Tag: inc ransom

# ROANE TRANSPORTATION SERVICES, INC.
## Rockwood, Tennessee | DOT# 652055 | roanetrans.com

—

### YOUR COMPANY HAS BEEN COMPROMISED

We have obtained complete access to your internal file systems and extracted a full copy of your corporate data. This includes all divisions: **Roane Transportation Services (RTS)**, **Roane Logistics (RLI)**, **Roane Metal Group (RMG)**, **Roane Specialized**, and **B&W**.

This is not a bluff. Below is a summary of what we hold.

—

### DATA IN OUR POSSESSION

**EMPLOYEE PERSONAL DATA**
– 262 employee files containing Social Security Number scans (PDF), driver’s licenses (CDL), DOT medical examination cards, drug screening results, I-9 employment verification forms, background check reports (PSP/MVR), tax withholding forms, and direct deposit authorizations
– Complete payroll records with full names, bank routing numbers, and account numbers for all current employees across RTS and RLI divisions

**FINANCIAL & BANKING**
– ACH payment files containing 351 bank account numbers (routing + account) for employees, contractors, and carrier partners
– First Horizon Bank online banking credentials
– State tax portal login credentials for 20+ US states (TN, KY, GA, OH, PA, VA, NC, IN, AL, MS, LA, MO, WV, NM, NE, OR, SC, IL, NY, AR)
– QuickBooks financial data
– Payroll ACH batch files with individual salary amounts
– Settlement payment records for 112 carrier/vendor relationships
– Insurance loss reports spanning 2008 through 2025
– Positive Pay check verification data

**CREDENTIALS & ACCESS**
– 200+ plaintext username/password combinations exported from employee browsers, covering Microsoft 365, banking portals, fleet management (Samsara, OmniTracs), customer billing portals, insurance providers, government tax systems, and personal accounts
– Customer portal credentials for 39 business partners including Nucor, Ryder, Cleveland Cliffs, US Bank, Valmont, SiteOne, Megacorp, Hubbell, CMC, Builders FirstSource, and others
– Your Carbon Black security product license information
– Acronis backup system license keys
– CheckPoint VPN configuration data

**DOT / FMCSA COMPLIANCE**
– DOT audit files
– Drug and alcohol testing results for all drivers
– DOT medical examination certificates
– FMCSA inspection and violation records
– Accident and incident reports spanning multiple years
– CSA score documentation

**BUSINESS INTELLIGENCE**
– 949-entry contact database (drivers, customers, vendors, suppliers)
– Customer contracts and rate agreements
– IFTA fuel tax reports (all states, 2021–2025)
– Complete fleet and driver assignment records
– Internal HR files for current and terminated employees
– Workers’ compensation claim records

—

### WHAT THIS MEANS FOR YOU

If this data becomes public:

1. **Mandatory breach notification in all 50 US states** for SSN and financial data exposure — estimated cost: $500,000 – $1,000,000 in notification, credit monitoring, and legal fees alone

2. **FMCSA regulatory action** — exposure of drug test results and DOT medical records creates grounds for federal compliance investigation. Potential suspension or revocation of operating authority under 49 CFR Part 382

3. **Employee lawsuits** — 262 individuals with exposed Social Security Numbers and bank accounts will have grounds for identity theft class action litigation. Average settlement: $5,000 – $50,000 per affected person

4. **Customer relationship damage** — 39 business partners whose portal credentials were stored in plaintext will be notified. Nucor, Cleveland Cliffs, Ryder, US Bank, and others will terminate carrier agreements and pursue damages

5. **Financial fraud exposure** — bank routing numbers, account numbers, and online banking passwords enable direct financial theft. Every employee and carrier partner will need to change bank accounts immediately

6. **Tax fraud liability** — login credentials for 20+ state tax portals enable fraudulent filings. State revenue departments will freeze accounts pending investigation

7. **Total estimated exposure: $5,000,000 – $15,000,000** in regulatory fines, legal costs, settlements, lost business, and remediation

—

### PROOF OF DATA

We will provide a sample data package upon request in this chat to verify authenticity. This may include:
– Partial employee SSN document samples (redacted)
– ACH file headers showing bank routing information
– Portal credential samples
– Payroll records with employee names and amounts

—

### OUR TERMS

We are prepared to:
– Permanently delete all copies of your data
– Provide proof of deletion
– Never disclose or publish any information
– Provide a full list of accessed systems for your security remediation

**In exchange, we require a one-time payment. The amount will be discussed in this chat.**

—

### DEADLINE

You have **168 hours (7 days)** from the moment this message was posted to initiate contact and begin negotiations.

**After the deadline:**
– Phase 1: Data samples will be sent directly to your customers (Nucor, Ryder, Cleveland Cliffs, US Bank, SiteOne)
– Phase 2: Full dataset published on our public blog
– Phase 3: FMCSA, state attorneys general, and IRS notified with supporting evidence

**The timer is running.**

—

*To begin the conversation, type your message below. All communications are encrypted and confidential. We respond within 2 hours during business days.*

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# Kolin Construction

**Kolin Construction** (*Kolin İnşaat Turizm Sanayi ve Ticaret A.Ş.*) is one of Turkey’s major construction and industrial companies. Founded in **1977** and headquartered in **Ankara, Turkey**, the company serves as a flagship business of **Koloğlu Holding**.

## Business Activities

Kolin Construction operates primarily in large-scale construction, infrastructure, and engineering projects. Its areas of expertise include:

* Highways and road infrastructure
* Bridges and viaducts
* Tunnels
* Railways and metro systems
* Airports
* Ports and marine infrastructure
* Dams and hydroelectric power plants
* Energy infrastructure
* Industrial and mining projects

The company has participated in numerous major infrastructure developments in Turkey and abroad and has regularly appeared in international contractor rankings published by **Engineering News-Record (ENR)**.

## Major Projects

Kolin Construction has been involved in several large-scale and strategically important projects. One of its most notable developments is its participation in the construction of **Istanbul Airport**, one of the largest aviation infrastructure projects in the world.

Beyond transportation infrastructure, the company is active in projects involving power generation, water infrastructure, ports, industrial facilities, and other complex engineering works.

## Other Business Sectors

Through its broader corporate group, Kolin is also involved in several industries outside traditional construction, including:

* Energy and power generation
* Mining
* Port operations
* Shipyards and maritime services
* Tourism
* Trade and commercial activities

## International Presence

Kolin Construction maintains an international presence and has undertaken projects across **Europe, Asia, the Middle East, and Africa**.

Its international operations have included countries such as:

* Azerbaijan
* Libya
* Uganda
* Poland
* Romania
* Oman
* Saudi Arabia
* Kuwait

The company has established representative offices and project operations in several of these markets to support its international engineering and construction activities.

## Company Scale

Kolin Construction is considered one of the prominent Turkish contractors operating internationally. Its annual turnover has been reported in the range of approximately **USD 1.5–2 billion**, reflecting the scale of its infrastructure, energy, and industrial projects.

## Summary

With several decades of experience, Kolin Construction has developed capabilities in managing complex, large-scale infrastructure and engineering projects. Its portfolio covers transportation, energy, industrial construction, and public infrastructure, with operations extending from Turkey to multiple international markets.

