π INCIDENT: FDC Interiors
π Attacker's Claim Date: November 18, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: fdcinteriors.com
π’ About the Company: FDC Interiors is a luxury interior design and construction firm headquartered in Dubai, UAE, specializing in creating high-end environments for prestigious brands and commercial clients. The company focuses on unique designs from conception to completion, utilizing precision craftsmanship. 201β500 employees | Headquarters: National Industries Park, Dubai, United Arab Emirates, P.O. Box 113507
π¦ Total size of the leaked archive: 14.84 GB
π WHAT WAS LEAKED:
Based on Medusa's published evidence and analysis from security researchers :
* Architectural drawings, 3D modeling files, and structural design documents
* CAD files and engineering reports
* Client project plans and concept designs
* Financial documents (including scanned checks and invoices)
* Vendor contracts and procurement documentation
* Internal spreadsheets and operational logs
* Employee databases and payroll information
* Project financials and budgeting records
* Corporate file structures and project plans
* Blueprints, sketches, renderings, and layout specifications
* High-risk operational data (floor plans, equipment lists, security configurations)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: November 18, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: fdcinteriors.com
π’ About the Company: FDC Interiors is a luxury interior design and construction firm headquartered in Dubai, UAE, specializing in creating high-end environments for prestigious brands and commercial clients. The company focuses on unique designs from conception to completion, utilizing precision craftsmanship. 201β500 employees | Headquarters: National Industries Park, Dubai, United Arab Emirates, P.O. Box 113507
π¦ Total size of the leaked archive: 14.84 GB
π WHAT WAS LEAKED:
Based on Medusa's published evidence and analysis from security researchers :
* Architectural drawings, 3D modeling files, and structural design documents
* CAD files and engineering reports
* Client project plans and concept designs
* Financial documents (including scanned checks and invoices)
* Vendor contracts and procurement documentation
* Internal spreadsheets and operational logs
* Employee databases and payroll information
* Project financials and budgeting records
* Corporate file structures and project plans
* Blueprints, sketches, renderings, and layout specifications
* High-risk operational data (floor plans, equipment lists, security configurations)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Albany College of Pharmacy and Health Sciences
π Attacker's Claim Date: October 7, 2024 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: acphs.edu
π’ About the Company: Albany College of Pharmacy and Health Sciences (ACPHS) is a private institution founded in 1881, located in Albany, New York, with a satellite campus in Vermont. The college offers undergraduate, graduate, and professional pharmacy and health sciences programs, serving approximately 800-900 students and employing around 115-200 faculty members. The college operates two affiliated pharmacies: College Parkside Pharmacy and College Hometown Pharmacy in New York state.
π¦ Total size of the leaked archive: 178.16 GB
π WHAT WAS LEAKED:
Based on official breach notices and security analysis, the following types of information were potentially compromised :
β’ Personal Identifiers β Full names, dates of birth, birth certificates, marriage certificates, mother's maiden name, digital signatures
β’ Government IDs β Social Security numbers (SSNs), passport numbers, government identification numbers, taxpayer ID numbers, driver's license numbers, alien registration numbers
β’ Financial Information β Account numbers, routing numbers, security codes, payment card numbers and expiration dates
β’ Login Credentials β Usernames and passwords
β’ Health Insurance & Medical Information β Health insurance information, medical record numbers, mental or physical conditions, diagnosis/treatment information, procedure types, provider names, prescription information, biometric data
β’ Student Information β Academic records and student-related data
β’ Pharmacy Patient Data β Information from College Parkside Pharmacy (5,736 individuals) and College Hometown Pharmacy (9,742 individuals)
π§Ύ NOTE:
Number of Affected Individuals: Approximately 28,600 individuals (including 108 Maine residents in initial filing, plus subsequent filing of 1,662 individuals). Pharmacy patients affected: 5,736 (College Parkside) and 9,742 (College Hometown).
Official Investigation Conclusion: May 30, 2025
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: October 7, 2024 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: acphs.edu
π’ About the Company: Albany College of Pharmacy and Health Sciences (ACPHS) is a private institution founded in 1881, located in Albany, New York, with a satellite campus in Vermont. The college offers undergraduate, graduate, and professional pharmacy and health sciences programs, serving approximately 800-900 students and employing around 115-200 faculty members. The college operates two affiliated pharmacies: College Parkside Pharmacy and College Hometown Pharmacy in New York state.
π¦ Total size of the leaked archive: 178.16 GB
π WHAT WAS LEAKED:
Based on official breach notices and security analysis, the following types of information were potentially compromised :
β’ Personal Identifiers β Full names, dates of birth, birth certificates, marriage certificates, mother's maiden name, digital signatures
β’ Government IDs β Social Security numbers (SSNs), passport numbers, government identification numbers, taxpayer ID numbers, driver's license numbers, alien registration numbers
β’ Financial Information β Account numbers, routing numbers, security codes, payment card numbers and expiration dates
β’ Login Credentials β Usernames and passwords
β’ Health Insurance & Medical Information β Health insurance information, medical record numbers, mental or physical conditions, diagnosis/treatment information, procedure types, provider names, prescription information, biometric data
β’ Student Information β Academic records and student-related data
β’ Pharmacy Patient Data β Information from College Parkside Pharmacy (5,736 individuals) and College Hometown Pharmacy (9,742 individuals)
π§Ύ NOTE:
Number of Affected Individuals: Approximately 28,600 individuals (including 108 Maine residents in initial filing, plus subsequent filing of 1,662 individuals). Pharmacy patients affected: 5,736 (College Parkside) and 9,742 (College Hometown).
