[ For GroupLink (TOR), you need to change BAWANG with ONION, example: https://tegbmnhkbpqz637f2yd.bawang >> https://tegbmnhkbpqz637f2yd.onion ]
| Country | Discovered | Published | Group Name | Victim | Source | Description |
|---|---|---|---|---|---|---|
| 2026-11-10 | 2026-11-10 | BYOD Google | Research | PROVIDENCE About Victim | 25GB Of PII, Full Names, Emails, Addresses, DOB, SSNs & much more. We did not lock your network, yet we have sufficient access to do so, this is to show how nested our access is alongside the severity of the situation. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | ||
| JP | 2026-11-10 | 2026-11-10 | BYOD Google | Research | TOYOTA About Victim | Full Names, Emails, Addresses, Phone Numbers DOB, & Kiosk Devices. A lot was actually isolated, good job, however there was a few cracks we managed to slip through. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| US | 2026-11-09 | 2026-11-09 | BYOD Google | Research | TEXAS HHSC About Victim | So much for firing your enployees for leaking ~94k records, the true flaw remained in your system leading to the whole program being compromised, it's actually laughable, 2 Million Texas Citizens, Medicaid, Banking Information, SNAP, TANF, Disaster Assistance, well, like stated it is not just that, yet, the whole program. Yikes. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| US | 2026-11-09 | 2026-11-09 | BYOD Google | Research | VANDERBILT EDU About Victim | If you could not tell already, your databases are locked, We have your entire estate and research data. Over 1 Million SSNs, Full Names, Email addresses, Phone Numbers, Student & Employee Records, Full takeover of your DC, whatever was on your network, we possess. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| 2026-11-08 | 2026-11-07 | BYOD Google | Research | ??? About Victim | Hello, we are excited to share the start of something major very soon. Please be prepared, thank you. | ||
| US | 2026-11-08 | 2026-11-08 | BYOD Google | Research | TWITTER About Victim | For insights and updates that we do not post on our onion or handle behind the scenes, visit here: https://x.com/q6cv78dn45 (temporary username hold:<) | |
| 2026-11-05 | 2026-11-05 | BYOD Google | Research | FIRST AND FINAL WARNING - IHG HOTELS & RESORTS (ESTATE) About Victim | Here are some sample files for you and the public to see. Let's actually resolve this situation before we have to escalate it in ways we don't want to have to do. Make the right choice, we're not going to warn you again. | ORIGINAL MESSAGE: Nice LDAP Binding Password being '123'. Rotating things won't really save you casue it's not hard to hop back on your network. Anyways, we now have; Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store. Additionally we have reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property) with Access to the AD + All Financial Records. This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc you can pick up what we are putting down at this point. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | ||
| GB | 2026-11-04 | 2026-11-03 | BYOD Google | Research | IHG HOTELS & RESORTS (ESTATE) About Victim | Nice LDAP Binding Password being '123'. Rotating things won't really save you casue it's not hard to hop back on your network. Anyways, we now have; Customer Data, AWS Keys, Full Access to CyberArk, Complete Employee PII, Booking information included but not limited to, guest name, billing address, company, rate code, room charges, taxes, spend, property & stay dates. We also have the loyalty data store. Additionally we have reservation and payment ledgers for the folio reservation (guest name, address, phone, email, arrival and departure, rate, property) with Access to the AD + All Financial Records. This affects the big names such as Six Senses, Holiday Inn, Holiday Inn Express, Staybridge Suites, Garner, Candlewood, Crowne Plaza, Mayfair Hotel, etc etc you can pick up what we are putting down at this point. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| US | 2026-11-02 | 2026-11-01 | BYOD Google | Research | MICHIGAN STATE UNIVERSITY About Victim | Full Personal Identifiable Information for 1.03 million current and ex students as well as the full team in relations to MSU, we also have current and ex passwords, as well as a full compromise towards your System, don't let it scale any further, you've been given the chance to the make the right choice. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| 2026-10-27 | 2026-10-27 | BYOD Google | Research | UPDATE: UNM About Victim | We are offering the decryption key for the remaining of locked devices for free (ONLY for the hospital sector) we did not know that it was running machines related to assisting patients in real-time, (we would keep it locked if it was appointments, patient information + research data only), we are still going to keep the data, but we will provide the decryption key for the hospital sector only. Feel free to contact us on Session. To any patient that was affected, please provide us proof, and we will pay you up to $2500 each for the inconvenience. We are sorry once again. We have morals and we have a heart, we are not villains, but we will still continue to hold companies responsible for bad security leading to the compromise of any customer data. That's the whole reason why we came about and we plan to keep it that way. | ||
