🔐 INCIDENT: NG Attorneys Law Firm
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: ngattorneys.com
🏢 About the company: NG Attorneys is a US-based law firm specializing in medical malpractice and insurance law. Located in Florida. Serves hospitals, insurance companies, and private individuals. Has been handling cases since 2011.
📦 Total leaked archive size: 2.17 Tb (Terabytes)
📂 WHAT LEAKED (attackers' statement + file analysis):
• Complete case dossiers (lawsuits, motions, appeals)
• Patient medical records (MEDREC)
• W-9 forms containing SSNs
• Tax returns of employees and clients
• Financial documentation and invoices (Client Invoices)
• Personal data of employees
• Confidential correspondence with clients
• Internal corporate documents and guidelines
• Case management system database (_PracticeMaster)
• Bankruptcy records (Probate)
🧾 NOTES:
* On February 7, 2026, the Clop group added NG Attorneys to the victim list on their darknet site.
* The leak volume is 2.17 TB, indicating the theft of a multi-year document database.
* W-9 forms containing Social Security Numbers (SSNs) of employees and contractors were found in the leak.
* Medical records are also present, constituting a HIPAA violation.
* The files were presumably obtained through a breach of the firm's IT infrastructure or that of its contractor.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed, volume — 2.17 TB)
🔐 INCIDENT: Solutions In Safety Inc.
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: solutionsinsafety.com
🏢 About the company: Solutions In Safety Inc. is a US-based company specializing in consulting and training in the field of occupational health and industrial safety. Provides services in safety assessments, employee training, development of safety protocols, and assistance with OSHA compliance across various industries. The company is located in the USA.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers encrypted and exfiltrated sensitive company data.
• Occupational health and safety assessments and reports
• Client safety protocols and compliance documents
• Employee training records and materials
• OSHA compliance documents
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Client information
🧾 NOTES:
On February 10, 2026, the CL0P group claimed responsibility for the cyberattack on Solutions In Safety Inc.
The attack was discovered on February 14, 2026 (UTC)
Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Fish Window Cleaning
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: fishwindowcleaning.com
🏢 About the company: Fish Window Cleaning is the world's largest window cleaning company, founded in 1978 in St. Louis. It is a franchise network with more than 275 locations across the United States. The company serves over 200,000 commercial and residential clients, providing window cleaning, gutter cleaning, chandelier cleaning, skylight cleaning, and mirror cleaning services. The company's headquarters is located in St. Louis, Missouri.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified)
📂 WHAT LEAKED (attackers' statement + data analysis):
• Client information (over 200,000 clients nationwide)
• Franchise documentation and agreements
• Financial reports and accounting records
• Personal data of employees
• Internal corporate correspondence
• Data on more than 275 franchise locations
• Commercial proposals and pricing information
🧾 NOTES:
Only the file list has been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Cloud Clearway Group
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: March 30, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: cloud.clearwaygroup.com
🏢 About the company: Cloud Clearway Group is a Canadian IT company specializing in cloud infrastructure and IT services. It is a subsidiary of Clearway Group, a Canadian construction company founded in 1999 in Toronto. Clearway Group has more than 20 offices across Canada and provides services in construction, real estate, and IT infrastructure.