Official Investigation Conclusion: May 30, 2025
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: General Distributing
π Attacker's Claim Date: November 17, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π’ About the Company: General Distributing Co. operates in the convenience stores, gas stations, and liquor stores industry. The company is headquartered in Salt Lake City, Utah at 5350 W Amelia Earhart Drive, Salt Lake City, UT 84116, USA. 100β249 employees (approximately 168 employees) | Annual revenue: $25Mβ$50M
π¦ Total size of the leaked archive: 82.35 GB (based on provided data)
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Financial documents β including scanned checks and invoices
β’ Internal spreadsheets β operational logs and corporate data
β’ Client and partner information
β’ Employee databases and payroll information
β’ Corporate file structures and project plans
β’ Distribution and logistics records β related to convenience store and gas station supply chains
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: November 17, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π’ About the Company: General Distributing Co. operates in the convenience stores, gas stations, and liquor stores industry. The company is headquartered in Salt Lake City, Utah at 5350 W Amelia Earhart Drive, Salt Lake City, UT 84116, USA. 100β249 employees (approximately 168 employees) | Annual revenue: $25Mβ$50M
π¦ Total size of the leaked archive: 82.35 GB (based on provided data)
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Financial documents β including scanned checks and invoices
β’ Internal spreadsheets β operational logs and corporate data
β’ Client and partner information
β’ Employee databases and payroll information
β’ Corporate file structures and project plans
β’ Distribution and logistics records β related to convenience store and gas station supply chains
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Universidade Municipal de SΓ£o Caetano (USCS)
π Attacker's Claim Date: November 24, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: uscs.edu.br
π’ About the Company: Universidade Municipal de SΓ£o Caetano (USCS) is a prominent Brazilian municipal university headquartered in SΓ£o Caetano do Sul, SΓ£o Paulo State, Brazil. The institution offers a diverse range of educational programs including in-person and distance learning undergraduate degrees, technical courses, postgraduate studies (MBAs and doctorates), and non-degree courses for skill enhancement. USCS also provides community services such as free legal assistance, fiscal education, and health services. 501β1,000 employees | Headquarters: Rua Santo AntΓ΄nio, 50 β Centro, SΓ£o Caetano do Sul, SP, CEP 09521-160, Brazil
π¦ Total size of the leaked archive: 82.42 GB (based on provided data)
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Student records β personal identifiable information (names, addresses, identification numbers), academic histories, enrollment information, grades, transcripts, attendance logs, scholarship data
β’ Faculty and staff information β employment contracts, salary information, performance evaluations, personal identification documents
β’ Internal administrative documentation β student management platform data, curriculum planning documents, budgetary information, internal communications
β’ Program records β undergraduate, graduate, technical course, and distance learning program documentation
β’ Community service records β legal assistance, fiscal education, and health services documentation
β’ Research project materials β potential exposure of intellectual property and collaborative research data
β’ Financial and payment documentation β billing records, financial aid information, payment histories
π§Ύ NOTE:
β’ Infostealer Activity Detected (by HudsonRock):
β’ Compromised Employees: 2
β’ Compromised Users: 413
β’ Third-Party Employee Credentials: 32
β’ External Attack Surface: 80
β’ Cloud Services Detected: Microsoft 365 (MX record: uscs-edu-br.mail.protection.outlook.com)
University Risk Context: Universities hold concentrated datasets including identification details, academic histories, financial information, health documentation, research notes, and internal communications. The USCS breach threatens long-term harm to students, faculty, and staff through identity theft, targeted phishing, and potential extortion
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: November 24, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: uscs.edu.br
π’ About the Company: Universidade Municipal de SΓ£o Caetano (USCS) is a prominent Brazilian municipal university headquartered in SΓ£o Caetano do Sul, SΓ£o Paulo State, Brazil. The institution offers a diverse range of educational programs including in-person and distance learning undergraduate degrees, technical courses, postgraduate studies (MBAs and doctorates), and non-degree courses for skill enhancement. USCS also provides community services such as free legal assistance, fiscal education, and health services. 501β1,000 employees | Headquarters: Rua Santo AntΓ΄nio, 50 β Centro, SΓ£o Caetano do Sul, SP, CEP 09521-160, Brazil
π¦ Total size of the leaked archive: 82.42 GB (based on provided data)
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Student records β personal identifiable information (names, addresses, identification numbers), academic histories, enrollment information, grades, transcripts, attendance logs, scholarship data
β’ Faculty and staff information β employment contracts, salary information, performance evaluations, personal identification documents
β’ Internal administrative documentation β student management platform data, curriculum planning documents, budgetary information, internal communications
β’ Program records β undergraduate, graduate, technical course, and distance learning program documentation
β’ Community service records β legal assistance, fiscal education, and health services documentation
β’ Research project materials β potential exposure of intellectual property and collaborative research data
β’ Financial and payment documentation β billing records, financial aid information, payment histories
π§Ύ NOTE:
β’ Infostealer Activity Detected (by HudsonRock):
β’ Compromised Employees: 2
β’ Compromised Users: 413
β’ Third-Party Employee Credentials: 32
β’ External Attack Surface: 80
β’ Cloud Services Detected: Microsoft 365 (MX record: uscs-edu-br.mail.protection.outlook.com)
University Risk Context: Universities hold concentrated datasets including identification details, academic histories, financial information, health documentation, research notes, and internal communications. The USCS breach threatens long-term harm to students, faculty, and staff through identity theft, targeted phishing, and potential extortion
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: WR Comercial
π Attacker's Claim Date: November 24, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: wrcomercial.com.br
π’ About the Company: WR Comercial is a Brazilian staffing and workforce outsourcing company headquartered in SΓ£o Paulo, Brazil, specializing in providing skilled personnel for essential services such as security, cleaning, administrative support, and front desk operations. 11β50 employees | Headquarters: Rua Giancarlo Palanti 22B, Vila RΓ©, SΓ£o Paulo, CEP 03661-050, Brazil
