against domain spoofing.
📦 **Total leaked archive size: Unknown (data theft confirmed, volume not specified). 7.69 Gb have been released. The file list and structure have been published.
📂 **WHAT LEAKED (attackers' statement + data analysis):
• Technical documentation and source code (as a technology company)
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (Proofpoint Essentials MX records discovered)
🧾 **NOTES:
- Crowded Island is a technology company, which makes the leak particularly critical due to potential access to intellectual property and client data
- The company's DNS records show the use of SPF (Sender Policy Framework) protection to prevent email spoofing
⚠️ STATUS:
**Leak status: Published (attack confirmed, data leak claimed)
💫 👺
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 **Compromised domain: crowdedisland.com
🏢 About the company:** Crowded Island is an American technology company located in the United States. The exact year of foundation and field of activity are not specified in open sources, however the company is positioned as a leading tech company. According to DNS records, the company uses Microsoft 365 and Proofpoint Essentials for email security, as well as SPF protection against domain spoofing.
📦 **Total leaked archive size: Unknown (data theft confirmed, volume not specified). 7.69 Gb have been released. The file list and structure have been published.
📂 **WHAT LEAKED (attackers' statement + data analysis):
• Technical documentation and source code (as a technology company)
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (Proofpoint Essentials MX records discovered)
🧾 **NOTES:
- Crowded Island is a technology company, which makes the leak particularly critical due to potential access to intellectual property and client data
- The company's DNS records show the use of SPF (Sender Policy Framework) protection to prevent email spoofing
⚠️ STATUS:
**Leak status: Published (attack confirmed, data leak claimed)
💫 👺
🔐 **INCIDENT: Ideal Welders (IDEALWELDERS.COM)
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: idealwelders.com
🏢 About the company: Ideal Welders is a Canadian industrial company providing custom metal fabrication services. The company specializes in both complex and simple projects, including the fabrication of precision components and structures. Manufacturing capabilities include pressure vessels, pipe fittings, structural welding, and other services. With over 50 years of experience, the company serves industries such as chemical, pulp and paper, oil, and gas.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Engineering and technical documentation
• Drawings and product specifications
• Client data (chemical, oil and gas, pulp and paper industries)
• Employee information
• Financial documentation
• Contracts and commercial proposals
• Internal corporate correspondence
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed)
💫 🫥
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: idealwelders.com
🏢 About the company: Ideal Welders is a Canadian industrial company providing custom metal fabrication services. The company specializes in both complex and simple projects, including the fabrication of precision components and structures. Manufacturing capabilities include pressure vessels, pipe fittings, structural welding, and other services. With over 50 years of experience, the company serves industries such as chemical, pulp and paper, oil, and gas.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Engineering and technical documentation
• Drawings and product specifications
• Client data (chemical, oil and gas, pulp and paper industries)
• Employee information
• Financial documentation
• Contracts and commercial proposals
• Internal corporate correspondence
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed)
💫 🫥
🔐 **INCIDENT: Strategic Objectives Inc.
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: strategicobjectives.com
🏢 About the company: Strategic Objectives Inc. is a Canadian PR agency located in Toronto, Canada. The company provides strategic PR solutions for brand and reputation building, as well as achieving measurable results. The firm serves a wide range of industries, including consumer, lifestyle, retail, and corporate sectors. Services include social and digital communications, crisis management, and event marketing.
📂 WHAT LEAKED (attackers' statement):
• Strategic PR documents and communication plans
• Client data (consumer, retail, corporate sectors)
• Employee information
• Financial documentation
• Crisis management documentation
• Internal corporate correspondence
• Marketing and event campaign data
🧾 NOTES:
* The company's DNS records show the use of Microsoft 365 (SPF record:
* No downloadable files or visual evidence are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed
💫 🫥
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: strategicobjectives.com
🏢 About the company: Strategic Objectives Inc. is a Canadian PR agency located in Toronto, Canada. The company provides strategic PR solutions for brand and reputation building, as well as achieving measurable results. The firm serves a wide range of industries, including consumer, lifestyle, retail, and corporate sectors. Services include social and digital communications, crisis management, and event marketing.
📂 WHAT LEAKED (attackers' statement):
• Strategic PR documents and communication plans
• Client data (consumer, retail, corporate sectors)
• Employee information
• Financial documentation
• Crisis management documentation
• Internal corporate correspondence
• Marketing and event campaign data
🧾 NOTES:
* The company's DNS records show the use of Microsoft 365 (SPF record:
v=spf1 include:spf.protection.outlook.com -all) and Barracuda Networks for email protection* No downloadable files or visual evidence are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed
💫 🫥
🔐 INCIDENT: TRJ Ltd
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: trjltd.co.uk
🏢 About the company: TRJ Ltd is a British company providing business services.
👺The exact year of foundation and field of activity are not specified in open sources.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data. The attackers' statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."