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

notagroep.nl

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# MILLIMED CO., LTD. (มิลลิเมด) — DATA BREACH DISCLOSURE

**Date Added:** 2026-09-17
**Last Updated:** 2026-09-17
**Country:** Thailand 🇹🇭
**Industry:** Pharmaceutical Manufacturing & Distribution
**Website:** millimedthailand.com
**Revenue:** ~$70-85M USD (2.5-3.0 billion THB, group annual revenue)
**Data Volume:** **~3 TB** (databases, production records, email archives, factory documents, financial data)

—

## Overview

Millimed Co., Ltd. (บริษัท มิลลิเมด จำกัด) is a major Thai pharmaceutical manufacturer headquartered in Bangkok with GMP-certified production facilities in **Samut Prakan** and **Chiang Rai** provinces. The Millimed Group operates through **25+ subsidiary companies** spanning pharmaceutical manufacturing, consumer healthcare brands, supplements, real estate, agriculture, and hospitality.

Their consumer brand **i-HERB**, endorsed by Thai celebrity **Mario Maurer**, is one of the most recognized herbal healthcare brands in Thailand. The company holds **multiple Thai FDA quality awards** and manufactures prescription drugs, OTC products, sterile eye drops (BFS technology), and dietary supplements distributed nationwide through hospitals and pharmacies.

The group’s crown jewel subsidiary — **Millimed BFS** — reported **1,423 million THB revenue** and **593 million THB net profit** in 2025, with a staggering **41.7% net margin** and **65% year-over-year growth**. The parent company holds **942 million THB in retained earnings** — they can afford to resolve this.

Millimed’s management chose to ignore our communications and failed to protect their data. As a result, we are publishing details of the breach.

—

## What We Have — Over 3 Terabytes

We have obtained **complete access** to the Millimed Group’s entire IT infrastructure across **both factory locations and the Bangkok headquarters**. This includes production servers, file servers, NAS systems, ERP databases, email archives, and factory department shares. The total data volume exceeds **3 terabytes**.

### 💊 Pharmaceutical Manufacturing Data (CRITICAL)
– **Batch Manufacturing Records (BMR)** for **ALL pharmaceutical products** — the legal backbone of every drug they produce. We hold BMR distribution records from 2016 through August 2026, covering 18+ active product lines including i-HERB, Neoca, Denta Dente, Haelex, Leluxi, Amogin, and more
– **Quality Control & Calibration databases** — testing results, equipment calibration records, deviation reports
– **Drug Registration & Regulatory Affairs (RA)** data — complete product formulations for Amogin (4 variants), Chlovas, Caltab, BFS eye drops, Lidocaine HCl, Hilazin, Nicardipine, Cystaline-200, Nuosic, and more. **Master Formula documents** included
– **Bioequivalence Studies** (Bio Equalise subsidiary) — complete BE study reports, LC-MS/MS chromatography data, OECD compliance documents, and the contract with Chiang Mai University Faculty of Pharmacy
– **R&D Department** — pilot batch data, stability studies, cleaning validation, pharmaceutical excipient references (USP 38, BP 2013)
– **14 types of GMP audit records** — Thai FDA, Halal, GSDP, GPP, ISO 9001/14001/17025, Pfizer audit, TAISHO audit, iNova audit (including **CAR/PAR corrective action records**)
– **i-HERB brand complete IP** — all formulations, BMR, SOP, COA, specifications, cosmetic registrations, and production data for the Mario Maurer-endorsed brand

### 💰 Complete Financial Records (25+ Companies)
– **Audited financial statements** (งบการเงิน) for fiscal years **2024, 2025, and 2026** for all major subsidiaries:
– Millimed Co., Ltd. — 876M THB revenue, 54M THB net profit
– **Millimed BFS — 1,423M THB revenue, 593M THB net profit (41.7% margin!)**
– Pros Pharma, MLM Healthcare, Neoca Healthcare, Bio Equalise, i-Herb Innovation, Siriphanwa
– **K-Bank and EXIM Bank credit facility summaries** — full loan structures, credit lines, and covenant details
– **Monthly sales reports** (January 2025 — **August 2026**) — complete OTC and prescription drug revenue by product, region, sales channel, and individual sales unit
– **Oracle ERP database** — every financial transaction across the group. We also have the **Oracle ERP login credentials** (MMNEW/MMNEW@millimed.world)
– **Accounting databases** for **all 25+ entities** — complete general ledger, trial balances, tax reconciliation, intercompany transactions
– **28 entity accounting folders** with full Chart of Accounts, audit records, tax preparation documents

### 👤 Employee & HR Data (1,000+ People)
– **HRM8 database** — complete employee records: names, national ID numbers (เลขบัตรประชาชน), salaries, benefits, performance reviews
– **Organization charts** for all 7 production departments (PD1-PD7) with employee names
– **Payroll data** for all subsidiaries across three locations
– **FingerScan biometric data** backups
– **Personal data** of 1,000+ employees across Bangkok, Samut Prakan, and Chiang Rai

### 📧 Email Archives (30+ GB)
– **IT Administrator email archives** (15+ PST files) including:
– Network configuration and infrastructure credentials
– NAS Synology management alerts (neoca-office.synology.me, millimed-office.synology.me)
– Microsoft 365 administration
– VPN configuration and access management
– Vendor communications and support tickets
– Backup system notifications

### 🔑 60+ Credentials & Network Access
– **Thai Revenue Department (กรมสรรพากร)** login credentials for **ALL 25+ companies** — tax portal access for every entity in the group
– **BOI (Board of Investment)** portal credentials — 5 companies with tax incentive access
– **Department of Business Development (กรมพัฒนาธุรกิจการค้า)** — 5 corporate filing portal credentials
– **Dual VPN access** — WatchGuard Firebox at Ram Intra HQ (210.86.174.42) + **OpenVPN with full certificate chain and private key** for Neoca office (210.86.171.29)
– **Oracle ERP credentials** — MMNEW/MMNEW@millimed.world (production system)
– **SQL Server logins** including sysadmin (sa), mkuser, DB_ECM, dev_01-03
– **Microsoft 365 tenant** (millimedthailand.com) — cloud email and collaboration
– **Active Directory** — domain controller at 192.168.1.2

### 🏭 Complete Factory Infrastructure
– **233+ department folders** from the factory file server — every production, quality, regulatory, and administrative department
– **22 CCTV cameras + 1 access control** — complete Hikvision surveillance network with IP addresses and serial numbers covering BFS sterile area, laboratories, warehouses, food production, and all manufacturing floors
– **31 internal network subnets** (192.168.69.0/24 through 192.168.100.0/24) — full factory network topology
– **5 internal servers identified** — AD domain controller, 2x Orion NAS, barcode server, Chiang Rai center NAS
– **VMware vSphere** virtualization infrastructure, **CheckMK** monitoring, **Hikvision iVMS-4200** CCTV management

### 🏭 Sales & Operations
– **SALES & SALESAPP databases** (12+ GB) — complete sales history, pricing, customer relationships from 2022-2026
– **Monthly sales performance presentations** (January 2025 — August 2026) — OTC + prescription by area, product, channel
– **Marketing database** — campaigns, customer targeting, product focus data
– **Stock management** — inventory across all facilities
– **Forecast data** — business projections and planning
– **Transport & logistics** — GPS tracking, delivery records, government pharmaceutical organization reports

—

## Regulatory Impact

Millimed should be aware of the following consequences of this data becoming public:

1. **Thai FDA (อย.) Manufacturing License** — We hold the **actual BMR documents, QA audit records, and 14 types of regulatory audit documentation** including corrections (CAR/PAR). This is not just database records — these are the physical production documents that underpin every drug Millimed manufactures. Release triggers **immediate FDA review and potential suspension of manufacturing licenses**. The FDA Quality Award for 3 consecutive years ends here.

