# Onmion LLC — One IT Provider, Three Breached Companies, 3,000+ Victims
**Subject:** Onmion LLC (Mukilteo, WA) — Managed IT Provider
**Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB
—
## Who Is Onmion LLC?
**Onmion LLC** — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — **onmion.com**
A managed IT and software services provider that markets itself as “empowering businesses with cutting-edge software technology.” In practice, Onmion LLC stored all of its clients’ most sensitive data — Social Security Numbers, banking records, healthcare credentials, tax filings — on shared, unencrypted infrastructure with no segmentation between client environments.
Through Onmion’s FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.**
*Screenshot 1 — onmion.com — “Empowering businesses with cutting-edge software technology”*
—
## Three Clients, One Point of Failure
*Screenshot 2 — All three client datasets on the same shared FTP infrastructure*
| # | Client | Website | Location | Data | Individuals |
|—|——–|———|———-|——|————-|
| 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members |
| 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs |
| 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs |
—
## Onmion’s Failures
*Screenshot 3 — N-Central RMM backup archives from Onmion’s management server*
*Screenshot 4 — Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted*
*Screenshot 5 — Summary of Onmion’s security failures*
1. **No segmentation** — all clients on shared FTP with no access controls
2. **N-Central RMM exposed** — 44 daily backups (45 GB) with device inventories and remote access credentials
3. **Plaintext passwords** — production databases storing user credentials in cleartext
4. **Healthcare credentials in Word docs** — 25+ login pairs for major US insurers unencrypted
5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files
6. **Refused to respond** when notified — no action, no client notification
—
# CLIENT 1 — Lake Connor Park
**lcpmembers.com** — Tulalip, WA — Gated residential/RV community — 500+ members — **178.8 GB exfiltrated**
| Category | Details |
|———-|———|
| SQL Databases | 92+ GB — member records, POS transactions, user credentials |
| N-Central RMM | 45 GB — 44 daily backups of IT management server |
| Gate Access Logs | 700+ daily logs — 363+ members with names, cards, timestamps |
| Member Database | 500+ records with full PII, passwords in plaintext |
| Healthcare Creds | 25+ pairs — AETNA, UHC, Humana, Cigna, others |
| Source Code | 99 VB.NET files — POS, QuickBooks integration |
| System Backups | 656 DAR archives (4.8 GB), Jan–Sep 2026 |
*Screenshot 6 — 178.8 GB data archive*
*Screenshot 7 — MAAS member database: 500+ individual PII records*
*Screenshot 8 — Daily gate logs: names, card numbers, timestamps*
*Screenshot 9 — Healthcare credentials in plaintext*
*Screenshot 10 — SQL Server database backups (92+ GB)*
*Screenshot 11 — User passwords stored in cleartext in production DB*
*Screenshot 12 — 44 daily N-Central RMM backups*
—
# CLIENT 2 — Port Susan Camping Club
**portsusan.com** — Stanwood, WA — Tribal nonprofit (Tulalip Tribes) — 2,490 sites — $7.4M revenue — **400+ SSNs exposed**
| Category | Details |
|———-|———|
| Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings |
| Employee PII | 219 individuals (91 active + 128 terminated) — full SSN |
| W-2 Forms | 2020-2025 — SSN for every employee |
| Vendor W-9s | 202 forms — EIN/SSN for all vendors |
| Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations |
| HR Investigations | 10 named cases — harassment, misconduct, legal |
| IRS/Tax | 990T, 1099, PPP/SBA loan records |
| IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps |
*Screenshot 13 — Three data drives: Finance (K), HR (T), Departments (V)*
*Screenshot 14 — 20+ years of financial records*
*Screenshot 15 — 91 active employee personnel files*
*Screenshot 16 — W-2 forms (2020-2025) with employee SSNs*
*Screenshot 17 — 7 Heritage Bank accounts with full account numbers*
*Screenshot 18 — 202 vendor W-9 forms with EIN/SSN*
*Screenshot 19 — 10 confidential HR investigation files*
—
# CLIENT 3 — CarneVita / Cured by Visconti
**curedbyvisconti.com** — 1501 N Miller St, Wenatchee, WA — Food production — **26+ SSNs** — $3.4-4.8M revenue
Three entities compromised through a single shared backup:
| Entity | EIN | QuickBooks |
|——–|—–|————|
| CarneVita, LLC | 33-3284096 | 64 MB (active) |
| Cured by Visconti, LLC | 85-0659112 | 201 MB (active) |
| 3 Boots Ranch & Custom Cuts | — | 13 MB (active) |
| Category | Details |
|———-|———|
| QuickBooks Files | 278 MB+ — complete financials for all 3 entities |
| IRS W-2 Forms | 26 employees — full SSN, names, wages |
| IRS 941/940/W-3 | Quarterly + annual federal tax returns |
| Transactions | 2,018 documents — invoices, POs, receipts |
| Backups | 70+ automated QBW backups (Feb 2025 — Apr 2026) |
| Investment | Fidelity account statements |
*Screenshot 20 — W-2 forms with employee SSNs*
*Screenshot 21 — Form 941 CarneVita: 15 employees, $176K quarterly wages*
*Screenshot 22 — Form 941 Cured by Visconti: 11 employees*
*Screenshot 23 — QuickBooks files for all three entities*
*Screenshot 24 — 2,018 transaction documents*
*Screenshot 25 — PII summary across all three entities*
—
## Combined Impact
| Metric | Total |
|——–|——-|
| Organizations compromised | 3 |
| Data exfiltrated | 179+ GB |
| Individuals with PII exposed | 3,000+ |
| Social Security Numbers | 426+ |
| Bank accounts exposed | 10+ |
| Healthcare credentials | 25+ portal logins |
| Financial history | 20+ years |
| IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 |
| Member/client sites | 2,990+ |
—
## What Affected Organizations Should Do
1. **Terminate Onmion LLC** — they knew and chose silence
2. **Engage independent cybersecurity counsel**
3. **Begin breach notification** per WA State RCW 19.255.010
4. **Notify banks** — Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita)
5. **Report to WA Attorney General** and relevant authorities
6. **Offer credit monitoring** to all individuals with exposed SSNs
**All data will be published in full if Onmion LLC continues to refuse engagement.**
—
*Onmion LLC — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — onmion.com*
*Lake Connor Park — lcpmembers.com | Port Susan Camping Club — portsusan.com | CarneVita — curedbyvisconti.com*
- Group: inc ransom
- Discovered: 2026-11-10 22:33 UTC
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-11-10