π¦ Total size of the leaked archive: 14.84 GB
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Service contracts and agreements β with suppliers, clients, and logistics partners
β’ Financial records β invoices, payment histories, banking details, financial folders
β’ Personnel management files β "GestΓ£o de Pessoas" records, HR documentation, employee identification documents
β’ Internal administrative file structures β operational logs and corporate data
β’ Staffing and workforce records β employee personal data, payroll information
β’ Client and partner data β customer lists, contact information, transaction histories
β’ Email archives β internal communications, negotiations, project planning
π§Ύ NOTE:
DNS Records Detected:
β’ MX: mx1.hostinger.com, mx2.hostinger.com
TXT: v=spf1 include:_spf.mail.hostinger.com ~all
β’ Cloud / SaaS Services Detected: None (according to Ransomware.live)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: November 24, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: wrcomercial.com.br
π’ About the Company: WR Comercial is a Brazilian staffing and workforce outsourcing company headquartered in SΓ£o Paulo, Brazil, specializing in providing skilled personnel for essential services such as security, cleaning, administrative support, and front desk operations. 11β50 employees | Headquarters: Rua Giancarlo Palanti 22B, Vila RΓ©, SΓ£o Paulo, CEP 03661-050, Brazil
π¦ Total size of the leaked archive: 14.84 GB
π WHAT WAS LEAKED:
Based on Medusa's published evidence and security analysis :
β’ Service contracts and agreements β with suppliers, clients, and logistics partners
β’ Financial records β invoices, payment histories, banking details, financial folders
β’ Personnel management files β "GestΓ£o de Pessoas" records, HR documentation, employee identification documents
β’ Internal administrative file structures β operational logs and corporate data
β’ Staffing and workforce records β employee personal data, payroll information
β’ Client and partner data β customer lists, contact information, transaction histories
β’ Email archives β internal communications, negotiations, project planning
π§Ύ NOTE:
DNS Records Detected:
β’ MX: mx1.hostinger.com, mx2.hostinger.com
TXT: v=spf1 include:_spf.mail.hostinger.com ~all
β’ Cloud / SaaS Services Detected: None (according to Ransomware.live)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Thunder Bay Counselling
π Attacker's Claim Date: December 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: thunderbaycounselling.com
π’ About the Company: Thunder Bay Counselling is a mental health and counselling service provider based in Thunder Bay, Ontario, Canada. The organization offers professional counselling and psychotherapy services to individuals, couples, families, and workplaces, including mental health therapy, trauma support, stress management, and psychological assessments.
π¦ Total size of the leaked archive: 100.35 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Patient mental health records β therapy session notes, clinical assessments, intake forms, diagnostic information, treatment plans
β’ Personal identifiable information (PII) β full names, dates of birth, addresses, phone numbers, email addresses, emergency contacts
β’ Intake questionnaires and psychological assessments β sensitive personal histories, trauma records, abuse disclosures
β’ Administrative records β appointment schedules, billing information, insurance claims, internal communications
β’ Employee and therapist data β personal details of counsellors, administrative staff, and contractors
β’ Financial documentation β payment records, insurance billing, payroll information
β’ Internal organizational documents β policies, procedures, operational files
π§Ύ NOTE:
Regulatory Implications in Canada: Thunder Bay Counselling is subject to Canadian privacy laws including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Personal Health Information Protection Act (PHIPA).
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: December 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: thunderbaycounselling.com
π’ About the Company: Thunder Bay Counselling is a mental health and counselling service provider based in Thunder Bay, Ontario, Canada. The organization offers professional counselling and psychotherapy services to individuals, couples, families, and workplaces, including mental health therapy, trauma support, stress management, and psychological assessments.
π¦ Total size of the leaked archive: 100.35 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Patient mental health records β therapy session notes, clinical assessments, intake forms, diagnostic information, treatment plans
β’ Personal identifiable information (PII) β full names, dates of birth, addresses, phone numbers, email addresses, emergency contacts
β’ Intake questionnaires and psychological assessments β sensitive personal histories, trauma records, abuse disclosures
β’ Administrative records β appointment schedules, billing information, insurance claims, internal communications
β’ Employee and therapist data β personal details of counsellors, administrative staff, and contractors
β’ Financial documentation β payment records, insurance billing, payroll information
β’ Internal organizational documents β policies, procedures, operational files
π§Ύ NOTE:
Regulatory Implications in Canada: Thunder Bay Counselling is subject to Canadian privacy laws including the Personal Information Protection and Electronic Documents Act (PIPEDA) and Ontario's Personal Health Information Protection Act (PHIPA).
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: JBS Mental Health Authority
π Attacker's Claim Date: December 28, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: Not publicly disclosed (Domain queries to JBS servers are not detected)
π’ About the Company: Jefferson-Blount-St. Clair (JBS) Mental Health Authority is a regional, public, nonprofit corporation established under Act 310 of the 1967 Alabama Legislature. The authority serves Region M-5, comprising Jefferson, Blount, and St. Clair counties with over 800,000 residents. It operates three mental health centers, providing consultation, program development, coordination, and delivery of mental health services. 201-500 employees | Headquarters: 940 Montclair Rd., Birmingham, AL 35213, USA
π¦ Total size of the leaked archive: 67.02 GB (based on provided data; Medusa claims 168.6 GB)
π WHAT WAS LEAKED:
β’ Patient names β full names of individuals receiving mental health services
β’ Dates of birth β patient and employee date of birth information
β’ Social Security numbers β sensitive government identification numbers
β’ Medical information β diagnoses, treatment information, physician names, medical record numbers
β’ Prescription/medication information β details of prescribed medications
β’ Health insurance information β insurance provider details, policy numbers
β’ Medicare/Medicaid information β government healthcare program data
β’ Billing and claims information β payment records, insurance claims
β’ Employee personal data β current and former employee records (2011-2025)
π§Ύ NOTE:
β’ Number of Affected Individuals: 30,434 individuals (reported to HHS' Office for Civil Rights) .
