[ For GroupLink (TOR), you need to change BAWANG with ONION, example: https://tegbmnhkbpqz637f2yd.bawang >> https://tegbmnhkbpqz637f2yd.onion ]
| Country | Discovered | Published | Group Name | Victim | Source | Description |
|---|---|---|---|---|---|---|
| DK | 2026-10-28 | 2026-10-28 | BARRACUDA Google | Research | FEMERN LINK CONTRACTORS About Victim | GroupLink | Femern Link Contractors (FLC) is an international joint venture responsible for designing and building the Fehmarnbelt tunnel between Denmark and Germany. Its work includes the immersed tunnel, tunnel portals and ramps, and the factory that produces the tunnel elements.
During the attack, we bypassed EDR and infiltrated infrastructure. Since September 17, 2026, we have had full access to all confidential files of Femern Link Contractors, including internal correspondence, contracts, agreements, insurance documents, tunnel construction photos, site videos, procurement records, bank accounts and balances, employee personal data, and more.
After gaining access to all systems, we encrypted all vCenter virtual machines on the day of the attack, resulting in a complete infrastructure shutdown.
As a cybersecurity group, we do not wish to harm company and have sought a resolution. In an alternative outcome, this data and incident might never have been published (as with other clients with whom we successfully negotiated). However, due to interference from the Danish police, cooperation was prevented, and Femern Link Contractors will now suffer maximum reputational damage. All confidential construction information will become publicly available, including:
C1 - Strategy
C2 - QHSE
C3 - Risk Management
C4 - Compliance & Interface
C5 - Project Control
P1 - Works Preparation
P2 - Design & Engineering
P3 - Execution
P4 - Completion
S1 - Contract Management
S2 - Procurement
S3 - Human Resources
S4 - Admin & Finance
S5 - Communication & PR
S6 - Information Systems & Document Control
S7 - Industrial Relations
XX IT - Temporary
YY - PointCloud
In total, 1,576,452 files and 154,206 folders (2.44 TB) were exfiltrated.
The data is available for purchase either as individual files or as the entire dataset. | Status: selling | $500,000 |
| HR | 2026-10-09 | 2026-10-09 | BARRACUDA Google | Research | MINISTARSTVO POLJOPRIVREDE, šUMARSTVA I RIBARSTVA About Victim | GroupLink | We have complete database dumps from the Ministry of Agriculture and all documents from its main file server. They contain information about residents of Croatia, including agricultural registration records and personal data such as phone numbers, surnames, first names, and photos, as well as details about each resident’s agricultural activities. We also have Ministry of Agriculture contracts and other confidential documents.
Recently, the authorities claimed that no data breach had occurred. It’s unfortunate that this was a lie.
https://mps.hr | Status: selling | $50,000 |
| EC | 2026-10-02 | 2026-10-02 | BARRACUDA Google | Research | AUTOMOVIL CLUB DEL ECUADOR ANETA About Victim | GroupLink | We have a database of all the car club's customers and applications, photos of customers, financial documents, and a complete dump of emails from the mail server for the entire year:
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected] | Status: selling | $30,000 |
| 2026-09-26 | 2026-09-26 | BARRACUDA Google | Research | INTERNATIONAL CHEMICAL CO. About Victim | Screenshot GroupLink | International Chemical Company (ICC) manufactures specialty metalworking fluids, industrial cleaners, rust preventatives, and custom chemical formulations.
We have extracted the most important files from their main file server and possess data on their sales, formulas, patents, manufacturing, contracts, and partners.
For example, we possess the full formulation and manufacturing instructions for I.C.C.’s patented Biodraulic hydraulic oil. And even more than that. It is available for sale to competitors.
Victim website: https://e-icc.com | Severity: HIGH | Size: 90 GB | Status: selling | $50,000 | |
| AR | 2026-09-24 | 2026-09-24 | BARRACUDA Google | Research | SOLUCIONING S.A. About Victim | Screenshot GroupLink | This is a small company of 4-5 people, yet it has big clients in the oil production sector.
Unfortunately, the company neglected data security, allowing us to gain access to all their confidential files - projects, documents, blueprints, and so on.