2. **PDPA Violation (พ.ร.บ.คุ้มครองข้อมูลส่วนบุคคล)** — Personal data of **over 1,000 employees** including national ID numbers, salaries, biometric data, and home addresses has been compromised. The PDPA Office can impose fines up to **5 million THB per violation** and criminal penalties including imprisonment.

3. **Revenue Department Exposure** — We hold active login credentials for **ALL 25+ company tax portals** plus the complete intercompany financial structure across the group. The multi-entity accounting data, transfer pricing arrangements, and BOI tax incentive records will be of great interest to Thai tax authorities.

4. **Drug Formulation Theft** — Complete drug formulations including **Master Formula documents**, bioequivalence study data, R&D results, and regulatory submissions for the entire product portfolio. Competitors gain **decades of R&D investment** in seconds. The i-HERB brand formulas, Neoca supplement compositions, BFS sterile manufacturing specifications, and all proprietary pharmaceutical formulations are fully exposed.

5. **Bioequivalence Study Exposure** — Bio Equalise subsidiary’s complete BE studies, including the **contract with Chiang Mai University**, LC-MS/MS analytical data, and OECD-compliant study reports. Competitors can use this data to bypass their own bioequivalence testing requirements.

6. **Banking & Credit Exposure** — K-Bank and EXIM Bank credit facility details, loan covenants, and the true financial health of each subsidiary will be publicly available, potentially triggering credit reviews, covenant violations, or credit rating downgrades.

7. **Physical Security Compromise** — The complete **CCTV surveillance network** (22 cameras + access control) with IP addresses and serial numbers, factory network topology, and building plans are exposed. Combined with VPN access credentials, this represents a total physical and digital security failure.

—

## Message to Millimed Management

Chairman **Thongplew Siripornpithak** (ทองเปลว ศิริพรพิทักษ์) and the board of directors had an opportunity to resolve this matter privately. That window is closing.

The data we hold represents the **complete digital footprint** of your 25+ company pharmaceutical empire — **over 3 terabytes** spanning both factory locations, the Bangkok headquarters, and all subsidiary operations. From drug manufacturing records to tax filings, from employee national IDs to bank loan structures, from factory CCTV configurations to Oracle ERP credentials.

Your **Millimed BFS** subsidiary generated **593 million THB in net profit** last year with a 41.7% margin. Your parent company holds **942 million THB in retained earnings**. You can afford to resolve this.

Your **i-HERB brand**, endorsed by Mario Maurer and sold across Thailand, depends on consumer trust. Your **FDA manufacturing licenses** depend on the integrity of your BMR and QA data. Your relationships with **K-Bank and EXIM Bank** depend on financial confidentiality. Your **ISO and Halal certifications** depend on audit documentation security.

**All of this — 3 terabytes of it — is now in our hands.**

We strongly recommend Millimed’s management reconsider their position and contact us immediately to resolve this situation before the full dataset is published.

**Screenshots below demonstrate the scope and authenticity of the breach:**

*(See attached: 26 evidence screenshots)*

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# HONG BAO GROUP — DATA BREACH

**Hong Bao Group** (หงเปา กรุ๊ป) — a major Thai restaurant conglomerate operating 15+ restaurant brands across Bangkok, including **Hong Bao Restaurant**, **Water Library**, **Lovely Wine**, **PLU (พลู)**, **CIAO PIZZA**, **Bistro**, and **SEED** — has suffered a complete network compromise resulting in the exfiltration of their entire corporate infrastructure.

## Company Profile

Hong Bao Group operates multiple legal entities:
– **Hong Bao Co., Ltd.** (บริษัท หงเปา จำกัด)
– **Hong Bao EV Co., Ltd.** (บริษัท หงเปา อีวี จำกัด) — Tax ID: 0105559005630
– **Water & Wine (Thailand) Co., Ltd.** (บริษัท วอเตอร์ แอนด์ ไวน์ (ประเทศไทย) จำกัด)
– **Lovely Wine Co., Ltd.** (บริษัท เลิฟลี่ไวน์ จำกัด)
– **I-Group** (investment holding)

The group operates restaurants in premium Bangkok locations including MBK Center, King Square, Ramada, and multiple other shopping malls across Thailand.

**Websites:** hongbaorestaurant.com | waterlibrary.com

## Scope of Breach

Over **736,000 files** have been exfiltrated from three critical infrastructure sources:

### 1. Corporate File Server (FL6-SRV-FILSHA)
– **86,500+ files** from all corporate departments
– Accounting (Hongbao + Water divisions)
– Executive Administration — including **board meeting audio recordings**
– Finance department — complete reports
– HR — employee records, contracts, personal documents
– Purchasing — vendor agreements, pricing

### 2. Company NAS (NAS5EECFF)
– **647,000+ files** — the complete corporate document archive
– **hongbao/** — 400,000+ files: finance, tax, HR, SAP ERP documentation
– **water/** — 180,000+ files: Water & Wine financial, banking, payroll data
– **hb_wl/** — shared financial and tax records
– **Scanned documents** — thousands of signed originals

### 3. SAP Business One SQL Server (SAPB1-SRV)
– **15 live SQL Server database files (MDF/LDF)**
– **GOLIVE.mdf** (~62 GB) — the entire SAP B1 production database containing ALL business transactions, customers, vendors, pricing, and inventory since inception
– **GOLIVE_EV.mdf** (~56 GB) — complete audit trail
– **SBO-COMMON.mdf** (~10 GB) — user accounts and system configuration
– **master.mdf** — SQL Server authentication database with login credentials
– **1,918 branch database backup archives** covering 15 branches

## Data Categories Exfiltrated

### Financial Records (15,500+ files)
Complete profit & loss statements, balance sheets, cash flow reports, and audit records across all branches spanning **2022–2026**. Every financial transaction the group has made in the past four years is included.

### Banking Information (28,400+ files)
– **Bangkok Bank (BBL)** Corporate iCash — account statements, transfers
– **Siam Commercial Bank (SCB)** Business Net — corporate banking records
– **Kasikorn Bank (K-Cash Connect Plus)** — payment records
– Personal **credit card statements** of company directors
– Wire transfer confirmations, payment vouchers

### Tax & Revenue Records (5,100+ files)
– VAT filings for all entities
– Withholding tax certificates
– Revenue Department submissions
– Annual tax returns from 2022–2026

### Payroll & HR (7,800+ files)
– Complete **salary records** for all employees across all branches
– Overtime calculations, bonus payments
– Social Security (ประกันสังคม) contributions
– Provident fund records
– Employment contracts

### Email Archives (14 Outlook mailboxes)
Complete email archives (.PST) of key personnel from both hongbaorestaurant.com and waterlibrary.com domains, including all attachments and internal communications.