β’ Reported to HHS: January 23, 2026 .
Legal Action:
β’ A class action investigation is being conducted by Lynch Carpenter, LLP regarding potential claims against JBS related to this data breach
β’ Regulatory Implications: As a HIPAA-covered entity, JBS faces potential fines from the U.S. Department of Health and Human Services Office for Civil Rights for failure to protect patient health information.
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: December 28, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: Not publicly disclosed (Domain queries to JBS servers are not detected)
π’ About the Company: Jefferson-Blount-St. Clair (JBS) Mental Health Authority is a regional, public, nonprofit corporation established under Act 310 of the 1967 Alabama Legislature. The authority serves Region M-5, comprising Jefferson, Blount, and St. Clair counties with over 800,000 residents. It operates three mental health centers, providing consultation, program development, coordination, and delivery of mental health services. 201-500 employees | Headquarters: 940 Montclair Rd., Birmingham, AL 35213, USA
π¦ Total size of the leaked archive: 67.02 GB (based on provided data; Medusa claims 168.6 GB)
π WHAT WAS LEAKED:
β’ Patient names β full names of individuals receiving mental health services
β’ Dates of birth β patient and employee date of birth information
β’ Social Security numbers β sensitive government identification numbers
β’ Medical information β diagnoses, treatment information, physician names, medical record numbers
β’ Prescription/medication information β details of prescribed medications
β’ Health insurance information β insurance provider details, policy numbers
β’ Medicare/Medicaid information β government healthcare program data
β’ Billing and claims information β payment records, insurance claims
β’ Employee personal data β current and former employee records (2011-2025)
π§Ύ NOTE:
β’ Number of Affected Individuals: 30,434 individuals (reported to HHS' Office for Civil Rights) .
β’ Reported to HHS: January 23, 2026 .
Legal Action:
β’ A class action investigation is being conducted by Lynch Carpenter, LLP regarding potential claims against JBS related to this data breach
β’ Regulatory Implications: As a HIPAA-covered entity, JBS faces potential fines from the U.S. Department of Health and Human Services Office for Civil Rights for failure to protect patient health information.
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Town of North Providence, Rhode Island
π Attacker's Claim Date: May 30, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: northprovidenceri.gov
π’ About the Company: Town of North Providence is a municipal government entity located at 2000 Smith Street, North Providence, Rhode Island, 02911, USA. The town provides municipal services to residents including online permitting, tax payment options, and community events. 40 employees | Headquarters: 2000 Smith Street, North Providence, Rhode Island, USA
π¦ Total size of the leaked archive: 88.84 GB (based on provided data; Medusa posted on May 30, 2025)
π WHAT WAS LEAKED:
β’ Personal Identifiable Information (PII) β names, dates of birth
β’ Contact information β addresses, phone numbers, email addresses
β’ Government identification numbers β potentially including Social Security numbers
β’ Municipal service records β permitting, tax payment, and community event data
β’ Internal government documents β administrative records and operational files
π§Ύ NOTE:
The breach affected a total of 1,840 individuals (including 1 Maine resident) .
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: May 30, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: northprovidenceri.gov
π’ About the Company: Town of North Providence is a municipal government entity located at 2000 Smith Street, North Providence, Rhode Island, 02911, USA. The town provides municipal services to residents including online permitting, tax payment options, and community events. 40 employees | Headquarters: 2000 Smith Street, North Providence, Rhode Island, USA
π¦ Total size of the leaked archive: 88.84 GB (based on provided data; Medusa posted on May 30, 2025)
π WHAT WAS LEAKED:
β’ Personal Identifiable Information (PII) β names, dates of birth
β’ Contact information β addresses, phone numbers, email addresses
β’ Government identification numbers β potentially including Social Security numbers
β’ Municipal service records β permitting, tax payment, and community event data
β’ Internal government documents β administrative records and operational files
π§Ύ NOTE:
The breach affected a total of 1,840 individuals (including 1 Maine resident) .
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Presort First Class
π Attacker's Claim Date: May 27, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: presortfirstclass.com
π’ About the Company: Presort First Class is a printing and mailing services company founded in 2008, headquartered in Oklahoma City, Oklahoma, USA. The company offers design, print, and mail services including presort mail, document imaging, statement printing, and digital printing. It is designated as a Detached Mail Unit (DMU) of the USPS, with an on-site postal service employee. 33 employees | Annual revenue: $20.5 million | Headquarters: 2621 SE 15th St, Oklahoma City, OK 73129, USA
π¦ Total size of the leaked archive: 88.84 GB (based on provided data; Medusa claims 279.30 GB)
π WHAT WAS LEAKED:
Based on Medusa's leak page and security analysis :
β’ Internal corporate documents β operational files and company data
β’ Client mailing and printing records β customer information, mailing lists
β’ Financial documentation β invoices, billing records, transaction data
β’ Employee personal information β staff records
β’ Business contracts and agreements β with clients and partners
β’ USPS compliance and DMU documentation
π§Ύ NOTE:
β’ DNS Records Detected :
MX: presortfirstclass-com.mail.eo.outlook.com
TXT: v=spf1 include:spf.protection.outlook.com include:spf.bbcsoftware.com include:spfa.cpmails.com -all
β’ Cloud / SaaS Services Detected: Microsoft 365 (based on MX record to Outlook protection)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: May 27, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: presortfirstclass.com
π’ About the Company: Presort First Class is a printing and mailing services company founded in 2008, headquartered in Oklahoma City, Oklahoma, USA. The company offers design, print, and mail services including presort mail, document imaging, statement printing, and digital printing. It is designated as a Detached Mail Unit (DMU) of the USPS, with an on-site postal service employee. 33 employees | Annual revenue: $20.5 million | Headquarters: 2621 SE 15th St, Oklahoma City, OK 73129, USA
π¦ Total size of the leaked archive: 88.84 GB (based on provided data; Medusa claims 279.30 GB)
π WHAT WAS LEAKED:
Based on Medusa's leak page and security analysis :
β’ Internal corporate documents β operational files and company data
β’ Client mailing and printing records β customer information, mailing lists
β’ Financial documentation β invoices, billing records, transaction data
β’ Employee personal information β staff records
β’ Business contracts and agreements β with clients and partners
β’ USPS compliance and DMU documentation
π§Ύ NOTE:
β’ DNS Records Detected :
MX: presortfirstclass-com.mail.eo.outlook.com
TXT: v=spf1 include:spf.protection.outlook.com include:spf.bbcsoftware.com include:spfa.cpmails.com -all
β’ Cloud / SaaS Services Detected: Microsoft 365 (based on MX record to Outlook protection)
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Baileys Inc.
