[ For GroupLink (TOR), you need to change BAWANG with ONION, example: https://tegbmnhkbpqz637f2yd.bawang >> https://tegbmnhkbpqz637f2yd.onion ]
| Country | Discovered | Published | Group Name | Victim | Source | Description |
|---|---|---|---|---|---|---|
| US | 2026-09-16 | 2026-09-16 | SHADOWBYT3$ Google | Research | HANDYTRAC GREYSTAR AZ WARNING About Victim | Screenshot GroupLink | We have locked out The manager and staff. Time to negotiate now we are extending the day to September 22 2026 at 3:00pm to get it figured out. What we have is real.
[email protected]
[email protected]
Everyone is locked out and we possess the data below
- Physical-to-Digital Key Maps (Reports)
- Property Intelligence & Vulnerability Logs (HandyTrac Key Control.pdf)
- Employee Identity & Credential Data (Employees)
- Financial & Vendor Records (Open_and_closed_Invoices)
- Administrative Portal Control (Dashboard / Administration)
This is not a joke or a bluff it's a sign of a corporate disaster.
proof of lockout: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/locked_out.jpg
we turned off all those and deleted it.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/everyones_lockedout.png
no on that new one it doesn't show Website Logins now everyone is locked out. Read the emails ceo, privacy email, and manager and staff that we sent you a week ago. |
| US | 2026-09-15 | 2026-09-15 | SHADOWBYT3$ Google | Research | HANDYTRAC (GREYSTAR LITCHFIELD PARK, AZ) About Victim | Screenshot GroupLink | We have access to sensitive data. It's in your best interest to contact us and negotiate since it will just hurt you if you don't. We stole a lot of sensitive info including the following:
- Physical-to-Digital Key Maps (Reports)
- Property Intelligence & Vulnerability Logs (HandyTrac Key Control.pdf)
- Employee Identity & Credential Data (Employees)
- Financial & Vendor Records (Open_and_closed_Invoices)
- Administrative Portal Control (Dashboard / Administration)
This is not a joke or a bluff it's a sign of a corporate disaster. Figure it out and negotiate and the picture for proof is on are site at the below
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/Screenshot_proof.png
As you can see negotiate within 72 hours or we will leak the full data. |
| US | 2026-09-10 | 2026-09-10 | SHADOWBYT3$ Google | Research | JOHN ENGEL TEAM About Victim | Screenshot GroupLink | Contact us and negotiate. Don't be like the other real estate companies we have breached. We have serious data which contains the following below. Also we have a image url too to show you that we are not bluffing negotiate and we will remove your name and show you all the proof you want.
url: http://sdwbyttda4uzwdffbt4m7niuodiwhcgmkyxqg5nly2bjxqa6xtbe3fyd.onion/invoice.png
Data Compromised:
the leak contains 0.014 million contacts (exactly 14,476 unique customer records).
The following was stolen
1. Complete Identity and Client Databases (14,476 Total Profiles)
The extraction completely drains the brokerage team's customer network, divided into three distinct lifecycle tables:
- 10,993 Nurtured Contacts:
- 3,306 Archived Contacts:
- 177 Awaiting Nurture Contacts: The fresh pipeline of new inquiries, open-house visitors, and active 30-day leads.
2. Deep Behavioral Tracking & Psychological Analytics
For every single one of those 14,476 profiles, We stole exact behavioral history and intent metrics, including:
- Predictive Intent Metrics: scout score and score change counters that signal exactly when a high-net-worth client is getting ready to purchase.
- Direct Interaction Metrics: Explicit lists of Homes Viewed, Homes Interested (properties starred or liked), Home Value Alert Views, and Market Activity Alert Views.
- Communication Analytics: Logs of Email receives, Email opens, email clicks, email rejects, and system Errors mapping out exactly how responsive a customer is to digital alerts.
3. Corporate Financial and Transaction Data
- 40 Invoice PDFs: A localized batch of billing records detailing contractual pricing, vendor relationships, and enterprise account balances.