### Personal Identity Documents
– **Passport scans** and **Thai national ID cards** of company directors and executives
– Visa and travel documents
– Flight bookings and itineraries

### Contracts & Legal (2,800+ files)
– Mall lease agreements for all restaurant locations
– Vendor supply contracts
– Non-disclosure agreements
– Employment contracts with personal terms

### Wine & Alcohol Import Licenses (425+ files)
All regulatory permits, excise department records, and import documentation for the Lovely Wine business — **without which the wine import business cannot legally operate**.

### POS & Customer Data
– 15+ branch point-of-sale databases with transaction history
– Customer checkout records
– Daily sales reports across all locations

### IT Infrastructure Access
– SAP B1 user accounts (303+ users) with password hashes
– SQL Server administrator credentials
– QNAP NAS access credentials
– TSplus remote access configuration files
– Internal network mapping (172.16.x.x)
– Evidence of prior security compromise (CLR assemblies loaded in SQL Server)

## Key Personnel Exposed

Personal documents, passport scans, banking records, and travel documents of the following individuals are included in the breach:
– **Noppadon Narittakurn** — Director
– **Tata** — Director
– **Zithai** — Director / Designer
– **Nitchaya Tohsanguanpun** — Director

## Impact

This breach represents a **complete corporate data compromise**. Every department, every financial record, every employee record, every branch database, and every executive communication has been exfiltrated.

The data includes sensitive regulatory documents (tax filings, alcohol import licenses) that could trigger **government investigations** if disclosed publicly. The personal banking records and passport scans of company directors present significant **identity theft and fraud risks**.

The SAP production database alone contains the company’s **entire operational history** — customer lists, vendor pricing, proprietary recipes and inventory formulas, and every financial transaction processed through their ERP system.

**Data volume:** 736,000+ files | 15 SQL databases | 1,918 database backups | 14 email archives

**Hong Bao Group has limited time to resolve this situation before full publication.**

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# Onmion LLC — One IT Provider, Three Breached Companies, 3,000+ Victims

**Subject:** Onmion LLC (Mukilteo, WA) — Managed IT Provider
**Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB

—

## Who Is Onmion LLC?

**Onmion LLC** — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — **onmion.com**

A managed IT and software services provider that markets itself as “empowering businesses with cutting-edge software technology.” In practice, Onmion LLC stored all of its clients’ most sensitive data — Social Security Numbers, banking records, healthcare credentials, tax filings — on shared, unencrypted infrastructure with no segmentation between client environments.

Through Onmion’s FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.**

*Screenshot 1 — onmion.com — “Empowering businesses with cutting-edge software technology”*

—

## Three Clients, One Point of Failure

*Screenshot 2 — All three client datasets on the same shared FTP infrastructure*

| # | Client | Website | Location | Data | Individuals |
|—|——–|———|———-|——|————-|
| 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members |
| 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs |
| 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs |

—

## Onmion’s Failures

*Screenshot 3 — N-Central RMM backup archives from Onmion’s management server*

*Screenshot 4 — Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted*

*Screenshot 5 — Summary of Onmion’s security failures*

1. **No segmentation** — all clients on shared FTP with no access controls
2. **N-Central RMM exposed** — 44 daily backups (45 GB) with device inventories and remote access credentials
3. **Plaintext passwords** — production databases storing user credentials in cleartext
4. **Healthcare credentials in Word docs** — 25+ login pairs for major US insurers unencrypted
5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files
6. **Refused to respond** when notified — no action, no client notification

—

# CLIENT 1 — Lake Connor Park

**lcpmembers.com** — Tulalip, WA — Gated residential/RV community — 500+ members — **178.8 GB exfiltrated**

| Category | Details |
|———-|———|
| SQL Databases | 92+ GB — member records, POS transactions, user credentials |
| N-Central RMM | 45 GB — 44 daily backups of IT management server |
| Gate Access Logs | 700+ daily logs — 363+ members with names, cards, timestamps |
| Member Database | 500+ records with full PII, passwords in plaintext |
| Healthcare Creds | 25+ pairs — AETNA, UHC, Humana, Cigna, others |
| Source Code | 99 VB.NET files — POS, QuickBooks integration |
| System Backups | 656 DAR archives (4.8 GB), Jan–Sep 2026 |

*Screenshot 6 — 178.8 GB data archive*

*Screenshot 7 — MAAS member database: 500+ individual PII records*

*Screenshot 8 — Daily gate logs: names, card numbers, timestamps*

*Screenshot 9 — Healthcare credentials in plaintext*

*Screenshot 10 — SQL Server database backups (92+ GB)*

*Screenshot 11 — User passwords stored in cleartext in production DB*

*Screenshot 12 — 44 daily N-Central RMM backups*

—

# CLIENT 2 — Port Susan Camping Club

**portsusan.com** — Stanwood, WA — Tribal nonprofit (Tulalip Tribes) — 2,490 sites — $7.4M revenue — **400+ SSNs exposed**

| Category | Details |
|———-|———|
| Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings |
| Employee PII | 219 individuals (91 active + 128 terminated) — full SSN |
| W-2 Forms | 2020-2025 — SSN for every employee |
| Vendor W-9s | 202 forms — EIN/SSN for all vendors |
| Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations |
| HR Investigations | 10 named cases — harassment, misconduct, legal |
| IRS/Tax | 990T, 1099, PPP/SBA loan records |
| IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps |

*Screenshot 13 — Three data drives: Finance (K), HR (T), Departments (V)*

*Screenshot 14 — 20+ years of financial records*

*Screenshot 15 — 91 active employee personnel files*

*Screenshot 16 — W-2 forms (2020-2025) with employee SSNs*

*Screenshot 17 — 7 Heritage Bank accounts with full account numbers*

*Screenshot 18 — 202 vendor W-9 forms with EIN/SSN*

*Screenshot 19 — 10 confidential HR investigation files*

—

# CLIENT 3 — CarneVita / Cured by Visconti

**curedbyvisconti.com** — 1501 N Miller St, Wenatchee, WA — Food production — **26+ SSNs** — $3.4-4.8M revenue

Three entities compromised through a single shared backup:

| Entity | EIN | QuickBooks |
|——–|—–|————|
| CarneVita, LLC | 33-3284096 | 64 MB (active) |
| Cured by Visconti, LLC | 85-0659112 | 201 MB (active) |
| 3 Boots Ranch & Custom Cuts | — | 13 MB (active) |

| Category | Details |
|———-|———|
| QuickBooks Files | 278 MB+ — complete financials for all 3 entities |
| IRS W-2 Forms | 26 employees — full SSN, names, wages |
| IRS 941/940/W-3 | Quarterly + annual federal tax returns |
| Transactions | 2,018 documents — invoices, POs, receipts |
| Backups | 70+ automated QBW backups (Feb 2025 — Apr 2026) |
| Investment | Fidelity account statements |