π Attacker's Claim Date: May 27, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: baileysonline.com
π’ About the Company: Baileys Inc. is a retailer and wholesaler specializing in tools, clothing, and equipment for forestry professionals, arborists, landscapers, and property owners. Founded in 1975, the company is headquartered in Woodland, California. 25β30 employees | Annual revenue: $17.9M β $25M | Headquarters: 1210 Commerce Ave., Ste. 8d, Woodland, CA 95776, USA
π¦ Total size of the leaked archive: 20.72 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Internal corporate documents β operational files and company data
β’ Customer information β client records, shipping details
β’ Financial documentation β invoices, billing records
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attacker's Claim Date: May 27, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: baileysonline.com
π’ About the Company: Baileys Inc. is a retailer and wholesaler specializing in tools, clothing, and equipment for forestry professionals, arborists, landscapers, and property owners. Founded in 1975, the company is headquartered in Woodland, California. 25β30 employees | Annual revenue: $17.9M β $25M | Headquarters: 1210 Commerce Ave., Ste. 8d, Woodland, CA 95776, USA
π¦ Total size of the leaked archive: 20.72 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Internal corporate documents β operational files and company data
β’ Customer information β client records, shipping details
β’ Financial documentation β invoices, billing records
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: DSI Tech
π Attacker's Claim Date: May 14, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: dsitech.com
π’ About the Company: DSI Tech is a certified minority-owned technology company based in Ashburn, Virginia, USA. Operating since 1991, the company provides IT value-added reseller (VAR) services, hardware, software, and technology solutions to commercial and government clients .
π¦ Total size of the leaked archive: 338.29 GB (based on provided data; Medusa claims 399.10 GB)
π WHAT WAS LEAKED:
β’ Internal corporate documents β operational files, technical documentation, business records
β’ Client information β customer data, contracts, project specifications
β’ IT infrastructure documentation β system configurations, network architecture
β’ Financial records β billing information, transaction data
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈ Leak status: Published β 338.29 GB of data in open access on Medusa's Tor leak site (as of May 17, 2025)
π Attacker's Claim Date: May 14, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: dsitech.com
π’ About the Company: DSI Tech is a certified minority-owned technology company based in Ashburn, Virginia, USA. Operating since 1991, the company provides IT value-added reseller (VAR) services, hardware, software, and technology solutions to commercial and government clients .
π¦ Total size of the leaked archive: 338.29 GB (based on provided data; Medusa claims 399.10 GB)
π WHAT WAS LEAKED:
β’ Internal corporate documents β operational files, technical documentation, business records
β’ Client information β customer data, contracts, project specifications
β’ IT infrastructure documentation β system configurations, network architecture
β’ Financial records β billing information, transaction data
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈ Leak status: Published β 338.29 GB of data in open access on Medusa's Tor leak site (as of May 17, 2025)
π INCIDENT: DeVita & Associates, Inc.
π Attackerβs Claim Date: May 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: devitainc.com
π’ About the Company: DeVita & Associates, Inc. is a structural engineering firm founded in 1984, providing a full range of mechanical, electrical, and structural engineering services, including specialized structural precast design and detailing . 114 employees | Headquarters: 1150 E Washington St, Greenville, South Carolina, 29601, USA
π¦ Total size of the leaked archive: 560.59 GB (based on provided data; Medusa claims 618.40 GB )
π WHAT WAS LEAKED:
Based on Medusaβs leak page and security analysis :
β’ Engineering project data β structural designs, precast detailing, mechanical and electrical engineering documents
β’ Internal corporate documents β operational files, company records, business correspondence
β’ Client and project information β confidential client data, project specifications, contracts
β’ Financial documentation β billing records, invoices, financial statements
β’ Employee personal information β staff records, personal identifiable information
β’ Proprietary technical data β engineering drawings, CAD files, design specifications
π§Ύ NOTE:
β’ DNS Records Detected :
MX: devitainc-com.mail.protection.outlook.com
TXT: SPF record redirecting to devitainc.com.hosted.spf-report.com
TXT: Verification records for sophos, autodesk, wrike, and google-site-verification
β’ Cloud / SaaS Services Detected: Microsoft 365 (based on MX record to Outlook protection)
π§Ύ STATUS:
β οΈ Leak status: Published β 560.59 GB of data in open access on Medusaβs Tor leak site (as of May 14, 2025)
π Attackerβs Claim Date: May 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: devitainc.com
π’ About the Company: DeVita & Associates, Inc. is a structural engineering firm founded in 1984, providing a full range of mechanical, electrical, and structural engineering services, including specialized structural precast design and detailing . 114 employees | Headquarters: 1150 E Washington St, Greenville, South Carolina, 29601, USA
π¦ Total size of the leaked archive: 560.59 GB (based on provided data; Medusa claims 618.40 GB )
π WHAT WAS LEAKED:
Based on Medusaβs leak page and security analysis :
β’ Engineering project data β structural designs, precast detailing, mechanical and electrical engineering documents
β’ Internal corporate documents β operational files, company records, business correspondence
β’ Client and project information β confidential client data, project specifications, contracts
β’ Financial documentation β billing records, invoices, financial statements
β’ Employee personal information β staff records, personal identifiable information
β’ Proprietary technical data β engineering drawings, CAD files, design specifications
π§Ύ NOTE:
β’ DNS Records Detected :
MX: devitainc-com.mail.protection.outlook.com
TXT: SPF record redirecting to devitainc.com.hosted.spf-report.com
TXT: Verification records for sophos, autodesk, wrike, and google-site-verification
β’ Cloud / SaaS Services Detected: Microsoft 365 (based on MX record to Outlook protection)
π§Ύ STATUS:
β οΈ Leak status: Published β 560.59 GB of data in open access on Medusaβs Tor leak site (as of May 14, 2025)
π INCIDENT: Concord Academy
π Attackerβs Claim Date: November 28, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: concord-academy.org