The company has been ignoring us for five days now, and we will soon publish their files. This is a warning. We do not wish to harm anyone, but we are prepared to inflict maximum damage.
Victim website: https://www.solucioning.com/ | Severity: HIGH | Size: 463 GB | Status: selling | $100,000 |
| 2026-09-23 | 2026-09-23 | BARRACUDA Google | Research | ABTACH LTD. About Victim | Screenshot GroupLink | Abtach Ltd. was renamed Intersys Ltd.—a Pakistani company engaged in fraud targeting the US. The company’s employees charged fees for services that did not actually exist.
The company’s founder, Azneem Bilwani, was involved in the illicit trafficking of synthetic opioids and fentanyl analogues, which were supplied to the US market via the eWorldTrade marketplace.
We encrypted all virtual machines and snapshots on their ESXi hypervisors and all files on employee computers, and exfiltrated 1.5 TB of data from their infrastructure. We possess all their documents and bank records, which contain evidence of Azneem Bilwani’s illegal activities.
Will be published soon... | Severity: HIGH | Size: 1.5 TB | Status: selling | $100,000 | |
| TR | 2026-09-13 | 2026-09-13 | BARRACUDA Google | Research | I2I-SYSTEMS About Victim | Screenshot GroupLink | This is one of the most poorly secured companies we have ever encountered. Over the course of a week, we analyzed the infrastructure and moved freely across their network. The infrastructure lacked proper security configurations, and the IT department showed a complete disregard for the data. As a result of the attack, 693 gigabytes of data were exfiltrated.
We downloaded the complete source code for the following projects:
Caplan
DataGov-Dev-Docker
DDR
DDR-Veriskop
DFE-Dev
Kangal-Dev
SDD-DEV-DOCKER
SDD-MAIN
commonprojects.zip
Copycat.zip
CopycatLive.zip
datacat.war
datagov.war
Kangal-Dev.zip
Kangal-Master.zip
[email protected]
smartdq.war
The volume of exfiltrated source code totaled 44 gigabytes. The data includes a full snapshot of the latest releases from the development repository. i2i-systems has a direct connection to the information security company Veriskop; therefore, this breach directly affects them as well. In addition, i2i-systems engaged in joint projects with partners such as Vodafone, Etiya, Bouygues, Freedom Mobile, and others; this is evidenced by the Linux servers located within the i2i-systems infrastructure:
1864654005 backup_Veriskop-SQA1.local_2026-08-31_203808.tar.gz
3292962897 copycat2019.i2isystems.local_critical_backup_2026-08-31_19-30-29.tar.gz
18422354 critical_backup_bouygues_fcbs_batch2.local_20260830_221815.tar.gz
2231188487 etiya-mobile-test-01.local_backup_20260831_213207.tar.gz
20546323810 freedom-mobile1-critical-vault.tar.gz
1050673952 freedom-mobile2-secrets-20260830-232814.tar.gz
721661 maya-redhat7-9_2026-08-30_233036.tar.gz
22966288270 ol8-10-innobi_full_backup_20260831_022640.tar.gz
529695763 veriskop-db-critical-backup-2026-08-31_234418.tar.gz
13012999372 veriskop-fiziksel-yedek-20260831023535.tar.gz
309528511 veriskop-oracle-critical-backup-2026-08-31_203340.tar.gz
633604141 veriskop-rhel-7.local_critical_backup.tar.gz
4878999722 Veriskoptest01.local_backup_20260831_213236.tar.gz
238487575 Veriskoptest02.local_critical_backup_20260831_213052.tar.gz
33936543608 veriskoptest03_critical_backup_2026-08-31.tar.gz
We have extracted absolutely all critical data from these infrastructure Linux systems and created a snapshot of the databases.
In addition, i2i-systems recently launched a joint project with Turk Telekom—we have downloaded the database containing all their customers.