- Corporate Payment Method: Active account billing profiles, explicitly exposing a corporate Visa card ending in 8265 with an expiration date of 01/29.
4. Direct Brand Impersonation Assets
- Administrative Access Details: The team leader’s personal profile details, including name, primary corporate emails ([email protected], [email protected]), direct contact phone numbers (203 247 4700), and official state real estate license number (RES.0787476).
- High-Definition Media Links: Pristine branding paths hosted on the platform's live AWS CloudFront CDN network (d1buiexcd5gara.cloudfront.net
- Operational Templates: The exact welcoming and onboarding text strings used by the agents to register new users.
The .csv is in the format below:
Nurtured_Contacts
Name,Email,scout score,score change,type,tags,created at,Auto Nurture Active,Alerts,Email receives,Email opens,email rejects,email clicks,Homes Viewed,Homes Interested,Home Value Alert Views,Market Activity Alert Views,Errors,Starred
and that is for all of them. If you don't negotiate we will sell it on underground forums for one person only and we will send proofs to bleepingcomputer and haveibeenpwned. You have 72 hours to negotiate it will get leaked on 09/12/2026 at 10:10 PM New York Time EST/EDT.
To negotiate are session is below for negotiations only
session: 05dd14d0860cb5d6901de01af2a84c026d914197d0f8ed892085ea3be556563301
contact us via email has a second option:
[email protected] |
| GB | 2026-09-07 | 2026-09-07 | SHADOWBYT3$ Google | Research | BEN LEEDS PROPERTIES About Victim | Screenshot GroupLink | We have emailed the following
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
[email protected]
Reply back and negotiate or all data that we said was stolen gets published. If you comply and negotiate then we won't leak the data that we say we have and could tear down your reputation like dominos. Were not bluffing and this is not a drill we have what we say we have and we are willing to publish it and let everyone accross La and Hollywood know since it affects some people there. You have till wednesday September 9th 2026 due to labor day for USA Companies. |
| US | 2026-08-29 | 2026-08-29 | SHADOWBYT3$ Google | Research | BAYVIEW REAL ESTATE About Victim | Screenshot GroupLink | Guess your too busy focusing on your clients then changing password and protecting your clients. We breached them through pm.livable.com. You can see screenshots and file tree in the proof section. Also bleepingcomputer we will send you the data so you can confirm it too. Were not bluffing BayView Real Estate guess you guys didn't learn your lesson from the 26 million lawsuit but now you will.
The following data was stolen:
1. Corporate Identity and Admin Profiles
6 Individual Administrator Profiles: Complete web profile exports, account configurations, and visible permission mappings for six active employees:
- Breanna Tiu
- Diana Nguyen
- Elise Hou
- Jeanne David
- Wendy Wu
- Zhen Deng
2. High-Density Financial Database Dumping
- Building Statement Reports: The core database extraction file (Building-nK37xrmRYcoCMHymv-statements-report.pdf
- Sample Distribution Summaries: Multi-property accounting records detailing exactly how utility expenses are balanced and divided across real estate assets (including specialized trackers for 394 Midway Street).
3. Operational Infrastructure & Platform Playbooks
- Internal Corporate Handbooks: Step-by-step business guides detailing how money is processed and collected:
- Bill & Collect: Manuals for handling payments routed directly through Livable's platform.
- Convergent: Frameworks detailing workflows where tenants pay the property group directly.