Potentially leaked data may include:
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
🧾 NOTES:
👁 DNS records of the company show the use of Microsoft 365 (MX record: trjltd-co-uk.mail.protection.outlook.com)
😎 SPF record of the company: v=spf1 include:spf.protection.outlook.com include:spf.UK.exclaimer.net ip4:85.236.147.194/29 ip4:85.236.147.162/29 ~all
👿 Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: trjltd.co.uk
🏢 About the company: TRJ Ltd is a British company providing business services.
👺The exact year of foundation and field of activity are not specified in open sources.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data. The attackers' statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."
Potentially leaked data may include:
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
🧾 NOTES:
👁 DNS records of the company show the use of Microsoft 365 (MX record: trjltd-co-uk.mail.protection.outlook.com)
😎 SPF record of the company: v=spf1 include:spf.protection.outlook.com include:spf.UK.exclaimer.net ip4:85.236.147.194/29 ip4:85.236.147.162/29 ~all
👿 Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫
👺
🔐 INCIDENT: VIP Properties LLC
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: vippllc.com
🏢 About the company: VIP Properties LLC is an American real estate rental company located in Essex Junction, Vermont. The company was founded in 2011. Field of activity: Real Property Lessors. According to Dun & Bradstreet, the company's annual revenue is approximately $102,573, with 1 employee. Contact person is Jeff Spooner.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). 16.5 Gb have been released. The file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Real estate and tenant data
• Financial documentation and accounting records
• Personal data of employees and contact information
• Lease agreements and commercial proposals
• Internal corporate correspondence
• Company owner information
🧾 NOTES:
- The company's DNS records show the use of Microsoft 365 (MX record:
- SPF record of the company:
- The company uses a domain registered through GoDaddy (WHOIS email:
⚠️ STATUS:
Leak status: Questionable
💫 😂
🔐 INCIDENT: VIP Properties LLC
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: vippllc.com
🏢 About the company: VIP Properties LLC is an American real estate rental company located in Essex Junction, Vermont. The company was founded in 2011. Field of activity: Real Property Lessors. According to Dun & Bradstreet, the company's annual revenue is approximately $102,573, with 1 employee. Contact person is Jeff Spooner.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). 16.5 Gb have been released. The file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Real estate and tenant data
• Financial documentation and accounting records
• Personal data of employees and contact information
• Lease agreements and commercial proposals
• Internal corporate correspondence
• Company owner information
🧾 NOTES:
- The company's DNS records show the use of Microsoft 365 (MX record:
vippllc-com.mail.protection.outlook.com)- SPF record of the company:
v=spf1 include:spf.protection.outlook.com -all- The company uses a domain registered through GoDaddy (WHOIS email:
abuse@godaddy.com)⚠️ STATUS:
Leak status: Questionable
💫 😂
👺
🔐 INCIDENT: MNK Associates
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: mnkassociates.com
🏢 About the company: MNK Associates is a British consulting company registered in Alfreton, Derbyshire, UK (16 Mount Crescent Broadmeadows, South Normanton). The company was founded on April 27, 2016, main activity is management consulting (SIC: 70229). Company status is Active. The CL0P group classifies it as a company in the business services sector.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). The leak page shows the same magnet link as for VIP Properties LLC.
📂 WHAT LEAKED (attackers' statement):
• Client and partner data (management consulting)
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
• Strategic consulting documents
🧾 NOTES:
The company's DNS records show the use of Microsoft 365 (MX record: mnkassociates-com.mail.protection.outlook.com)
SPF record of the company: v=spf1 include:spf.protection.outlook.com -all
Microsoft 365 verification code: MS=ms42271467
The domain is registered through PublicDomainRegistry.com (WHOIS email: abuse-contact@publicdomainregistry.com)
👿 No downloadable files or visual evidence are present on the leak page — only the breach claim, and the same magnet link as for VIP Properties LLC is indicated
⚠️ STATUS:
Leak status: Questionable
💫 😂
🔐 INCIDENT: MNK Associates
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: mnkassociates.com
🏢 About the company: MNK Associates is a British consulting company registered in Alfreton, Derbyshire, UK (16 Mount Crescent Broadmeadows, South Normanton). The company was founded on April 27, 2016, main activity is management consulting (SIC: 70229). Company status is Active. The CL0P group classifies it as a company in the business services sector.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). The leak page shows the same magnet link as for VIP Properties LLC.
📂 WHAT LEAKED (attackers' statement):
• Client and partner data (management consulting)
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
• Strategic consulting documents
🧾 NOTES:
The company's DNS records show the use of Microsoft 365 (MX record: mnkassociates-com.mail.protection.outlook.com)
SPF record of the company: v=spf1 include:spf.protection.outlook.com -all
Microsoft 365 verification code: MS=ms42271467
The domain is registered through PublicDomainRegistry.com (WHOIS email: abuse-contact@publicdomainregistry.com)
👿 No downloadable files or visual evidence are present on the leak page — only the breach claim, and the same magnet link as for VIP Properties LLC is indicated
⚠️ STATUS:
Leak status: Questionable
💫 😂