*Screenshot 20 — W-2 forms with employee SSNs*

*Screenshot 21 — Form 941 CarneVita: 15 employees, $176K quarterly wages*

*Screenshot 22 — Form 941 Cured by Visconti: 11 employees*

*Screenshot 23 — QuickBooks files for all three entities*

*Screenshot 24 — 2,018 transaction documents*

*Screenshot 25 — PII summary across all three entities*

—

## Combined Impact

| Metric | Total |
|——–|——-|
| Organizations compromised | 3 |
| Data exfiltrated | 179+ GB |
| Individuals with PII exposed | 3,000+ |
| Social Security Numbers | 426+ |
| Bank accounts exposed | 10+ |
| Healthcare credentials | 25+ portal logins |
| Financial history | 20+ years |
| IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 |
| Member/client sites | 2,990+ |

—

## What Affected Organizations Should Do

1. **Terminate Onmion LLC** — they knew and chose silence
2. **Engage independent cybersecurity counsel**
3. **Begin breach notification** per WA State RCW 19.255.010
4. **Notify banks** — Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita)
5. **Report to WA Attorney General** and relevant authorities
6. **Offer credit monitoring** to all individuals with exposed SSNs

**All data will be published in full if Onmion LLC continues to refuse engagement.**

—

*Onmion LLC — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — onmion.com*
*Lake Connor Park — lcpmembers.com | Port Susan Camping Club — portsusan.com | CarneVita — curedbyvisconti.com*

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# NANDAN TERRY LTD — DATA BREACH ANNOUNCEMENT

**Industry:** Textile Manufacturing (Terry Towels, Bathrobes)
**HQ:** Dholka, Ahmedabad, Gujarat, India
**Group:** Chiripal Group
**Website:** nandanterry.com
**Revenue:** ~$23M USD (₹194 Crore)
**Employees:** 500+

—

## WHAT WE HAVE

Nandan Terry Limited’s entire corporate infrastructure has been compromised. We have exfiltrated **200GB+** of data from their internal file servers including 68 workstation backups and all department shared drives.

—

### 🔑 CREDENTIALS & ACCESS (46+ accounts)

Login credentials for **every shipping and logistics portal** they use — including their supply chain accounts with:

– **H&M Supplier Portal** (supplierportal.hm.com)
– **Marks & Spencer** Trading Grid & EDI
– **Walmart** cargo systems
– **Puma** shipping & PO management
– **ALDI** production & contracts
– **LIDL**, **TJX/Marshalls**, **Ross Stores**, **BJ’s Wholesale**, **Big Lots**, **QVC**, **Metro**, **XXX Lutz**
– **DHL**, **Kuehne+Nagel**, **GEODIS**, **Yusen Logistics**, **Expeditors**

All usernames, passwords, portal URLs. Many still active.

—

### 💰 COMPLETE FINANCIAL RECORDS

– **Profit & Loss** statements — monthly, FY 2024-2026
– **Balance Sheet** FY 2024-25 (audited, 47 pages)
– **Consolidated P&L** with revenue breakdown (Export vs Domestic)
– **EBITDA, Net Profit, Working Capital** calculations
– Revenue: **₹194 Crore** ($23M), Net Profit: **₹9 Crore** ($1.07M)
– Full cost structure: raw materials, salary, power, logistics

—

### 🏦 BANKING & LOAN DATA

Complete banking relationships with **7 major Indian banks**:

| Bank | Facility |
|——|———|
| **Punjab National Bank (PNB)** | CC ₹70Cr + TL ₹95Cr |
| **State Bank of India (SBI)** | TL ₹47Cr |
| **Bank of Baroda (BOB)** | TL ₹47Cr |
| **Canara Bank** | TL ₹47Cr |
| **Central Bank of India (CBI)** | TL ₹70Cr |
| **Union Bank (UBI)** | TL ₹47Cr |
| **Bank of Maharashtra + Bandhan Bank** | CC facilities |

**Total loan exposure: ₹433+ Crore ($51.5M)**

All account numbers, IFSC codes, bank RM contacts (names, phones, emails), repayment schedules, interest calculations included.

**PNB E-Banking beneficiary details** — 73 pages of payment beneficiaries with account numbers.

—

### ⚠️ CIBIL CREDIT REPORTS & LEGAL ISSUES

**Extremely sensitive** credit bureau data:

– **CIBIL Commercial Credit Report** — 69 pages, full credit history
– **DPD (Days Past Due) reports** from Canara Bank (31 days) and SBI (29 days) — **evidence of late loan payments**
– **CIBIL irregularity complaints** to PNB
– **Legal suits against company and directors** — documented in internal files
– **NCLT (National Company Law Tribunal)** withdrawal orders
– Director **Braijmohan Chiripal** — CIBIL irregularity for housing loan ₹4.75 Crore
– **CRILC (Central Repository)** reporting disputes with Bank of Baroda, Central Bank of India, SBI

This data reveals the company’s **true financial health** — not the version they show to their buyers.

—

### 👥 EMPLOYEE DATA (500+ workers & staff)

– **Complete salary sheets** — every employee, every month (NTPL Staff, NTPL Workers, SPG Staff, SPG Workers)
– **Worker increment proposals** with full PII: Name, Father’s Name, Department, Designation, Date of Joining, Salary
– **PF (Provident Fund)** and **ESI** data
– **SAP payroll upload files** with individual amounts
– **KPI performance data** — individual worker performance metrics

—

### 📋 CLIENT & SUPPLY CHAIN DATA

**62+ global buyers** in customer master including:

ALDI, H&M, Walmart, Marks & Spencer, Puma, TJX (Marshalls/TK Maxx), BJ’s Wholesale, Ross Stores, Big Lots, QVC, Metro, XXX Lutz, Falabella, LIDL, Meijer, Bealls, Liberty, Hemtex/Kesko, Vineyard Vines, Cencosud, DD’s Discount

**Client-specific data includes:**
– Purchase Orders with pricing
– Product specifications (GSM, size, design files)
– H&M Master Order Dashboards (2023-2026)
– Puma packing instructions & shipment data
– ALDI contract correspondence
– Production schedules per buyer
– Cost sheets and margin calculations

**This data is devastating for their buyer relationships.** Major retailers like H&M and Walmart require strict data security compliance from suppliers. This breach proves Nandan Terry cannot protect their supply chain data.

—

### 📁 CORPORATE & LEGAL DOCUMENTS

– **KYC package:** CIN, IEC (Import Export Code), GST Registration, Export House Certificate
– **Board Resolutions** (conversion from Pvt to Public)
– **Director list** with education and experience
– **Insurance policies** (8 active — plant, machinery, solar, marine)
– **Settlement agreements** (Uday Buildcon)
– **Tax Audit Reports** (FY 2019-2025)
– **Secretarial Audit Report** 2024
– **CredAvenue borrower profile** and shareholding patterns
– **DSRA release letters** from 4 banks

—

### 🗂️ DATA VOLUME

| Category | Volume |
|———-|——–|
| Workstation backups | 68 machines |
| Financial records | Monthly P&L, BS, NCA (2+ years) |
| Salary data | ALL employees, monthly |
| Banking data | 7 banks, full account details |
| Client data | 62+ global buyers |
| Credentials | 46+ portal logins |
| Legal/CIBIL | Credit reports, court cases |
| Insurance | 8 active policies |
| Total estimated | **200GB+** |

—

## ⏰ TIMELINE

**Announcement published.** Nandan Terry Limited has been contacted.

⬛ **4 DAYS** — deadline to begin negotiations. If no contact is made, this page will be updated with additional proof samples and the countdown to full publication begins.