- Software Integration Guides: Training documentation teaching personnel how to map customer data tables between platforms:
- AppFolio ID and Charges mapping logs
- Yardi system integration guides
Complete Video Tutorial Playbooks: Over 100 MB of internal instructional videos teaching how to navigate the portal, manage profiles, and export tenant lists:
- 01 PM Portal Intro
- 02 How to Setup a Tenant's Account
- 03 How to Access the Tenant's Account
- 04 How to Access the Allocation Table
- 05 Move Out Processing
- 06 Export tenant charges and download CSV files
- PM Portal Training - Portfolio Overview & Building Profile
- PM Portal Training - Resident Profile & Allocation Tables
- PM Portal Training - Utility Recovery Proforma, Add a Building, Export Monthly Tenant Charges
4. Tenant Communication Scripts & Branding Graphics
- Official Digital Graphics: High-resolution templates used by the company for onboarding and platform access:
- Bill & Collect Welcome Email interface maps
- Convergent Welcome Email branding templates
- Resident Portal dashboard graphical layouts
- Physical Outreach Letters: Word and PDF versions of letters sent directly to tenants regarding payments and billing statuses:
- Bill & Collect / Convergent / Net Zero Billing Tenant Welcome Letters
- Delinquency Template notification forms
- Physical Billing Statements and Net Zero Statement layouts
5. Legal Leases & Regional Utility Addenda
- 30-Day Notice Templates: Legally binding notification documents used to alter tenant agreements (30 Day Notice_Billing Method Change, Notice of Supplier Change, and Notice of Supplier and Allocation Formula Change).
- Geographic Lease Addenda Collections: Specific legal attachments containing the rules and formulas for utility billing across different municipal districts:
- California Addenda (including localized frameworks for Hayward and Los Angeles)
- National Utility Addenda / US Addenda (including localized parameters for Seattle)
- Exhibit B - Submetered Water regulatory documents
- Lease Addendum Guide instructional packets
Uncompressed size: 216653153 bytes(216.6 MB)
compressed size: 78.0MB
mirror 1: https://pixeldrain.com/u/pc8VfBLf
mirror 2: https://fex.net/s/vydmesb |
| US | 2026-08-28 | 2026-08-28 | SHADOWBYT3$ Google | Research | BAYVIEW REAL ESTATE WARNING About Victim | Screenshot GroupLink | Check your emails or we will leak the data we are not bluffing we stole 216.6 MB.
compromised email: [email protected]
compromised site: https://pm.livable.com
The following emails below check your emails or spam for proof
- [email protected]
- [email protected]
- [email protected]
- [email protected]
- [email protected]
Your company has till August 29th 2026 to respond back or it gets leaked but can get extended to monday if your company responds back and negotiates. |
| ID | 2026-08-25 | 2026-08-25 | SHADOWBYT3$ Google | Research | SINAR MAS AGRIBUSINESS AND FOOD GOLDEN AGRI-RESOURCES) About Victim | Screenshot GroupLink | We Breached This company a few months ago. we stole 375.66MB.
mirror 1: https://anonfilesnew.com/s/4t-mBJg9wMy
More info is on darkforums.ru about this leak. |
| GB | 2026-08-25 | 2026-08-25 | SHADOWBYT3$ Google | Research | A-PLUS SOFTWARE LIMITED About Victim | Screenshot GroupLink | We Breached A-plus through a sql injection vulnerability and downloaded everything in there backend. We gained access to there system on 08/18/2026
The following data was stolen:
1. Website User Data (`usr.csv`)
- This file contains the administrative backend infrastructure for the website, exposing:
- 10 internal accounts, including the usernames `admin`, `debuger`, `camby`, `asuka`, `jimmy`, `ricole`, and `green`.
- Password hashes (SHA-1 format) revealing that almost all administrative users shared the exact same password.
- Internal access metadata
2. Marketing and Public Web Content
- The remaining four files contain the text, configuration, and structural layout used to display information to visitors on `a-plussoft.com`:
`- products.csv`
13 lines): The master list of software solutions and mobile apps sold by the company (such as SalesAnywhere).
`- product_content.csv` (101 lines): The detailed marketing descriptions, features, specifications, and text modules displayed on individual product pages.
`- news.csv` (89 lines): The text content of all historical corporate announcements, updates, and press releases published by the company.