📦 Total leaked archive size: 1.86 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• Cloud infrastructure data and configurations
• Client information of IT services
• Internal corporate correspondence
• Personal data of employees
• Financial documentation
• Technical documentation and access codes
• Construction project and real estate data (parent company)
🧾 NOTES:
* Cloud Clearway Group is the IT subsidiary of the construction company Clearway Group
* Clearway Group is a large Canadian company with more than 20 offices and an annual revenue exceeding $500 million
* The attack affected the company's critical cloud infrastructure
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Broadreach Retail (BROADREACHRETAIL.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: broadreachretail.com
🏢 About the company: Broadreach Retail is an American company in the retail sector. According to an AI-generated description on a ransomware tracking website, the company is engaged in real estate investment, specializing in the acquisition of commercial real estate.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Retail customer data
• Financial documentation
• Personal data of employees
• Commercial real estate information
• Internal corporate correspondence
• Contracts and commercial proposals
🧾 NOTES:
Broadreach Retail is a company in the retail sector, which makes the leak particularly critical due to potential access to consumer data and banking information.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hudson Sustainable Group (HUDSONSUSTAINABLE.COM)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hudsonsustainable.com
🏢 About the company: Hudson Sustainable Group is an American investment company founded in 2007, specializing in sustainable investing in the clean energy, renewable energy, energy efficiency, and clean transportation infrastructure sectors. Headquarters is located in Miami, Florida. The company manages over $13 billion in assets, has 11-50 employees. Senior team members previously ran Goldman Sachs' alternative energy platform and led renewable energy investments for GE Energy Financial Services. The company has executed 19 transactions and invested in 14 portfolio companies.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Portfolio company data and investment project information
• Financial documentation (managing $13 billion in assets)
• Personal data of employees
• Client and investor information
• Internal corporate correspondence
• Contracts and commercial proposals
• Strategic partnership data
🧾 NOTES:
- The company manages over $13 billion in assets, making the leak particularly critical due to potential disclosure of financial information about portfolio companies and investors
- Headquarters is located in Miami, Florida
- Hudson Sustainable Group is an investment company in the clean energy sector; senior team members previously worked at Goldman Sachs and GE Energy Financial Services
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Hyde Park United Methodist Church (HYDEPARKUMC.ORG)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 14, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: hydeparkumc.org
🏢 About the company: Hyde Park United Methodist Church is a religious organization located in the United States (Florida, Tampa). The church was founded in 1888 and is one of the oldest and largest Methodist tradition churches in the region. The organization provides religious services, conducts community programs, and engages in charitable activities. Headquarters is located in Tampa, Florida.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
Potentially leaked data may include:
• Personal data of parishioners and employees
• Financial documentation and donations
• Internal corporate correspondence
• Charitable program data
• Volunteer information
• Contracts with contractors and suppliers
🧾 NOTES:
- On February 14, 2026, the CL0P group claimed responsibility for the cyberattack on Hyde Park United Methodist Church
- The attack was discovered on February 14, 2026 (UTC)
- Hyde Park United Methodist Church is one of the oldest churches in Florida, founded in 1888
- No downloadable files are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: The Mortgage Firm
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
📅 Date of attackers' claim: February 10, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: themortgagefirm.com
🏢 About the company: The Mortgage Firm is a mortgage lending company based in Orlando, Florida. Founded in 1995, the company operates multiple branches, including several in Brevard County, and has expanded its reach to states such as Alabama, Georgia, Texas, and more. The company offers a range of loan products, including conventional, FHA, VA, USDA, and jumbo loans.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Customer names and addresses
• Social Security numbers (SSNs)
• Financial account details
• Loan documents
• Information related to mortgage applications
• Sensitive personally identifiable information (PII)
🧾 NOTES:
February 10, 2026 — the CL0P ransomware group announced a cyberattack targeting THEMORTGAGEFIRM.COM, a key player in Canada's financial services industry
The incident was posted on the dark web on February 10, 2026, with the group claiming to have accessed the organization's internal data
The breach has potentially impacted individuals in several states; the total number has not been disclosed
CL0P has amassed 1062 lifetime victims since August 2020
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
🔐 INCIDENT: Dukosi (DUKOSI.COM)
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: dukosi.com
🏢 About the company: Dukosi Ltd. is a British technology company founded in 2003 in Edinburgh, Scotland. The company develops revolutionary battery management technologies, including the Chip-on-Cell cell monitoring system and the C-SynQ® communication protocol. Dukosi's solutions are used in electric vehicles (EVs), industrial transport, and stationary energy storage systems. The company has offices in the US, Asia, and Europe, with a staff of 100-200 employees. Annual revenue is estimated in the range of 5-25 million, with total funding raised of5−25million,withtotalfundingraisedof6.4 million.