| US | 2026-10-26 | 2026-10-26 | BYOD Google | Research | UNIVERSITY OF NEW MEXICO About Victim | 36,000 Machines Compromised, both AD forests (Main Campus + Hospital Sector(with appointments, patient information + research)) With GPOs, Two Oracle databases, every student + employee PII (including SSNs), research information, entire Entra Tenant, Oracle HR + Payroll + Banner Student Records, Internal Emails, Cerner EHR rosters. This is your entire network and infrastructure compromised, the entire university COMPLETELY. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| 2026-10-13 | 2026-10-13 | BYOD Google | Research | DECOROLALA About Victim | Canaidan based home essentials, 60,544 customers, Home addresses + ZIP Code, longitude + latitude, Phone Numbers, Emails, First Name, Last Name, UPS Tracking Number & URL (includes photos of outside house), Total Price at Checkout, Device Used at Checkout, Prodcut ID ordered, Time ordered, you get the idea as we go along. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | ||
| US | 2026-10-07 | 2026-10-07 | BYOD Google | Research | TMOBILE About Victim | You're in big big trouble, oh no, what will you ever do in this situation? Well, we think you should get in touch with BYOD. We won't display what we have for the public to see, just yet, we'll give you the chance. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| SG | 2026-10-07 | 2026-10-07 | BYOD Google | Research | GATE | CRYPTO EXCHANGE About Victim | 12 Million Users, Phone numbers, Nicknames, Balance/VIP Tier List, 2FA Indicator (differentiates, Passkey/Auth) Region, UIDs, Gender, Position, AUM, Profit Rates, Verification Status, City, Strategy, Account Age, Profile Key, and SO much more. This is terrible, for you guys of course, we wonder what will happen if this ever gets out onto the corners of the internet it shouldn't. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | |
| 2026-10-05 | 2026-10-04 | BYOD Google | Research | STANDPOINTE / TRINITE SOLUTIONS About Victim | Finished Financial Statements, Tenant documents & files, Customer Bank Accounts, Deposit Slips, Payment/Cheque Registers, Tax & Accounting Records, Customer Information (Names, Phones, Emails, Addresses, Provinces), Employee Identities, Commercial Secrets. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | ||
| 2026-10-05 | 2026-10-04 | BYOD Google | Research | FRANKLIN EMPIRE About Victim | You know we have over 700GB of Data, AWS Keys to your buckets, (which we dumped), Moonshot AI API keys, SMTP credentials, Packaging Slips, invoices, PDFs, Business Information, Customer PII, Inventory stash and SO much more. Your team knows how serious the breach is, hence why everything got rotated FAST, you also know how bad it can get if it gets posted in every corner of the dark web, Either reach out to us using the Contact methods listed on our site or face the consequences. Make the right decision, it's only you who can save yourselves. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. | ||
| US | 2026-10-05 | 2026-09-29 | BYOD Google | Research | TRUMP MOBILE WIRELESS (TELECOM) About Victim | Trump mobile was informed they had been breached, they then replied with "We have no team to handle this" and that anyone who hacks them are a terrorist. Well unfortunately for them, all 3615 customers and their PII, alongside telecom details are now up for grabs. Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. | |
| 2026-10-05 | 2026-09-29 | BYOD Google | Research | ETEAM About Victim | Eteam was informed they had been breached, just ignored us, we are not giving any more chances, Enjoy their full BPO list EXTREME PII (some of the most sensitive shit any company has). Feel free to take a gander at it yourself, don't be shy, we (and them) certainly aren't stopping you. | ||
| MY | 2026-10-05 | 2026-10-04 | BYOD Google | Research | ROYAL SELANGOR About Victim | Both, your Registered Users & Customer list have been affected. 300K Lines Total, Includes: Names, Emails, Phone Numbers, Addresses, Purchase Amount, Payment Method, Pretty Juicy stuff you don't want getting out there. Anyways, you know where to find us (contact tab). We will take you down when communication has been established between our team and yours. |