`- news_cate.csv` (2 lines): The category organization tags used to sort the news section on the website
Uncompressed size
total records: 211
2,787,292 Bytes, which equals 2.6582 Megabytes (MB).
mirror 1: https://anonfilesnew.com/s/XtgbXhRkQQ8
mirror 2: https://pixeldrain.com/u/jUpuUyj9 |
| GB | 2026-08-25 | 2026-08-25 | SHADOWBYT3$ Google | Research | KNOTTINGHAM TRENT UNIVERSITY About Victim | Screenshot GroupLink | We breached Knottingham trent University on August 19th 2026 by gaining access through webapps.ntu.ac.uk. We alerted the university which they know they have been breached they locked out are access after stealing the following below
High-Risk Sensitive PII
- Passport Numbers & Details: Stolen via the raw PDF copies of the applicants' physical passports
- Dates of Birth: Specifically exposed on the main data profile screen
- Nationalities & Countries of Birth: Confirmed via the legal passport logs and the registration metadata fields.
Contact & Location PII
- Full Legal Names: Animesh Shukla and Abhinand Unnikrishnan
- Personal Email Addresses: Exposed via the portal login view (`[email protected]`).
- Mobile Phone Numbers: Explicitly collected on the dashboard contact view (`7080809422`).
- Permanent & Correspondence Home Addresses: Complete street-level addresses mapping out exact house numbers, apartment complexes, districts, and postal ZIP codes spanning across Lucknow (226001) and Delhi (110024).
Academic & Professional History PII
- While non-sensitive on its own, hackers use this deeply personal context to write highly convincing scam letters
- Complete Academic History: Stolen via the raw transcript files (`Degree Transcript.pdf` `10TH`, and `12TH` grade completion papers), showing exact grade percentages, modules studied, and prior school names.
- Employment & Professional History: Stolen directly out of the `CV.pdf` file, mapping out their previous job titles and career timelines
- Professional Reference Names: Stolen via the Letters of Recommendation (`LOR.pdf`), which reveal the names, titles, and institutions of the professors or employers who recommended them.
mirror 1: https://anonfilesnew.com/s/FXB5-I_XtWl
mirror 2: https://pixeldrain.com/u/XXWv2geH
This is a warning to all companies to comply it's that easy and simple. If you don't we will leak you and ruin your reputation and make sure that everyone abuses your companies data. |
| JP | 2026-06-16 | 2026-06-16 | SHADOWBYT3$ Google | Research | TINYPULSE NINTENDO BREACH About Victim | Screenshot GroupLink | This will be quick. You don't even want to read the private messages as some will be embarrasing. Some people are confused but this breach doesn't affect you unless if you use tinypulse and work for nintendo. There will be more victims coming soon. If you get a email by us. by us we mean are only email on are leak site, then respond or it will get leaked. We will send file trees for confirmation to prove we actually breached your company. It's pretty funny how companies are defending themselves and when the truth comes out now they want to stay quiet. We have no further questions to answer. This is a warning to all companies if you get breached by us, It's best to contact us especially if we show you the file size. This was true negligence and now you will likely face a massive lawsuit, have fun tinypulse and told you this would be quick. uncompressed file size: (856MB) compressed size: (6.89MB) The included data includes: - full name, first name, last name, email (the w9 is only one and multiple invoices) - Private Employee Chats: Direct internal messages and conversations between workers. - Mar 10, 2025 Sure, it's Knowledge Team—we've needed more content creators for years, but it seems all we can ever get approved are more associates, often temporarily. This helps some, and I know there are vague rumors that maybe we will be able to swap our associates over to NOA employees in the future, but that's not what we need—we need more writers so that we can distribute the primary work among more people. overworking chat: Sep 22, 2025 How happy are you at work? 3 I'm generally extremely content, but the overwhelming number of overlapping high-priority projects and a constant stream of meetings, has left me with little to no available occupancy. This has made it tough to manage everything effectively and still make time for innovation. |