The data will be published soon... | Severity: HIGH | Size: 643 GB | Status: selling | 300000$ |
| US | 2026-08-23 | 2026-08-23 | BARRACUDA Google | Research | SKYLINE IMPLANTS & PERIODONTICS About Victim | Screenshot GroupLink | Full personal and servers files dumps from Skyline Implants & Periodontics company. The data files contain: medical documents of patients (including MRI scans of various parts of the body — files with the .dcm extension), personal photos, and the personal data of the doctor, Scott Ferguson, as well as documents from the company Skyline Implants & Periodontics — in particular, information on equipment and pharmaceutical procurement and other related materials. | Severity: HIGH | Size: 800 GB | Status: free | FREE |
| KR | 2026-08-23 | 2026-08-23 | BARRACUDA Google | Research | NAMYANG INDUSTRIAL CO., LTD. About Victim | Screenshot GroupLink | Selling fresh full database dumps of company Namyang Industrial Co., Ltd. (renamed to Namyang Nexmo).
Infrastructure dump, not website! There information about employers, manufacturing, parts, clients, partners and etc. Total lines (csv format): 17 641 181. | Severity: HIGH | Size: 2.51 GB | Status: free | FREE |
| US | 2026-08-23 | 2026-08-23 | BARRACUDA Google | Research | CLINICAL ASSOCIATES OF THE FINGER LAKES (CAFL) About Victim | Screenshot GroupLink | The company mishandled its clients' and employees' data, which is why it was leaked. We extracted all files and documents from the infrastructure. These documents included children's medical records, personal information of parents and employees, a full dump of all emails from the mail server, and much more.
Target website: https://www.clinassoc.com/
| Severity: HIGH | Size: 447 GB | Status: selling | $1000 |
| BR | 2026-08-15 | 2026-08-15 | BARRACUDA Google | Research | VR ADVOGADOS About Victim | Screenshot GroupLink | VR Advogados, a Brazilian law firm, neglected its clients’ personal data, violating laws regarding data storage and confidentiality—they posted and shared all of their clients’ documents, passport information, and powers of attorney via a Discord server. We hacked it. Now we have 3,000 documents belonging to all of their clients—passports, powers of attorney, declarations, personal and work-related correspondence, and more. The firm hasn’t responded to us for three days; if this continues, we’ll start selling the data. | Status: upcoming | Size: 10 GB | Starts at $30000.00 |
| 2026-08-06 | 2026-08-05 | BARRACUDA Google | Research | FERRELL \ SKYLINE IMPLANTS & PERIODONTICS \ DR. SCOTT FERGUSON About Victim | Screenshot GroupLink | Full personal and servers files dumps from Skyline Implants & Periodontics company. The data files contain: medical documents of patients (including MRI scans of various parts of the body — files with the .dcm extension), personal photos, and the personal data of the doctor, Scott Ferguson, as well as documents from the company Skyline Implants & Periodontics — in particular, information on equipment and pharmaceutical procurement and other related materials. | Status: free | Size: 800 GB | Now free | |
| US | 2026-08-06 | 2026-08-05 | BARRACUDA Google | Research | MICRO-COMM INC. About Victim | Screenshot GroupLink | Micro-Comm, Inc. is an industrial automation company based in Olathe, Kansas, that provides water and wastewater control systems, manufacturing control panels, micro-controllers, and SCADA software. [http://www.micro-comm-inc.com]. Tree of all files: https://www.filemail.com/d/vpqdvykqwssupsw. Files count: 894 963, documents type: maps, schemes, personal employers information, personal citizens information, work photos, emails, partners personal information | Status: selling | Size: 643 GB | Starting at $30000.00 |
| KR | 2026-08-06 | 2026-08-05 | BARRACUDA Google | Research | NAMYANG INDUSTRIAL CO., LTD. \ NAMYANG NEXMO About Victim | Screenshot GroupLink | Selling fresh full database dumps of company Namyang Industrial Co., Ltd. (renamed to Namyang Nexmo).
Infrastructure dump, not website! There information about employers, manufacturing, parts, clients, partners and etc. Total lines (csv format): 17 641 181. | Status: selling | Size: 2.51 GB | Starting at $40000.00 |
| CN | 2026-08-06 | 2026-08-06 | BARRACUDA Google | Research | RS AUTOMATION CO., LTD. About Victim | Screenshot GroupLink | Full dump of all files from the servers and developers personal files and NAS. Legal documents, letters, drawings, assembly, C, and C++ source codes. Official manufacturer website: rsautomation.co.kr | Status: upcoming | Size: 637 GB | Starts at $50000.00 |