📦 Total leaked archive size: 1.07 Tb
📂 WHAT LEAKED (attackers' statement + data analysis):
• R&D and intellectual property in battery management
• Source code and technical documentation
• Client and partner information (automakers, battery manufacturers)
• Employee data
• Financial documentation
• Internal corporate correspondence
• Patent documentation (the company holds 24 patents)
🧾 NOTES:
👺 In July 2025, Dukosi received ISO 27001 certification, confirming compliance with international information security standards
😈 The attack was discovered on February 7, 2026 (UTC)
😂 In November 2025, the company received the CLEPA Innovation Award as an SME Top Innovator in the "Green Technologies" category
⚡️ Dukosi is a key player in battery management systems for electric vehicles and energy storage
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫 👽
🔐 **INCIDENT: Crowded Island (CROWDEDISLAND.COM)
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 **Compromised domain: crowdedisland.com
🏢 About the company:** Crowded Island is an American technology company located in the United States. The exact year of foundation and field of activity are not specified in open sources, however the company is positioned as a leading tech company. According to DNS records, the company uses Microsoft 365 and Proofpoint Essentials for email security, as well as SPF protection against domain spoofing.
📦 **Total leaked archive size: Unknown (data theft confirmed, volume not specified). 7.69 Gb have been released. The file list and structure have been published.
📂 **WHAT LEAKED (attackers' statement + data analysis):
• Technical documentation and source code (as a technology company)
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (Proofpoint Essentials MX records discovered)
🧾 **NOTES:
- Crowded Island is a technology company, which makes the leak particularly critical due to potential access to intellectual property and client data
- The company's DNS records show the use of SPF (Sender Policy Framework) protection to prevent email spoofing
⚠️ STATUS:
**Leak status: Published (attack confirmed, data leak claimed)
💫 👺
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 **Compromised domain: crowdedisland.com
🏢 About the company:** Crowded Island is an American technology company located in the United States. The exact year of foundation and field of activity are not specified in open sources, however the company is positioned as a leading tech company. According to DNS records, the company uses Microsoft 365 and Proofpoint Essentials for email security, as well as SPF protection against domain spoofing.
📦 **Total leaked archive size: Unknown (data theft confirmed, volume not specified). 7.69 Gb have been released. The file list and structure have been published.
📂 **WHAT LEAKED (attackers' statement + data analysis):
• Technical documentation and source code (as a technology company)
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (Proofpoint Essentials MX records discovered)
🧾 **NOTES:
- Crowded Island is a technology company, which makes the leak particularly critical due to potential access to intellectual property and client data
- The company's DNS records show the use of SPF (Sender Policy Framework) protection to prevent email spoofing
⚠️ STATUS:
**Leak status: Published (attack confirmed, data leak claimed)
💫 👺
🔐 **INCIDENT: Ideal Welders (IDEALWELDERS.COM)
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: idealwelders.com
🏢 About the company: Ideal Welders is a Canadian industrial company providing custom metal fabrication services. The company specializes in both complex and simple projects, including the fabrication of precision components and structures. Manufacturing capabilities include pressure vessels, pipe fittings, structural welding, and other services. With over 50 years of experience, the company serves industries such as chemical, pulp and paper, oil, and gas.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Engineering and technical documentation
• Drawings and product specifications
• Client data (chemical, oil and gas, pulp and paper industries)
• Employee information
• Financial documentation
• Contracts and commercial proposals
• Internal corporate correspondence
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed)
💫 🫥
📅 **Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: idealwelders.com
🏢 About the company: Ideal Welders is a Canadian industrial company providing custom metal fabrication services. The company specializes in both complex and simple projects, including the fabrication of precision components and structures. Manufacturing capabilities include pressure vessels, pipe fittings, structural welding, and other services. With over 50 years of experience, the company serves industries such as chemical, pulp and paper, oil, and gas.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Engineering and technical documentation
• Drawings and product specifications
• Client data (chemical, oil and gas, pulp and paper industries)
• Employee information
• Financial documentation
• Contracts and commercial proposals
• Internal corporate correspondence
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed)
💫 🫥
🔐 **INCIDENT: Strategic Objectives Inc.