| JP | 2026-06-12 | 2026-06-12 | SHADOWBYT3$ Google | Research | NINTENDO COMPANY About Victim | proof: https://mega.nz/folder/3kBzQKgR#rIhDePsPMeFpfEGTPopDVQ We are ShadowByt3$ a extortion as a service group. We stole close enough to 1gb. You have 48 hours to contact us nintendo or all data gets leaked. If you contact us we give you an extra day to think this through. We are demanding a ransom payment of 2 million dollars. Check your inbox if you work for nintendo and use TINYpulse or go login to tinypulse if the url in the leak looks familiar. You have 48 hours from this announcement then it gets leaked. You have till June 15 2026. size: 859.0MB Close enough to 1GB it contains the following: -full name first name, last name, email of employees -analytics - surveys - all reports exported - all bank statements of payment pdf and w9 forms with employee ids - all cheers exported - all wins dashboard and wall of wins exported - all progress plans exported - Reports from 2016 to up to date 2026 - Analytics of Employees contain conversations and personal feelings about work and more - Content library of personal questions and engagement analytics - TINYpulse and Nintendo top employees of Nintendo based on engagement | |
| 2026-06-03 | 2026-06-03 | SHADOWBYT3$ Google | Research | LEAD COMPANY (LEADERSHIP BOULEVARD) About Victim | Screenshot GroupLink | Company Site: leadschool.in size: 765.9MB This is will be quick. The following schools are affected: The specific schools explicitly named in the exfiltrated folders include: - Arya Vidyapith - Aakarsh International Public School - Students High School - Rainbow International Matric Hr. Sec. School - Vignan Private School The following info was stolen: 1. Personally Identifiable Information (PII) of Students - Full Names and Demographics: Complete names of children sorted by gender and admission numbers. - Academic Progression: Exact tracking of student grade levels (e.g., SKG, Class 1, Class 2) and division assignments - Age and Vital Records: Exact dates of birth (DOB) for all enrolled students. - Physical Locations: Full residential addresses, cities/districts (such as Nampally, Telangana), and exact localized postal pincodes 2. Guardian and Parent Contact Registries - Parent Identity: Full names of both fathers and mothers linked directly to their children. - Direct Contact Methods: Active personal mobile numbers for parents, creating a severe vulnerability for automated spam or voice-phishing attacks. - Digital Contact: Parent email addresses intended for formal school updates. - Student Led Events - Teacher Certificates - gac-reports - Assessments 3. Proprietary LEAD School Academic Metrics - ELGA Placement Data: Internal academic tracking metrics, showing specific curriculum tiers like "ELGA Class" (e.g., ELGA02, ELGA06) and "ELGA Division" for individual students. - Classroom Analytics: Operational performance data exfiltrated directly from the nucleus.leadschool.in administrative portal. - Teacher Resources: Lesson plans, training modules, and classroom resources that form the core commercial assets of the LEAD platform. | |
| CH | 2026-06-02 | 2026-06-02 | SHADOWBYT3$ Google | Research | CROPWISE (SYNGENTA GROUP) About Victim | Screenshot GroupLink | We have breached you and gained access to the following portals: https://operations.cropwise.com/d/users/sign_in https://accounts.cropwise.com/signin proof: https://mega.nz/folder/25hkSLgY#ELjJaFie-TfES9Z_47KFZA company url: https://operations.cropwise.com/ We are ShadowByt3$ a Extortion as a service group. You have been breached and 10.4MB was stolen. It may seem small but it can affect you every way imaginable. Don't believe us the following below was stolen: 👤 User Identities and Access Credentials - Account Directory Data: Full names, corporate email addresses, and phone numbers of registered agronomists, regional farm managers, and field staff. - Authentication Metadata: Encrypted password hashes, session tokens, or configured API keys utilized to link automated machinery data feeds to the web dashboard. 🚜 Precision Agronomy and Farm Metrics - Geospatial Boundaries: High-resolution GIS boundary files detailing the exact shapes, coordinates, and property lines of privately owned or leased commercial fields. - Vegetation and Scouting Analyses: Historical NDVI satellite imagery datasets [CWO: Tools for effective monitoring of your crops' condition syngenta.co.za], past growth tracking matrices, field problem zone flags, and yield prediction models. - Operational Treatment Records: Deep operational histories documenting exact pesticide or fertilizer applications, crop types, seeding timelines, and harvesting schedules. 