Netcrook
#Data Exfiltration
MCBS Breach Claim Turns Into a Scale Test for Ransomware Truth
MCBS has linked a breach to 1.2 million affected individuals, while the PEAR ransomware group claimed to have taken 3 TB of information - a reminder that volume claims and verified exposure are not the same thing.
Crpxo Listing Puts Prei Capital in the Crosshairs of a Leak Claim
A new victim label and an unverified 18.7 GB data figure create immediate pressure, even while the technical facts remain incomplete.
Ransomware Listing Pressures a Named Industrial Supplier With Unverified Theft Claims
A fresh victim entry tied to hydraulic-components.net shows how extortion crews use exact file and volume figures to amplify pressure, even when the alleged theft remains unconfirmed.
Booba Project Lists Zynex With a Claimed 1.4 GB Data Theft
A victim entry names Zynex and attaches a data-loss figure, but the allegation remains unverified and the content of the data is not described.
Victim Name Drops Fast, But the Evidence Trail for Clarke Radiology Stays Narrow
A ransomware-linked victim listing tied to Thegentlemen has placed a Montreal imaging clinic in view, yet the supplied material does not prove intrusion, exfiltration, or patient-data exposure.
One Victim Listing, One Name, and a Lot of Unanswered Questions
A public victim listing tied to Moneymessage names Indigo Energy, but the record does not confirm breach scope, data theft, or downstream impact.
Leak Threat Shakes Fairlife Claim, But the Proof Still Has Not Arrived
A ransomware crew says it has confidential data tied to a Coca-Cola subsidiary, yet the public record still rests on an unverified extortion claim.
When a Healthcare Vendor Bleeds Data, Everyone in the Chain Feels It
Craneware’s disclosure points to a classic exfiltration event: an unauthorized party got into part of its environment and took data tied to employees, customers, partners, and some US healthcare organizations.
Inside Furtex: A Linux Toolkit Built to Stay Close to the Kernel
MatheuZSecurity’s newly announced Furtex package puts raw io_uring and eBPF in the spotlight, showing how post-exploitation tooling can lean on legitimate Linux primitives to pursue stealthier process manipulation and data theft.
When the Help Desk Becomes the Heist Route: EY’s Tax Files and the Vendor Trust Problem
A breach involving a vendor-managed IT support platform shows how sensitive client tax data can travel through a trust boundary that many organizations do not fully see.
Blueprints in the Crosshairs as Interlock Adds a New Victim
A ransomware listing tied to Paragon Store Fixtures points to a familiar extortion pressure point: sensitive business files that can hurt customers, partners, and deal pipelines at once.
Extortion Post Names a Property Firm, but the Data Claim Still Needs Proof
A ransomware-style listing ties arambol.co.uk to M3rx and alleges a large file haul, yet the public evidence still stops at the post itself.
GoSerpent’s Quiet Theft Playbook Put Southeast Asian Diplomats in the Crosshairs
A Go-based backdoor, stolen credentials, and share-based transfer paths point to an espionage workflow built for patience, not noise.
Gallant Name-Checked in a Ransomware Post, but the Incident Picture Is Still Thin
A victim listing tied to Thegentlemen puts the Finnish advisory and accounting firm in view, yet the public record does not confirm breach scope, data theft, or operational disruption.
Chaos Claims a Pharma Intrusion, but the Real Story Is in the Data It Wanted
A new extortion listing tied to Aphena Pharma Solutions points to the value of finance records, even when the alleged breach details remain unverified.
When the Vendor File Breaks, the Retail Brand Feels It
Lidl’s customer data was taken from a separately stored database run by a third-party provider, underscoring how a breach can begin far from the public storefront.
Hidden Code, Big Trust: Why a Chrome Add-On Triggered a Store Removal
Google removed ModHeader from the Chrome Web Store after a security review flagged dormant surveillance behavior and a hidden data exfiltration risk in a browser extension with roughly 900,000 users.
DeadLock’s Latest Name-Check Shows How Ransomware Pressure Starts Before Proof Does
Bridgeport S.p.A. was named in a DeadLock victim publication, but the public record still does not confirm the intrusion path, the scale of any compromise, or whether data was actually taken.
DeadLock’s Municipal Spotlight: Why a City Listing Can Matter Before Any Breach Is Proven
Židlochovice has been named as a DeadLock victim, but the more important question is whether this is a real exfiltration case, a pressure tactic, or both.
Leak-Site Theater Turns Real Estate Records Into Extortion Currency
A Deadlock victim post tied to WiBeats S.r.l. shows how modern ransomware pressure often centers on email archives, contracts, and permits rather than encryption alone.