π’ About the Company: Concord Academy is a specialized educational institution serving students with Autism, learning and intellectual disabilities, language processing disorders, ADD/ADHD, and other neurodiverse learning needs. 11β50 employees | Headquarters: 4942 Walnut Grove Road, Memphis, TN 38117, USA
π¦ Total size of the leaked archive: 27.42 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Student sensitive data β Personally Identifiable Information of students with special educational needs
β’ Educational records β individualized learning plans, academic assessments
β’ Student health information β medical diagnoses, treatment records, therapy documentation
β’ Internal administrative documents β operational files, policies, procedures
β’ Employee personal information β staff records, background checks
β’ Parent/guardian contact information β communication records
β’ Financial documentation β tuition billing, payment records, scholarship information
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attackerβs Claim Date: November 28, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: concord-academy.org
π’ About the Company: Concord Academy is a specialized educational institution serving students with Autism, learning and intellectual disabilities, language processing disorders, ADD/ADHD, and other neurodiverse learning needs. 11β50 employees | Headquarters: 4942 Walnut Grove Road, Memphis, TN 38117, USA
π¦ Total size of the leaked archive: 27.42 GB (based on provided data)
π WHAT WAS LEAKED:
β’ Student sensitive data β Personally Identifiable Information of students with special educational needs
β’ Educational records β individualized learning plans, academic assessments
β’ Student health information β medical diagnoses, treatment records, therapy documentation
β’ Internal administrative documents β operational files, policies, procedures
β’ Employee personal information β staff records, background checks
β’ Parent/guardian contact information β communication records
β’ Financial documentation β tuition billing, payment records, scholarship information
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: MFE Formwork Technology
π Attackerβs Claim Date: November 18, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: mfeformwork.com
π’ About the Company: MFE Formwork Technology is a global leader in aluminium formwork solutions headquartered in Port Klang, Selangor, Malaysia. The company designs and manufactures precision-engineered formwork systems enabling rapid construction cycles for high-rise and landed housing projects. Operating in over 50 countries, MFE provides 3D modeling, technical support, and customised solutions for complex structures. 51β200 employees | Headquarters: Lot 4 & 6 Jalan Tun Perak 3, Perdana Industrial Park, 42000 Port Klang, Selangor, Malaysia
π WHAT WAS LEAKED:
β’ Financial documents β including scanned checks and invoices
β’ Client and supplier information β contact details, purchase history
β’ Contracts and pricing details β commercial agreements, project proposals
β’ Project files and planning documents β operational logs, workflow documents
β’ Employee databases and payroll information β personnel records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π Attackerβs Claim Date: November 18, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: mfeformwork.com
π’ About the Company: MFE Formwork Technology is a global leader in aluminium formwork solutions headquartered in Port Klang, Selangor, Malaysia. The company designs and manufactures precision-engineered formwork systems enabling rapid construction cycles for high-rise and landed housing projects. Operating in over 50 countries, MFE provides 3D modeling, technical support, and customised solutions for complex structures. 51β200 employees | Headquarters: Lot 4 & 6 Jalan Tun Perak 3, Perdana Industrial Park, 42000 Port Klang, Selangor, Malaysia
π WHAT WAS LEAKED:
β’ Financial documents β including scanned checks and invoices
β’ Client and supplier information β contact details, purchase history
β’ Contracts and pricing details β commercial agreements, project proposals
β’ Project files and planning documents β operational logs, workflow documents
β’ Employee databases and payroll information β personnel records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π«
π INCIDENT: Shamrock Technologies
π Attackerβs Claim Date: December 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: shamrocktechnologies.com
π’ About the Company: Shamrock Technologies is a global provider of micronized polytetrafluoroethylene (PTFE) products, founded in 1941. The company also offers specialty micronized powders, dispersions, emulsions, and compounds including PTFE, polyethylene, polypropylene, fluoropolymers, custom wax alloys, natural waxes, and other specialty additives. 51β200 employees | Headquarters: Newark, New Jersey, USA
π¦ Total size of the leaked archive: 76.69 GB (based on provided data; publication on January 6, 2026)
π WHAT WAS LEAKED:
β’ Proprietary chemical formulations β PTFE product specifications, additive compositions, custom wax alloy formulas
β’ Intellectual property β proprietary manufacturing processes, product development data
β’ Customer and partner information β supply chain records, client lists, order histories
β’ Internal corporate documents β operational files, company records
β’ Financial documentation β invoices, billing records, transaction data
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π Attackerβs Claim Date: December 13, 2025 (Medusa group)
π¦ Attacker: Medusa ransomware group
π― Compromised Domain: shamrocktechnologies.com
π’ About the Company: Shamrock Technologies is a global provider of micronized polytetrafluoroethylene (PTFE) products, founded in 1941. The company also offers specialty micronized powders, dispersions, emulsions, and compounds including PTFE, polyethylene, polypropylene, fluoropolymers, custom wax alloys, natural waxes, and other specialty additives. 51β200 employees | Headquarters: Newark, New Jersey, USA
π¦ Total size of the leaked archive: 76.69 GB (based on provided data; publication on January 6, 2026)
π WHAT WAS LEAKED:
β’ Proprietary chemical formulations β PTFE product specifications, additive compositions, custom wax alloy formulas
β’ Intellectual property β proprietary manufacturing processes, product development data
β’ Customer and partner information β supply chain records, client lists, order histories
β’ Internal corporate documents β operational files, company records
β’ Financial documentation β invoices, billing records, transaction data
β’ Employee personal information β staff records
π§Ύ STATUS:
β οΈLeak status: Published β the attack has been confirmed
π INCIDENT: NUVITIA.COM
π Attacker's Claim Date: August 5, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: NUVITIA.COM
π’ About the Company: NudeVista is an adult search engine specializing in indexing adult photo and video galleries from various source sites. The company is owned by Tokyo Group Inc. Headquarters: Seychelles (Tenancy 10, Marina House, Eden Island, Mahe, Seychelles).
