# ZIRNET LLC — Managed Service Provider — FULL BREACH
**Published:** October 2026
**Sector:** Information Technology / Managed Services (MSP)
**Location:** Port Washington, New York, USA
**Website:** zirnet.com
—
## Summary
ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida.
We have obtained **complete access** to ZIRNET’s internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals.
**Total data: 2,260,963 files across ZIRNET and 12 client server backups.**
—
## Affected Organizations
ZIRNET’s negligent security practices have resulted in the exposure of the following companies’ complete IT environments:
| # | Company | Industry | Location | Files |
|—|———|———-|———-|——-|
| 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 |
| 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 |
| 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 |
| 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 |
| 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 |
| 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 |
| 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 |
| 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 |
| 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 |
| 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 |
| 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 |
| 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 |
**Additional organizations with exposed credentials and data:**
– Skylatus Property Capital LLC (Real Estate)
– ClearScope (myclearscope.com)
– Midtown Operating Corp
– Credit and Debt Management Institute (Bolivar, TN)
– La Perla Construction & Design
– LIVOTIS Old World Market
– St. Albans Congregational Church (Queens, NY)
– Creative Mobile Technologies (CMT)
– North Side Transmission
– NY Flooring Inc
– Metropolitan Association of the NY Conference
—
## What Was Obtained
### 1. ZIRNET Internal Data (2,743 files)
– **QuickBooks databases** — Zirnet.QBW (163 MB) and 2025.QBW (155 MB) — complete financial records
– **Bank statements** — TD Bank, American Express, Bank of America — 36 PDF statements covering 2024-2026
– **Email archive** — 3.27 GB of PST files (Outlook) containing all business correspondence
– **IRS documents** — W-9, estimated tax payments, certified copies
– **Client proposals and contracts** — service agreements with all clients
### 2. Complete Credential Database (100+ accounts)
For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained:
– **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords
– **Industrial Solutions (ISNY):** 39 email accounts with passwords
– **ClearScope:** 8 Microsoft 365 accounts with passwords
– **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials
– **St. Albans Church:** 18 email accounts + Azure tenant secret key
– **LIVOTIS:** 3 accounts + VoIP portal access
– **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness)
### 3. Hidden Backdoor Account on ALL Client Machines
ZIRNET created a **hidden administrator account** on every managed workstation and server:
“`
Username: NetworkAccess
Password: [REDACTED]
“`
This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** — a single credential compromise gives access to every machine ZIRNET manages.
### 4. Credit Card Numbers (with CVV)
Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes.
### 5. Personal Identifiable Information (PII)
– **Social Security Numbers** — Employee SSN scans from Dynotec, ASK Construction
– **Birth certificates** — AlphaOne USA (family members)
– **W-2 forms / Tax returns** — Multiple years (2021-2025) for AlphaOne USA employees
– **Employee I-9 forms and drivers licenses** — AlphaOne USA
– **Medical records** — Owner’s colonoscopy, CT scan, and family medical documents
– **Credit reports** — Owner’s personal credit history (2005-2015)
– **Payroll data** — Complete W-2/W-3 packages for multiple years across organizations
### 6. Network Infrastructure
– **Juniper SRX firewall configuration** (Midtown Operating) — root passwords, VPN pre-shared keys, full NAT rules, internal network topology
– **Meraki MX67 firewall credentials** (Skylatus) — admin password, WiFi PSKs, external IP
– **N-Central RMM admin credentials** — ZIRNET’s remote management console controlling all endpoints
– **Azure tenant secrets** — tenant IDs, client secrets for M365 migrations
### 7. Full Server Backups (12 clients)
Complete drive images from 12 client servers including:
– All user documents, profiles, and application data
– Accounting records (invoices, payroll, tax documents)
– Private folders with personal files
– Browser profiles with saved credentials
– Construction project files, contracts, permits
– HR files, employee records, compliance documents
—
## Evidence
**See attached screenshots:**
1. `01_clients_list.png` — Full client listing with file counts
2. `02_credentials.png` — Sample of extracted credentials (partially redacted)
3. `03_financial.png` — ZIRNET financial data and bank accounts
4. `04_pii_sensitive.png` — PII and sensitive document inventory
5. `05_infrastructure.png` — Network backdoors and firewall configurations
—
## Impact Assessment
This breach affects:
– **13+ organizations** across New York, New Jersey, Florida, and Tennessee
– **500+ individuals** (employees, contractors, clients of affected companies)
– **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data)
ZIRNET’s security practices represent gross negligence:
1. **Storing all client passwords in plaintext text files**
2. **Using a single hidden backdoor account across all clients**
3. **No encryption on sensitive data storage**
4. **Storing credit card numbers with CVV in plain text**
5. **Mixing personal medical/financial records with business data**
—
## Contact
ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published.
Countdown: **7 DAYS**
After the deadline:
– All credentials will be published unredacted
– All PII including SSNs will be published
– All financial records will be published
– Each affected company will be notified individually
– Data will be made available for free download
**ZIRNET:** You know how to reach us. The clock is ticking.
—
*This post will be updated as more data is analyzed. Additional client data may be published as proof of access.*
- Group: inc ransom
- Discovered: 2026-11-10 22:33 UTC
This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.
Source: RansomLook — Recent Posts · 2026-11-10