🚛 Telematics and Fleet Diagnostics - Machinery Tracking Logs: Real-time and archived GPS location paths generated by connected tractors, combines, or sprayers. These logs map out the specific work shifts, operational speeds, and field locations of individual machine drivers. If you contact us then we won't leak it and show proof that we deleted it. Also we will tell you how to secure your company so you don't get breached again. We are giving you 48 hours (approx 3 days) to contact us which would be by June 4th 2026. If you fail to reach out to us we will maximize damage by giving it to news outlets, swatting victims, and we will email everyone affected and you would be the next headline. All you have to do is pay 1 million in bitcoin or monero and it goes away. |
| IN | 2026-05-21 | 2026-05-21 | SHADOWBYT3$ Google | Research | HOTELOGIX COMPANY About Victim | Screenshot GroupLink | Should've not messed with us Hotelogix. We gave you guys numerous times to reach back and proceed with payment but you decided to fuck around and you found out. Any company that contacts us because you had a warning or we leaked proof should look at what we got if your concerned then contact us for payment if everything matches up. It's that simple and don't think twice or it can lead to what happened with this company. Don't be like Hotelogix and wait till the last Minute. It's best to pay first to so you don't end up like these companies to name a few University Of Georgia, Hotelogix, starBucks, and more mega link conversations: https://mega.nz/file/mwAGQDaA#TX0wXzN2JmzehD1WxV234_QiHaK7AzSA1PumfWq_HCU |
| US | 2026-05-21 | 2026-04-01 | SHADOWBYT3$ Google | Research | STARBUCKS COMPANY About Victim | Screenshot GroupLink | StarBucks Failed to reach out to us and didn't pay even $500,000 when we know they can afford it. It's not even that much we were asking for. Since you didn't contact is no negotiations and this is now in the hands of cybercriminals. This is a warning to all companies if you see yourself posted here to reach us. This is the only ammount we have on are servers due to migrating dmca and ignore abuse infrastructure. They were breached on 04/01/2026 and they know they were breached because they closed the s3 bucket starbucks-prod. |
| IN | 2026-05-14 | 2026-05-14 | SHADOWBYT3$ Google | Research | POWERCAMPUS About Victim | Cloud-based school management and collaboration platform targeting educational institutes in India, covering online fee payments, exam management, online admissions, teacher-parent communication, and e-learning continuity. | |
| US | 2026-05-14 | 2026-05-14 | SHADOWBYT3$ Google | Research | STRIDE LEARNING About Victim | Screenshot GroupLink | Stride Learning Should've Paid the ransom. We were only asking $500,000 in bitcoin or monero it's not that hard. This is a warning to all companies that if you don't pay it will get leaked. If you pay you have are word that it's deleted also with a picture before and after. If you want we will also take a video. |
| GB | 2026-05-14 | 2026-05-14 | SHADOWBYT3$ Google | Research | AMPLIFY TECHNOLOGY About Victim | Amplify technology has been a victim of an attack. There project they were working on with the pakistan and other countries got stolen. We stole 1.69Gb of data. for all the proof and files it's on the mega.nz link below. For screenshots go to are telegram channel below. They didn't take us seriosly so now they pay for it. The data contains the following below: financial records, pii, pictures of houses personal stuff like address, fathers name, address, etc The company Website: https://www.amplifytechnology.co.uk In the UK, Amplify Technology Limited is a strategic technology consultancy based in Bromsgrove, England. They specialize in helping organizations align their technology with business goals through advisory and implementation services. WHAT THEY DO... - CIO Advisory: Strategic support for technology leaders, including one-to-one mentoring, coaching, and support for cloud migrations or mergers. -SAP Services: Expertise in SAP leadership and technology integration, particularly for the housing, local government, and healthcare sectors. - Change & Adoption: Guiding organizations through cultural shifts and new operating models to ensure people and technology are aligned during digital transformations. - Technical Reviews: Conducting diagnostic reviews of IT operations, cybersecurity, data, and technology change | |