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: strategicobjectives.com
🏢 About the company: Strategic Objectives Inc. is a Canadian PR agency located in Toronto, Canada. The company provides strategic PR solutions for brand and reputation building, as well as achieving measurable results. The firm serves a wide range of industries, including consumer, lifestyle, retail, and corporate sectors. Services include social and digital communications, crisis management, and event marketing.
📂 WHAT LEAKED (attackers' statement):
• Strategic PR documents and communication plans
• Client data (consumer, retail, corporate sectors)
• Employee information
• Financial documentation
• Crisis management documentation
• Internal corporate correspondence
• Marketing and event campaign data
🧾 NOTES:
* The company's DNS records show the use of Microsoft 365 (SPF record:
* No downloadable files or visual evidence are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed
💫 🫥
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: strategicobjectives.com
🏢 About the company: Strategic Objectives Inc. is a Canadian PR agency located in Toronto, Canada. The company provides strategic PR solutions for brand and reputation building, as well as achieving measurable results. The firm serves a wide range of industries, including consumer, lifestyle, retail, and corporate sectors. Services include social and digital communications, crisis management, and event marketing.
📂 WHAT LEAKED (attackers' statement):
• Strategic PR documents and communication plans
• Client data (consumer, retail, corporate sectors)
• Employee information
• Financial documentation
• Crisis management documentation
• Internal corporate correspondence
• Marketing and event campaign data
🧾 NOTES:
* The company's DNS records show the use of Microsoft 365 (SPF record:
v=spf1 include:spf.protection.outlook.com -all) and Barracuda Networks for email protection* No downloadable files or visual evidence are present on the leak page — only the breach claim
⚠️ STATUS:
Leak status: Attack confirmed, data leak claimed
💫 🫥
🔐 INCIDENT: TRJ Ltd
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: trjltd.co.uk
🏢 About the company: TRJ Ltd is a British company providing business services.
👺The exact year of foundation and field of activity are not specified in open sources.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data. The attackers' statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."
Potentially leaked data may include:
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
🧾 NOTES:
👁 DNS records of the company show the use of Microsoft 365 (MX record: trjltd-co-uk.mail.protection.outlook.com)
😎 SPF record of the company: v=spf1 include:spf.protection.outlook.com include:spf.UK.exclaimer.net ip4:85.236.147.194/29 ip4:85.236.147.162/29 ~all
👿 Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: trjltd.co.uk
🏢 About the company: TRJ Ltd is a British company providing business services.
👺The exact year of foundation and field of activity are not specified in open sources.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). Only the file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data. The attackers' statement: "The full leak will be published soon, unless a company representative contacts us via the channels provided."
Potentially leaked data may include:
• Client and partner data
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
🧾 NOTES:
👁 DNS records of the company show the use of Microsoft 365 (MX record: trjltd-co-uk.mail.protection.outlook.com)
😎 SPF record of the company: v=spf1 include:spf.protection.outlook.com include:spf.UK.exclaimer.net ip4:85.236.147.194/29 ip4:85.236.147.162/29 ~all
👿 Only the file list and structure have been published.
⚠️ STATUS:
Leak status: Published (attack confirmed, data leak claimed)
💫
👺
🔐 INCIDENT: VIP Properties LLC
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: vippllc.com
🏢 About the company: VIP Properties LLC is an American real estate rental company located in Essex Junction, Vermont. The company was founded in 2011. Field of activity: Real Property Lessors. According to Dun & Bradstreet, the company's annual revenue is approximately $102,573, with 1 employee. Contact person is Jeff Spooner.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). 16.5 Gb have been released. The file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Real estate and tenant data
• Financial documentation and accounting records
• Personal data of employees and contact information
• Lease agreements and commercial proposals
• Internal corporate correspondence
• Company owner information
🧾 NOTES:
- The company's DNS records show the use of Microsoft 365 (MX record:
- SPF record of the company:
- The company uses a domain registered through GoDaddy (WHOIS email:
⚠️ STATUS:
Leak status: Questionable
💫 😂
🔐 INCIDENT: VIP Properties LLC
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: vippllc.com
🏢 About the company: VIP Properties LLC is an American real estate rental company located in Essex Junction, Vermont. The company was founded in 2011. Field of activity: Real Property Lessors. According to Dun & Bradstreet, the company's annual revenue is approximately $102,573, with 1 employee. Contact person is Jeff Spooner.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). 16.5 Gb have been released. The file list and structure have been published.