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 89.8 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Project files and software
β’ User credentials β at least 1,247 compromised logins and passwords (according to Hudson Rock)
β’ Login and registration page data (my.nudevista.com/login, my.nudevista.com/registration)
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. Data has not been published. There is currently no independent confirmation of the breach β information is based solely on statements from the hacker group.
π« Note: Given the policy of Japanese companies regarding ransomware attacks, Tokyo Group Inc. is unlikely to pay the ransom.
π Attacker's Claim Date: August 5, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: NUVITIA.COM
π’ About the Company: NudeVista is an adult search engine specializing in indexing adult photo and video galleries from various source sites. The company is owned by Tokyo Group Inc. Headquarters: Seychelles (Tenancy 10, Marina House, Eden Island, Mahe, Seychelles).
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 89.8 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Project files and software
β’ User credentials β at least 1,247 compromised logins and passwords (according to Hudson Rock)
β’ Login and registration page data (my.nudevista.com/login, my.nudevista.com/registration)
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. Data has not been published. There is currently no independent confirmation of the breach β information is based solely on statements from the hacker group.
π« Note: Given the policy of Japanese companies regarding ransomware attacks, Tokyo Group Inc. is unlikely to pay the ransom.
π INCIDENT: IPMSOLUTIONS.SK
π Attacker's Claim Date: August 11, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: IPMSOLUTIONS.SK
π’ About the Company: IPM Solutions s.r.o. is a Slovakian IT and engineering solutions provider founded in 2003, specializing in CAD, CAM, CAE, and PLM software . The company resells and supports products from PTC (Creo, Windchill) and Altair (HyperWorks), offering solutions for product development, manufacturing management, and IoT . The company has 11β50 employees, is headquartered in PreΕ‘ov, Slovakia, and has offices in Ε½ilina and Bratislava .
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 253 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ PDF files (engineering documentation, technical plans, schematics)
β’ CAD files (design projects, 3D models)
β’ Software files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The data has been published by the attackers . No official confirmation or statement from IPM Solutions regarding the breach has been found at this time.
π Attacker's Claim Date: August 11, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: IPMSOLUTIONS.SK
π’ About the Company: IPM Solutions s.r.o. is a Slovakian IT and engineering solutions provider founded in 2003, specializing in CAD, CAM, CAE, and PLM software . The company resells and supports products from PTC (Creo, Windchill) and Altair (HyperWorks), offering solutions for product development, manufacturing management, and IoT . The company has 11β50 employees, is headquartered in PreΕ‘ov, Slovakia, and has offices in Ε½ilina and Bratislava .
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 253 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ PDF files (engineering documentation, technical plans, schematics)
β’ CAD files (design projects, 3D models)
β’ Software files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The data has been published by the attackers . No official confirmation or statement from IPM Solutions regarding the breach has been found at this time.
π
Attackerβs Claim Date: August 12, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: ECCELLENT.COM
π’ About the Company: Eccellent Corp is a software and networking company specializing in Product Lifecycle Management (PLM) consulting and managed services for product development and manufacturing companies . Founded in 2006, the company serves industries ranging from Aerospace and Defense to Medical Devices. 11β20 employees | Headquarters: Glendora, New Jersey, USA (PO Box 188, Glendora, NJ)
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 241 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ DBF files (database files)
β’ CAD files (design projects, engineering documentation)
β’ Project files
β’ Software files
β’ Backups
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The attack was reported on August 12, 2026 . No official confirmation or statement from Eccellent Corp regarding the breach has been found at this time. The claim has not been independently verified.
π« Note: Eccellent Corpβs estimated annual revenue is between $1 million and $5 million , making the $5,000,000 ransom demand potentially significant relative to the companyβs size.
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: ECCELLENT.COM
π’ About the Company: Eccellent Corp is a software and networking company specializing in Product Lifecycle Management (PLM) consulting and managed services for product development and manufacturing companies . Founded in 2006, the company serves industries ranging from Aerospace and Defense to Medical Devices. 11β20 employees | Headquarters: Glendora, New Jersey, USA (PO Box 188, Glendora, NJ)
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 241 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ DBF files (database files)
β’ CAD files (design projects, engineering documentation)
β’ Project files
β’ Software files
β’ Backups
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The attack was reported on August 12, 2026 . No official confirmation or statement from Eccellent Corp regarding the breach has been found at this time. The claim has not been independently verified.
π« Note: Eccellent Corpβs estimated annual revenue is between $1 million and $5 million , making the $5,000,000 ransom demand potentially significant relative to the companyβs size.
π **INCIDENT: STNET.IT**
π Attacker's Claim Date: August 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: STNET.IT
π’ About the Company: STNet S.p.A. is an Italian system integration and IT services company based in Suisio, Bergamo, Italy. The company specializes in networking, software development, and IT solutions for businesses and public administration.