⬛ **+10 DAYS** — full data publication. If no agreement is reached within 10 days after the announcement deadline, the following actions will be taken:

1. **Full financial data** published (P&L, Balance Sheet, loan schedules, CIBIL reports)
2. **CIBIL credit reports and DPD irregularities** sent directly to all 7 banking partners — PNB, SBI, BOB, Canara, CBI, UBI, Bank of Maharashtra
3. **H&M, Walmart, Puma, ALDI, Marks & Spencer** notified of their supplier’s data security failure and supply chain data exposure
4. **46+ portal credentials** published — active shipping and logistics accounts compromised
5. **Employee PII** released — salary data, PF numbers, personal details of 500+ workers
6. **Complete data dump** published on clearnet and Tor — free download for anyone

**Total time to act: 14 days from today.**

The clock is ticking.

—

*Data verified. Screenshots below are samples only. Full dataset available for verification upon contact.*

—

## 📸 PROOF — DATA SAMPLES

*Screenshots from exfiltrated data:*

















• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# La Filipina Uy Gongco Corporation (LFUGGOC) — Philippines

**Published:** [DATE]
**Data Volume:** 278,594 files

—

## Company Overview

**La Filipina Uy Gongco Group of Companies (LFUGGOC)** is a major Philippine conglomerate operating across multiple industries including food manufacturing, flour milling, animal feed production, sugar processing, livestock farming, port operations, logistics, and real estate.

**Website:** foodgroup.ph
**Headquarters:** Taguig City (BGC), Metro Manila, Philippines
**Employees:** 1,500+
**Annual Revenue:** Estimated PHP 15-20 billion ($270-360M USD)
**Auditor:** SGV & Co. (Ernst & Young Philippines)
**ERP:** SAP S/4HANA

The group operates 17+ legal entities across the Philippines with nationwide operations spanning Luzon, Visayas, and Mindanao regions, including 6+ port terminals, flour mills, feed mills, sugar centrals, farms, retail stores, and distribution networks.

—

## Group Entities

| Segment | Companies |
|—|—|
| **Logistics** | Amigo Logistics Corp (ALC), Amadi ALC Services (AASI), Amadi MGT Terminals (AMTI), Mariveles Grain Corp (MGC) |
| **Flour & Pasta** | Philippine Foremost Milling Corp (PFMC), PLILI, MT Philippine Container (MTPCI) |
| **Feeds & Livestock** | LFUG Manufacturing (LFMI), Farms Division, Progreso Retail Stores (PRSI) |
| **Sugar** | CSCI, CAFC, RAFC, Plantation Division |
| **Commodities** | Advanced Agrisolutions Philippines Corp (AAPC), Gentle Earth |
| **Holdings** | CDH Holdings, STARCI/PGIC, Hok Heng/HHH Trading |
| **Real Estate** | LFUG Realty |

—

## Data Exfiltrated

Complete contents of the production file server (FILESHARED01) containing 278,594 files spanning 2018-2026, including:

### Financial Data
– **Consolidated Financial Statements** for the entire group (FY2022 through July 2026)
– **Annual Financial Statements** (AFS) for all business units
– **Budget files** for 2022-2027 including forward projections
– **SGV (Ernst & Young) external audit workpapers** (2022-2025)
– **Bank statements** and reconciliation files (BPI, BDO, Metrobank)
– **Loan documents** including PHP 300M+ BPI promissory notes and amortization schedules
– **Quarterly Income Tax Returns** and all BIR filings

### Employee Data (PII)
– **Complete payroll summaries** for all months of 2025 (24 files, ~13MB each)
– **Employee Alphalist** (JAN-DEC 2025) — all employee TIN numbers and annual income
– **Employee contact details** — names, phone numbers, email addresses, positions
– **13th Month Pay summaries**
– **Leave summaries** and tax refund data
– **SSS, HDMF (Pag-IBIG), and PhilHealth** contribution records

### Organizational Data
– **30+ organizational charts** for all business units (dated March 2025)
– **Job descriptions** with career paths for all positions
– **KPI documents**
– **Headcount reports** (2026)

### Customer & Vendor Data
– **Customer contact database** (26MB) including major Philippine food brands:
– Jollibee Foods Corporation
– Goldilocks Bakeshop Inc
– Shakey’s Pizza Commerce Inc
– The French Baker Inc
– Pan De Manila
– North Park Noodle House
– Vikings Group
– Monde Nissin Corporation
– Del Monte Philippines
– **100+ flour bakery client files** across the Philippines
– **30+ notarized vendor contracts**

### Legal & Compliance
– Correspondence and billing from **5 law firms** (MVGS Law, SAM Law, MOST Law, Rojas & Uy, Tillman & Marquez)
– **Litigation files**
– **SEC filings** and corporate governance documents
– **BIR validated tax returns** (2022-2025)
– **Business permits** (Taguig, Davao, Iloilo, Ingore)
– **Insurance policies** and asset registers

### Operations
– **Import/export documentation** and customs records
– **Vessel operations** data and shipping schedules
– **SAP S/4HANA** data exports, journal entries, and master data
– **Marketing materials** for brands: Iron Claw, Canis Prime, IC+, Progreso
– **IT infrastructure** data including database connection files

—

## Regulatory Implications

This data is subject to the **Philippine Data Privacy Act of 2012 (Republic Act No. 10173)**, which requires:
– **Mandatory breach notification** to the National Privacy Commission (NPC) within 72 hours
– **Notification to affected data subjects** (1,500+ employees and thousands of customers)
– Penalties of up to **PHP 5,000,000** and **imprisonment of 3-6 years** for violations

The company has **5 business days** to respond before data publication begins.

—

## Proof of Data

See attached screenshots showing:
1. Complete file server directory structure
2. Employee payroll files with dates and sizes
3. Group consolidated financial statements
4. HR organizational charts for all business units
5. Customer contact database and email addresses
6. Banking documents and tax filings

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# ZIRNET LLC — Managed Service Provider — FULL BREACH

**Published:** October 2026
**Sector:** Information Technology / Managed Services (MSP)
**Location:** Port Washington, New York, USA
**Website:** zirnet.com

—

## Summary

ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida.

We have obtained **complete access** to ZIRNET’s internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals.