| US | 2026-05-14 | 2026-05-14 | SHADOWBYT3$ Google | Research | UNIVERSITY OF GEORGIA About Victim | Screenshot GroupLink | ShadowByt3$ has breached University of Georgia. The full data is on are leak site. We stole approximately 3.2 MB in raw text files. No customers were affected just exployees the following was stolen. - Physical Locations: Home addresses (like the Columbus, GA residential home) and specific office numbers (like Office 2207). - Private Contact Info: Personal cell phone numbers and home phone numbers (e.g., the 404-736-xxxx). - Employee Information: This often includes full names, contact details, and institutional identification photos. - Project Documentation: Information regarding internal university projects, including tracking logs and administrative data for various departments. - Workforce Data: Internal metadata such as position numbers, departmental assignments, and work schedules. - Technical Details: Notes regarding system maintenance and development that could potentially highlight internal processes - Critical Infrastructure: Active project maps for GEMA (Emergency Management), Georgia Broadband, and GDOT (Transportation) through 2026. - Government Records: Access to Asset Forfeiture logs and County-level GIS (Athens-Clarke, Bibb) that underpins 911 dispatch and land taxes. - Leadership Secrets: The UGA Office of the President Mail Tracker and Gov360 anonymous executive coaching logs. - The "SME" Map: we have identified the "Subject Matter Experts" like Noah Abouhamdan, Chad Rupert, and Pat Russell. we know exactly how many hundreds of hours these people have spent on specific pieces of code. - Security Clearances: we know who is a "Benefited" full-time employee (high-value target) versus a "Student Assistant" (low-value entry point). |
| SG | 2026-05-14 | 2026-05-14 | SHADOWBYT3$ Google | Research | HOTELOGIX About Victim | We are ShadowByt3$. We have claimed responsibility for hacking Hotelogix. They have been breached through there amazon s3 buckets and azure blobs. They were misconfigured which allowed us to scrape everything inside. This has been are latest campaign. If you don't pay $500,000 in btc or monero all data gets leaked. We are not joking and not playing we will. As you can tell in the sample in the data leak site or url below. We are giving you until April 14th at 12:20 it expires. It gets released. DarkWebinformer if you see this contact us asap through are telegram. Any researchers you can contact them and verify data. Also let them know what we have and have 6gb of data. Tell them if they don't pay by that date they get released and is not being put up for sale. Make the right decision and just getting law enforcement involved is just going to make it worse and as you can see they are helpless and don't do shit about you and don't care about companies. Look at how many companies get reported to the feds, you really think there going to help you. If you do your wrong. You can try to stop us but it doesn't stop the leaks from already being leaked and passed around other researchers or criminals. The following below was stolen: 1. Internal Corporate Data This data pertains to Hotelogix's own business operations and software development: - Operational Manuals: Internal guides for staff on how to use and manage their cloud-based systems. - Product Upgrade PDFs: Documentation detailing recent or upcoming software updates, which can reveal specific system architectures. - Branding Assets: Official logos, templates, and marketing materials (often used by hackers to create more convincing phishing emails). 2. Client-Specific Data (Treebo Hotels) The most critical part of the breach involves data belonging to Hotelogix’s clients. For Treebo Hotels, the stolen files include: - Customer Folios (Invoices): As seen in your image, these contain guest names, phone numbers, and home addresses. - Guest Stay Details: Specific dates of arrival and departure, room numbers, and room types (e.g., "Promotional Room Rent Oak"). - Payment Processing Details: While full credit card numbers are often encrypted, "processing details" can include: Last four digits of cards. Transaction IDs and dates. Billing amounts and tax breakdowns (GST/SGST). | |
| 2026-02-25 | 2026-02-17 | SHADOWBYT3$ Google | Research | UMSA About Victim | File: UMSA_LEAK.7z |