📂 WHAT LEAKED (attackers' statement + data analysis):
• Real estate and tenant data
• Financial documentation and accounting records
• Personal data of employees and contact information
• Lease agreements and commercial proposals
• Internal corporate correspondence
• Company owner information
🧾 NOTES:
- The company's DNS records show the use of Microsoft 365 (MX record:
vippllc-com.mail.protection.outlook.com)- SPF record of the company:
v=spf1 include:spf.protection.outlook.com -all- The company uses a domain registered through GoDaddy (WHOIS email:
abuse@godaddy.com)⚠️ STATUS:
Leak status: Questionable
💫 😂
👺
🔐 INCIDENT: MNK Associates
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: mnkassociates.com
🏢 About the company: MNK Associates is a British consulting company registered in Alfreton, Derbyshire, UK (16 Mount Crescent Broadmeadows, South Normanton). The company was founded on April 27, 2016, main activity is management consulting (SIC: 70229). Company status is Active. The CL0P group classifies it as a company in the business services sector.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). The leak page shows the same magnet link as for VIP Properties LLC.
📂 WHAT LEAKED (attackers' statement):
• Client and partner data (management consulting)
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
• Strategic consulting documents
🧾 NOTES:
The company's DNS records show the use of Microsoft 365 (MX record: mnkassociates-com.mail.protection.outlook.com)
SPF record of the company: v=spf1 include:spf.protection.outlook.com -all
Microsoft 365 verification code: MS=ms42271467
The domain is registered through PublicDomainRegistry.com (WHOIS email: abuse-contact@publicdomainregistry.com)
👿 No downloadable files or visual evidence are present on the leak page — only the breach claim, and the same magnet link as for VIP Properties LLC is indicated
⚠️ STATUS:
Leak status: Questionable
💫 😂
🔐 INCIDENT: MNK Associates
📅 Date of attackers' claim: February 7, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: mnkassociates.com
🏢 About the company: MNK Associates is a British consulting company registered in Alfreton, Derbyshire, UK (16 Mount Crescent Broadmeadows, South Normanton). The company was founded on April 27, 2016, main activity is management consulting (SIC: 70229). Company status is Active. The CL0P group classifies it as a company in the business services sector.
📦 Total leaked archive size: Unknown (data theft confirmed, volume not specified). The leak page shows the same magnet link as for VIP Properties LLC.
📂 WHAT LEAKED (attackers' statement):
• Client and partner data (management consulting)
• Personal data of employees
• Financial documentation
• Internal corporate correspondence
• Cloud infrastructure configurations
• Data from Microsoft 365 (MX records for protection.outlook.com discovered)
• Contracts and commercial proposals
• Strategic consulting documents
🧾 NOTES:
The company's DNS records show the use of Microsoft 365 (MX record: mnkassociates-com.mail.protection.outlook.com)
SPF record of the company: v=spf1 include:spf.protection.outlook.com -all
Microsoft 365 verification code: MS=ms42271467
The domain is registered through PublicDomainRegistry.com (WHOIS email: abuse-contact@publicdomainregistry.com)
👿 No downloadable files or visual evidence are present on the leak page — only the breach claim, and the same magnet link as for VIP Properties LLC is indicated
⚠️ STATUS:
Leak status: Questionable
💫 😂
😎
🔐 INCIDENT: Brault (BRAULT.US)
* 📅 Date of attackers' claim: February 7, 2026
* 🦠 Attackers: CL0P ransomware group
* 🎯 Compromised domain: brault.us
* 🏢 About the company: Brault is a technology company specializing in document management software development, digital transformation, and workflow automation. Headquarters is located in the USA.