π° Ransom Demand: $5,000,000
π¦ Total Claimed Archive Size: 13.2 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The data has been published by the attackers according to their leak site. No official confirmation or statement from STNet S.p.A. regarding the breach has been found at this time. The claim has not been independently verified.
π« **Note:** STNet S.p.A. is an Italian company, not to be confused with STNet, Incorporated (a Japanese ISP that was affected by the KDDI breach in June-July 2026). The Cl0p group has been actively targeting software vulnerabilities to attack multiple companies simultaneously in a recent campaign.
π Attacker's Claim Date: August 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: STNET.IT
π’ About the Company: STNet S.p.A. is an Italian system integration and IT services company based in Suisio, Bergamo, Italy. The company specializes in networking, software development, and IT solutions for businesses and public administration.
π° Ransom Demand: $5,000,000
π¦ Total Claimed Archive Size: 13.2 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group. The data has been published by the attackers according to their leak site. No official confirmation or statement from STNet S.p.A. regarding the breach has been found at this time. The claim has not been independently verified.
π« **Note:** STNet S.p.A. is an Italian company, not to be confused with STNet, Incorporated (a Japanese ISP that was affected by the KDDI breach in June-July 2026). The Cl0p group has been actively targeting software vulnerabilities to attack multiple companies simultaneously in a recent campaign.
π INCIDENT: QCPL.IN
π Attacker's Claim Date: August 12, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: QCPL.IN
π’ About the Company: Quest Consultancy Pvt Ltd (QCPL) is an Indian IT services and consultancy company headquartered in Valsad, Gujarat, India. The company operates its own Autonomous System (AS58659) for internet routing and manages multiple IP ranges.
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 501 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group on August 12, 2026. The attack was part of a broader Cl0p campaign targeting nearly 50 companies worldwide, including Shell, Philips, and General Electric. No official confirmation or statement from Quest Consultancy Pvt Ltd regarding the breach has been found at this time.
π« Note: QCPL.IN has been listed on a ransomware leak site by the Cl0p group. Cl0p's recent campaign has been linked to vulnerabilities in PTC Windchill and FlexPLM software used in engineering and manufacturing processes. The claim has not been independently verified.
π Attacker's Claim Date: August 12, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: QCPL.IN
π’ About the Company: Quest Consultancy Pvt Ltd (QCPL) is an Indian IT services and consultancy company headquartered in Valsad, Gujarat, India. The company operates its own Autonomous System (AS58659) for internet routing and manages multiple IP ranges.
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 501 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group on August 12, 2026. The attack was part of a broader Cl0p campaign targeting nearly 50 companies worldwide, including Shell, Philips, and General Electric. No official confirmation or statement from Quest Consultancy Pvt Ltd regarding the breach has been found at this time.
π« Note: QCPL.IN has been listed on a ransomware leak site by the Cl0p group. Cl0p's recent campaign has been linked to vulnerabilities in PTC Windchill and FlexPLM software used in engineering and manufacturing processes. The claim has not been independently verified.
π INCIDENT: FLUIDLOGIC.COM
π Attackerβs Claim Date: August 12, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: FLUIDLOGIC.COM
π’ About the Company: FluidLogic Inc. is a U.S. technology firm specializing in advanced active hydration systems for high-performance environments . Founded in 2016 and headquartered in El Segundo, California, the company develops vehicle-mounted and tactical hydration solutions primarily serving motorsports (NASCAR, IndyCar) and military sectors . The company has approximately 40 employees and has raised $39.3M in funding . CEO is Sara Blackmer, a retired U.S. Air Force Lieutenant Colonel .
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 26.4 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
β’ CAD files (engineering designs, technical drawings, specifications)
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group on August 12, 2026 . The group stated: "The full leak will be published soon, unless a company representative contacts us via the channels provided" . No official confirmation or statement from FluidLogic Inc. regarding the breach has been found at this time. This attack is part of a broader Cl0p campaign targeting nearly 50 companies worldwide, including Shell, Philips, and General Electric .
π« Note: The compromised CAD files are particularly significant as FluidLogicβs products involve complex mechanical and electronic components requiring extensive engineering documentation . The company recently received funding from the U.S. Air Force and Department of Defense for military hydration systems development, potentially making the breached data of national security interest . The claim has not been independently verified.
π Attackerβs Claim Date: August 12, 2026 (Cl0p group)
π¦ Attacker: Cl0p ransomware group
π― Compromised Domain: FLUIDLOGIC.COM
π’ About the Company: FluidLogic Inc. is a U.S. technology firm specializing in advanced active hydration systems for high-performance environments . Founded in 2016 and headquartered in El Segundo, California, the company develops vehicle-mounted and tactical hydration solutions primarily serving motorsports (NASCAR, IndyCar) and military sectors . The company has approximately 40 employees and has raised $39.3M in funding . CEO is Sara Blackmer, a retired U.S. Air Force Lieutenant Colonel .
π° Ransom Demand: $5,000,000
π¦ Total claimed archive size: 26.4 GB
π WHAT WAS CLAIMED TO BE LEAKED:
β’ Database files
β’ Project files
β’ CAD files (engineering designs, technical drawings, specifications)
π§Ύ STATUS:
β οΈ Claim made by Cl0p ransomware group on August 12, 2026 . The group stated: "The full leak will be published soon, unless a company representative contacts us via the channels provided" . No official confirmation or statement from FluidLogic Inc. regarding the breach has been found at this time. This attack is part of a broader Cl0p campaign targeting nearly 50 companies worldwide, including Shell, Philips, and General Electric .
π« Note: The compromised CAD files are particularly significant as FluidLogicβs products involve complex mechanical and electronic components requiring extensive engineering documentation . The company recently received funding from the U.S. Air Force and Department of Defense for military hydration systems development, potentially making the breached data of national security interest . The claim has not been independently verified.