Franklin Empire was targeted by the BYOD ransomware threat actor after attackers exfiltrated over 700GB of sensitive data, including AWS bucket keys, Moonshot AI API keys, SMTP credentials, customer PII, invoices, PDFs, packaging slips, and business/ inventory information. The attackers issued a fast-rotation/extortion demand to communicate via their site contact methods to avoid further posting on the dark web, with the impacted country(s) listed as: #countryname
Incident Details
- Victim: Franklin Empire
- Sector: Other
- Country:
- Actor: BYOD
- Source:
- Discovered: 2026-10-05T11:50:23.875197+00:00
- Published: 2026-10-04T00:00:00+00:00
Information
- Over 700GB of data was accessed.
- AWS keys for cloud buckets were obtained and dumped.
- Moonshot AI API keys were compromised.
- SMTP credentials were exposed.
- Packaging slips, invoices, and PDFs were taken.
- Business information and customer PII were included in the leak.
- Inventory data was also compromised.
- The team claims the breach was serious enough that credentials were rotated quickly.
- They warn that the stolen data could be posted across the dark web.
- They demand contact through the methods listed on their site.
- They threaten consequences if no communication is established.
Disclaimer: This post is based on public claims made by the ransomware group "BYOD". I cannot confirm the accuracy of the information. However, I would be happy to share any official statement from the affected organization to provide clarification.