Incident tracker

Recent cyber attacks and data breaches

This view includes companies named on ransomware leak sites. Those are the gangs’ claims, not verified breaches.

DisclosedCompanyWhat happenedTypeRecordsSource
2026-09-14Minmer GlobalMinmer Global named on qilin's leak site

Freight & Logistics Services

Ransomware claimClaimed by qilin · not verified
Not disclosedRansomLook
2026-09-14Apteki MareshkiApteki Mareshki named on the gentlemen's leak site

mareshki.com Apteki Mareshki Bulgaria's largest pharmacy chain by outlet count — 294 pharmacies in 120+ towns (2025), built since 1991–92 by Veselin Mareshki, the Varna businessman, founder of the Volya party and former deputy speaker of parliament. Because Bulgarian law caps one company at 4 pharmacies, the chain runs as dozens of legal entities (owned by his mother Veska, relatives and their children) under the MARESHKI HOLD AD umbrella, franchising the brand from Varnafarma-M and supplied through his own wholesaler Farmnet AD (bought from Actavis in 2010; 2016 revenue 494.8M leva, top-4 drug distributor — together with Sofarma Trading, Phoenix and Sting handling ~80% of national distribution)

Ransomware claimClaimed by the gentlemen · not verified
Not disclosedRansomLook
2026-09-14Multipla Contabilidade EmpresarialMultipla Contabilidade Empresarial named on the gentlemen's leak site

contabilmultipla.com.br Multipla Contabilidade Empresarial family accounting firm from Piracicaba, São Paulo state, operating since 1990 — legal entity MULTIPLA CONTABILIDADE EMPRESARIAL S/S LTDA (CNPJ 05.145.683/0001-99, founded 01/07/2002, capital R$700,000, Simples taxpayer), owned and run by husband-and-wife team Renata Nunes Albino Semmler (accounting director, 35+ years in the profession) and Charles Semmler, with the second generation (Beatriz & Eduardo Albino Semmler) joining family firms in 2026. Services: industry-specialized accounting (services, commerce, industry, healthcare, construction, agribusiness), BPO financial outsourcing (spun into Multipla Gestão Financeira, 2022), company formation & legalization, tax planning & revision, and full payroll/HR (eSocial, DCTFWeb). Team of ~15–20

Ransomware claimClaimed by the gentlemen · not verified
Not disclosedRansomLook
2026-09-14SomitSomit named on the gentlemen's leak site

somit.com zoominfo.com/c/somit/372548242 Guatemalan IT systems integrator founded in 1994 — designing, deploying and maintaining data networks, telecommunications, security systems, data-center engineering (power/cooling) and telemedicine & distance-learning interactive platforms for Guatemala's corporate and government sectors. In-house certified engineering staff; anchor clients include banks, universities and government institutions. A classic invisible Central-American integrator: 30+ years in the market, stable demand from banks and the state, near-zero international digital footprint

Ransomware claimClaimed by the gentlemen · not verified
Not disclosedRansomLook
2026-09-14Wada FarmsWada Farms named on the gentlemen's leak site

wadafarms.com Wada Farms third-generation family potato empire from Idaho — founded 1945 by Japanese-American farmer Albert Wada (whose family was interned at Minidoka camp during WWII, then returned and bought 160 acres near Pocatello); today run by the third generation (~10,000 acres in Magic Valley growing Idaho® Russet potatoes, onions and sweet potatoes) with its own climate-controlled storage, packing shed and three brands: Potato King™, Wada Farms® and Wada Farms Organic® — selling into national grocery chains, processors and export channels. Vertical integration from field to branded shelf; revenue undisclosed (est. $50–100M+); 50–150 seasonal/permanent staff

Ransomware claimClaimed by the gentlemen · not verified
Not disclosedRansomLook
2026-09-14AforpaAforpa named on the gentlemen's leak site

aforpa.fr zoominfo.com/c/aforpa/427085810 Aforpa French electrical engineering & installation contractor based in Roissy-en-France (next to Paris-CDG airport) — founded 1965 (current SAS registered 1978), specializing in high-power electrical works (HTA/BT networks, lighting) and industrial automation for airports, power plants, tunnels, telecom and residential towers. Its verified credentials: RATP certificate Q19 (electrical works for Paris transport — tunnels/stations) and registration on SFR's contractor registry (telecom power infrastructure). Headcount ~100–250, revenue est. €30–60M (private, undisclosed).

Ransomware claimClaimed by the gentlemen · not verified
Not disclosedRansomLook
2026-09-14tpi.twtpi.tw named on lockbit5's leak site

Managing a company is a constant process of managing change, solving problems and facing up to chall...

Ransomware claimClaimed by lockbit5 · not verified
Not disclosedRansomLook
2026-09-14comune.robeccosulnaviglio.mi.itcomune.robeccosulnaviglio.mi.it named on lockbit5's leak site

Comune di Robecco sul Naviglio is a municipality in the Metropolitan City of Milan

Ransomware claimClaimed by lockbit5 · not verified
Not disclosedRansomLook
2026-09-14httoy.fihttoy.fi named on lockbit5's leak site

Tilitoimisto HTT Oy Tilitoimisto HTT Oy on Raumassa toimiva kirjanpitäjä, joka tarjoaa taloushallin...

Ransomware claimClaimed by lockbit5 · not verified
Not disclosedRansomLook
2026-09-14Dublin City Schools GADublin City Schools GA named on eclipse's leak site

Dublin City Schools is a charter school system dedicated to preparing students to be effective communicators, problem solvers, and lifelong learners. The district offers a range of academic programs, including advanced and gifted education, special education, and various support services. Their intended clients include students and families in Dublin, Georgia, as well as educators seeking employment opportunities within the district

Ransomware claimClaimed by eclipse · not verified
Not disclosedRansomLook

About this tracker

435
Incidents
295
Ransomware gang claims
730
Last 30 days
395
Companies tracked
2,742,501,669
Records disclosed