**Total data: 2,260,963 files across ZIRNET and 12 client server backups.**

—

## Affected Organizations

ZIRNET’s negligent security practices have resulted in the exposure of the following companies’ complete IT environments:

| # | Company | Industry | Location | Files |
|—|———|———-|———-|——-|
| 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 |
| 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 |
| 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 |
| 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 |
| 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 |
| 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 |
| 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 |
| 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 |
| 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 |
| 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 |
| 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 |
| 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 |

**Additional organizations with exposed credentials and data:**
– Skylatus Property Capital LLC (Real Estate)
– ClearScope (myclearscope.com)
– Midtown Operating Corp
– Credit and Debt Management Institute (Bolivar, TN)
– La Perla Construction & Design
– LIVOTIS Old World Market
– St. Albans Congregational Church (Queens, NY)
– Creative Mobile Technologies (CMT)
– North Side Transmission
– NY Flooring Inc
– Metropolitan Association of the NY Conference

—

## What Was Obtained

### 1. ZIRNET Internal Data (2,743 files)
– **QuickBooks databases** — Zirnet.QBW (163 MB) and 2025.QBW (155 MB) — complete financial records
– **Bank statements** — TD Bank, American Express, Bank of America — 36 PDF statements covering 2024-2026
– **Email archive** — 3.27 GB of PST files (Outlook) containing all business correspondence
– **IRS documents** — W-9, estimated tax payments, certified copies
– **Client proposals and contracts** — service agreements with all clients

### 2. Complete Credential Database (100+ accounts)
For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained:
– **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords
– **Industrial Solutions (ISNY):** 39 email accounts with passwords
– **ClearScope:** 8 Microsoft 365 accounts with passwords
– **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials
– **St. Albans Church:** 18 email accounts + Azure tenant secret key
– **LIVOTIS:** 3 accounts + VoIP portal access
– **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness)

### 3. Hidden Backdoor Account on ALL Client Machines
ZIRNET created a **hidden administrator account** on every managed workstation and server:
“`
Username: NetworkAccess
Password: [REDACTED]
“`
This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** — a single credential compromise gives access to every machine ZIRNET manages.

### 4. Credit Card Numbers (with CVV)
Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes.

### 5. Personal Identifiable Information (PII)
– **Social Security Numbers** — Employee SSN scans from Dynotec, ASK Construction
– **Birth certificates** — AlphaOne USA (family members)
– **W-2 forms / Tax returns** — Multiple years (2021-2025) for AlphaOne USA employees
– **Employee I-9 forms and drivers licenses** — AlphaOne USA
– **Medical records** — Owner’s colonoscopy, CT scan, and family medical documents
– **Credit reports** — Owner’s personal credit history (2005-2015)
– **Payroll data** — Complete W-2/W-3 packages for multiple years across organizations

### 6. Network Infrastructure
– **Juniper SRX firewall configuration** (Midtown Operating) — root passwords, VPN pre-shared keys, full NAT rules, internal network topology
– **Meraki MX67 firewall credentials** (Skylatus) — admin password, WiFi PSKs, external IP
– **N-Central RMM admin credentials** — ZIRNET’s remote management console controlling all endpoints
– **Azure tenant secrets** — tenant IDs, client secrets for M365 migrations

### 7. Full Server Backups (12 clients)
Complete drive images from 12 client servers including:
– All user documents, profiles, and application data
– Accounting records (invoices, payroll, tax documents)
– Private folders with personal files
– Browser profiles with saved credentials
– Construction project files, contracts, permits
– HR files, employee records, compliance documents

—

## Evidence

**See attached screenshots:**
1. `01_clients_list.png` — Full client listing with file counts
2. `02_credentials.png` — Sample of extracted credentials (partially redacted)
3. `03_financial.png` — ZIRNET financial data and bank accounts
4. `04_pii_sensitive.png` — PII and sensitive document inventory
5. `05_infrastructure.png` — Network backdoors and firewall configurations

—

## Impact Assessment

This breach affects:
– **13+ organizations** across New York, New Jersey, Florida, and Tennessee
– **500+ individuals** (employees, contractors, clients of affected companies)
– **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data)

ZIRNET’s security practices represent gross negligence:
1. **Storing all client passwords in plaintext text files**
2. **Using a single hidden backdoor account across all clients**
3. **No encryption on sensitive data storage**
4. **Storing credit card numbers with CVV in plain text**
5. **Mixing personal medical/financial records with business data**

—

## Contact

ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published.

Countdown: **7 DAYS**

After the deadline:
– All credentials will be published unredacted
– All PII including SSNs will be published
– All financial records will be published
– Each affected company will be notified individually
– Data will be made available for free download

**ZIRNET:** You know how to reach us. The clock is ticking.

—

*This post will be updated as more data is analyzed. Additional client data may be published as proof of access.*

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10

# Elitdata i Varberg AB — Complete Infrastructure Breach

**Published:** [DATE]

—

Elitdata i Varberg AB (org.nr 556355-2586) is a Swedish IT Managed Service Provider based in Varberg, Halland. Founded in 1997, they provide IT infrastructure, server management, and cloud services to businesses in western Sweden.

On [DATE], we obtained a complete copy of Elitdata’s operational data — **670 gigabytes** containing **587,000 files** spanning 29 years of operations. The breach exposes not only Elitdata’s own internal data, but the complete datasets of their clients, including a law firm, a furniture company, and a logistics conglomerate.

Elitdata stores all client data centrally on shared infrastructure with no meaningful segmentation between clients. A single compromise cascades through their entire client base.

—

## The Scope

| Dataset | Type | Size | Files |
|—|—|—|—|
| Elitdata i Varberg AB | IT Provider internal ops + 198 client folders | 80 GB | 55,000 |
| Advokatfirman Kurt Lundberg HB | Swedish law firm | 122 GB | 204,000 |
| Artwood AB | Furniture & design company | 205 GB | 327,000 |
| Mantum Group | Logistics & construction conglomerate | 263 GB | 129 |
| **Total** | | **670 GB** | **587,000** |

—

## Elitdata — The IT Provider

**Address:** Västra Vallgatan 7, 432 45 Varberg, Sweden
**Website:** elitdata.se | **Phone:** 0340-86860

Elitdata is owned by Mattias Rödlund and Stefan Qvarford. Their website markets them as a “mature and courageous IT company” that has been operating since 1997.

From their infrastructure we obtained:

**198 Client Organizations** — complete IT documentation for each, including:
– VPN access configurations (.tgb) to connect directly to client networks
– Firewall configurations (full rulesets)
– Bitlocker encryption keys
– Server documentation and network diagrams
– Remote Desktop (RDP) connection files for 50+ client sites

**Wildcard SSL Private Keys:**
– `*.elitdata.se` — certificate with private key (.pem, .pfx), valid 2025-2026
– `*.mantum.se` — certificate with private key (.key, .pem, .pfx), valid 2026

**XCA Certificate Database** — the complete certificate authority used to manage all SSL certificates.

**Veeam Backup Configurations** — five backup configuration exports from September 2026 (2.3 GB total), containing the full backup infrastructure layout.

**Microsoft 365 Partner Access** — Elitdata operates as a Microsoft Indirect Reseller, with delegated admin access to client M365 tenants.

**Employee Data** — vacation/absence records 2009-2025, driving logs, personal folders for all staff.

**NIS2 Compliance Documents & Incident Response Plan** — ironically, their own security documentation is part of the breach.