As of February 7, 2026, the company Brault (brault.us) was added to the victim list of the CL0P group. Information about the company and the leak details are based solely on the CL0P group's statements.
### 📂 Attackers' statements:
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data, including files from servers and cloud storage.
### 🧾 NOTES:
😂 On February 7, 2026, the CL0P group added Brault to the victim list on their darknet site.
🫥 Brault develops security and compliance solutions, which makes the incident particularly reputationally sensitive if confirmed.
👺 The information is based solely on the attackers' statements and has no confirmation or evidence.
### ⚠️ STATUS:
**Leak status: Questionable. Not confirmed.**
--- 👹
🔐 INCIDENT: Brault (BRAULT.US)
* 📅 Date of attackers' claim: February 7, 2026
* 🦠 Attackers: CL0P ransomware group
* 🎯 Compromised domain: brault.us
* 🏢 About the company: Brault is a technology company specializing in document management software development, digital transformation, and workflow automation. Headquarters is located in the USA.
As of February 7, 2026, the company Brault (brault.us) was added to the victim list of the CL0P group. Information about the company and the leak details are based solely on the CL0P group's statements.
### 📂 Attackers' statements:
According to the CL0P ransomware group's statement, the attackers exfiltrated confidential company data, including files from servers and cloud storage.
### 🧾 NOTES:
😂 On February 7, 2026, the CL0P group added Brault to the victim list on their darknet site.
🫥 Brault develops security and compliance solutions, which makes the incident particularly reputationally sensitive if confirmed.
👺 The information is based solely on the attackers' statements and has no confirmation or evidence.
### ⚠️ STATUS:
**Leak status: Questionable. Not confirmed.**
--- 👹
👺
🔐 **INCIDENT: INJURYLAWYERS.COM
📅 Date of attackers' claim: April 28, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: injurylawyers.com
🏢 About the company: INJURYLAWYERS.COM is a US-based online platform in the legal services sector that helps injured individuals find qualified attorneys. Operating in the legal referral and marketing industry, the platform helps accident victims find representation for cases involving car accidents, workplace injuries, medical malpractice, and similar claims.
📦 **Total leaked archive size: Unknown. The first part of the archive, 3.28 Tb + second part - 3.41 Tb.
📂 WHAT LEAKED (😎 attackers' statement):
According to the CL0P ransomware group's statement, potentially leaked data may include:
• Personal client information (name, address, contact details)
• Injury and medical claim data
• Financial documentation
• Internal corporate correspondence
• Attorney and partner data
• Cloud infrastructure configurations
• Data from Microsoft 365 and Salesforce (MX records discovered)
🧾 **NOTES:**
- A multi-volume dropbox_backup archive is presented as proof. Files cannot be viewed without downloading all parts. No file list is available.
⚠️ **STATUS:**
**Leak status: Questionable.**
---💫 🫥
🔐 **INCIDENT: INJURYLAWYERS.COM
📅 Date of attackers' claim: April 28, 2026
🦠 Attackers: CL0P ransomware group
🎯 Compromised domain: injurylawyers.com
🏢 About the company: INJURYLAWYERS.COM is a US-based online platform in the legal services sector that helps injured individuals find qualified attorneys. Operating in the legal referral and marketing industry, the platform helps accident victims find representation for cases involving car accidents, workplace injuries, medical malpractice, and similar claims.
📦 **Total leaked archive size: Unknown. The first part of the archive, 3.28 Tb + second part - 3.41 Tb.
📂 WHAT LEAKED (😎 attackers' statement):
According to the CL0P ransomware group's statement, potentially leaked data may include:
• Personal client information (name, address, contact details)
• Injury and medical claim data
• Financial documentation
• Internal corporate correspondence
• Attorney and partner data
• Cloud infrastructure configurations
• Data from Microsoft 365 and Salesforce (MX records discovered)
🧾 **NOTES:**
- A multi-volume dropbox_backup archive is presented as proof. Files cannot be viewed without downloading all parts. No file list is available.
⚠️ **STATUS:**
**Leak status: Questionable.**
---💫 🫥