—

## Client 1: Advokatfirman Kurt Lundberg HB — Law Firm

**122 GB | 204,000 files | Org.nr 559218-5713**

This is the most sensitive dataset. Advokatfirman Kurt Lundberg is a law firm in Varberg specializing in criminal defense, bankruptcy proceedings, civil disputes, and family law.

The exposed data includes the **complete case archive** of the firm:

### Criminal Defense Cases — 26,871 files
The criminal defense archive contains named defendants with their:
– Full police investigation reports (FUP — förundersökningsprotokoll)
– Attorney defense notes and strategy documents
– Personal identity documents and passport copies
– Court case references (Varbergs Tingsrätt, Göteborgs Tingsrätt)
– Phone call logs between attorney and client
– Evidence files including USB phone extractions

Case types include aggravated tax fraud (grovt skattebrott), civil registration fraud (folkbokföringsbrott), assault, drug offenses, and multiple migration/asylum cases.

### Bankruptcy Proceedings — 110,973 files
Complete legal files for 20+ company bankruptcies, including:
– Creditor lists and debt inventories
– Asset valuations and estate inventories
– Creditsafe credit reports
– Court filings and distribution plans
– Wage guarantee (lönegaranti) documents for affected employees

### Civil Disputes & Family Law — 20,807 files
– Civil lawsuits and insurance claims
– Inheritance distributions (arvskiften)
– Guardianship cases (God Man)
– Custody matters
– Estate administration (dödsbon)

### Attorney Communications
– Email archives (PST) totaling approximately 15 GB
– Internal correspondence between lawyers
– Client communication records

### Financial Records
– Complete SIE accounting files 2020-2026
– Payroll records (Visma Lön 300) for 2021-2024, including a separate file for “Advokatfirman Anton Karlsson AB”
– Balance reports and general ledger entries

**Identified attorneys and staff:** Anton Karlsson (primary case attorney), Sofia (disputes/family law), Henrik, Anders, Krister, Peter, Tina, Ing-Mari, Ulla, Kurt Lundberg (founding partner).

—

## Client 2: Artwood AB — Furniture & Design

**205 GB | 327,000 files**

Artwood AB is a Swedish furniture and home décor company with international sales across Scandinavia, Europe, and New Zealand.

The exposed data includes their **complete business operation:**

– **Purchasing** (55,684 files) — supplier contracts, purchase orders, pricing structures with factories
– **Sales** (15,058 files) — complete customer lists, pricing, order history
– **Marketing** (33,969 files) — product catalogs, campaigns, promotional materials
– **Complete ERP backup** (54,916 files) — Pyramid ERP system with full database
– **3D product renders** (19,407 files) — entire 2026 product line in 3D
– **Employee data** — phone list of all employees, email lists, personnel records, anniversary tracking
– **EU Deforestation Regulation** (EUDR) compliance documentation

**From Elitdata’s client folder for Artwood:**
– VPN configuration file (Artwood.tgb)
– Complete firewall configuration (startup-config.conf)
– SSL certificate for mail.artwood.se with private key
– GDPR Data Processing Agreement (Personuppgiftsbiträdesavtal)
– Incident report templates

A competitor with access to this data would gain complete visibility into Artwood’s supplier network, pricing strategy, customer base, and product pipeline.

—

## Client 3: Mantum Group — Logistics & Construction Conglomerate

**263 GB | 129 files (all SQL databases)**

Mantum is a Swedish conglomerate operating across logistics, construction, and transportation through multiple subsidiaries. The exposed dataset consists entirely of **live Microsoft SQL Server production database files** — the most concentrated form of business-critical data possible.

### Databases:
| Database | Size | Contents |
|—|—|—|
| BC140.mdf | 103 GB | **Microsoft Business Central PRODUCTION** — complete ERP |
| RamosMantumProd.mdf | 28 GB | Production management system |
| Flow_Mantum (6 instances) | 82 GB | Manufacturing/logistics operations |
| Hogia_HR_Foundation | 2.7 GB | **HR database — employee records, contracts, personnummer** |
| Hogia_PBM (7 databases) | 1.7 GB | **Payroll & personnel management** |
| Hogia_Travel | 72 MB | Travel/expense management |
| Opter + Opter_Special | 8.2 GB | Transport/logistics management |
| Per-company accounting | ~600 MB | 10 subsidiaries, 7 years of data |

### Subsidiary companies exposed:
Mantum Entreprenad AB, Mantum Entreprenad i Sverige AB, Mantum Holding AB, Mantum Logistics, Mantum Special AB, Hyltebruks Transport AB, Veddige Åkeriaktiebolag, KC Holding, V Service AB, VAAB Service AB.

### Plaintext Credentials
From Elitdata’s client documentation for Mantum, a file titled “Användare.txt” contains plaintext credentials:

– **Microsoft 365 Global Admin:** admin@mantum.se
– WiFi network passwords for all Mantum SSIDs
– Aruba switch and access point admin credentials
– Application credentials for RAMOS production system
– Individual user credentials

These databases contain every financial transaction, employee record, salary payment, customer invoice, supplier payment, inventory movement, and logistics operation for the entire Mantum corporate group spanning 2018 through 2025.

—

## Why This Matters

### 1. Supply Chain Cascade
One IT provider. 198 client organizations. All exposed through a single point of failure. Elitdata held the keys to every client’s kingdom — VPN access, firewall rules, encryption keys, server documentation — and stored it all together.

### 2. Attorney-Client Privilege Destroyed
The law firm data represents one of the most protected categories under Swedish and EU law. Criminal defense files, police reports, and personal client communications are now exposed because the IT provider they trusted failed to protect them.

### 3. GDPR Nuclear Scenario
Elitdata serves as data processor (personuppgiftsbiträde) for all 198 clients. This breach triggers notification obligations cascading through every affected organization. The Swedish Authority for Privacy Protection (IMY) will need to assess GDPR violations not just for Elitdata, but potentially for each client that entrusted their data.

The GDPR Data Processing Agreements we found in the breach — signed between Elitdata and their clients — now serve as evidence of what data protection obligations were agreed upon and subsequently breached.

### 4. Active, Current Data
The most recent files are dated September 2026. Veeam backup configurations from September 17-21, 2026. VPN configurations updated August 2026. SIE accounting files for fiscal year 2025-2026. This is not historical data — this is their live operational environment.

—

## Data Available

The complete dataset (670 GB) is available for download and includes:

– Internal IT infrastructure documentation for 198 Swedish organizations
– Law firm complete case archive (criminal defense, bankruptcy, disputes, family law)
– Furniture company complete business data (ERP, purchasing, sales, HR)
– Logistics conglomerate SQL production databases (ERP, HR, payroll, accounting)
– SSL wildcard certificates with private keys
– VPN and firewall configurations for client networks
– Microsoft 365 delegated admin access documentation
– 29 years of operational records

—

*Contact us through our secure channel for any inquiries.*

• Group: inc ransom
• Discovered: 2026-11-10 22:33 UTC

This entry reflects a claim published by an extortion group and collected by a public tracker. It has not been independently verified.

Source: RansomLook — Recent Posts · 2026-11-10