About
Written by ThreatCluster from 2 storiesbraincipher is a ransomware group whose operations involve ransomware attacks that have claimed 69 victims across multiple sectors. Victims span Technology, Business Services, Manufacturing, Healthcare, and Professional Services, with the most affected countries being the United States, France, Canada, Spain, and the United Kingdom. Recent reporting shows a pattern of cross-sector targeting, illustrated by the September 18, 2026 incident at AECOM where about 1.22 terabytes of data were compromised. Overall, the set of reported activity points to a broad Western footprint across the identified sectors, rather than a concentration in a single industry or country.
Sectors: Technology, Healthcare, Manufacturing · Countries: US, CA, GB
Recent victims
View all →| Victim | Sector | Country | Data | Files | Posted | Status |
|---|---|---|---|---|---|---|
| fbc.ca fbc.ca | Financial Services | CA | 174k files with a total size of over 73GB, including: Client | — | Nov 4, 2026 | countdown |
| hamiltonhealthcenter.com hamiltonhealthcenter.com | Healthcare | CA | — | — | Nov 4, 2026 | countdown |
| hhjcpa.com hhjcpa.com | Professional Services | US | 180,500 files with a total size of over 305GB, including: SS | — | Nov 4, 2026 | countdown |
| prairieridge.net prairieridge.net | Agriculture and Food Production | US | — | — | Nov 4, 2026 | countdown |
| ciscocems.com ciscocems.com | Technology | US | 243,500 files with a total size of over 170GB. Contents: ins | — | Nov 4, 2026 | countdown |
| parkell.com parkell.com | Healthcare | US | 65GB data. Contents: project structures, employee names, reg | — | Nov 4, 2026 | countdown |
| tritonclaims.com tritonclaims.com | Financial Services | US | — | — | Nov 4, 2026 | countdown |
| cadorath.com cadorath.com | Not Found | DE | 100,000 files with a total size of over 95GB. If you think y | — | Nov 4, 2026 | countdown |
| spearcenter.com spearcenter.com | Professional Services | US | 89,500 files with a total size of over 40GB. Contents: 1) Me | — | Nov 4, 2026 | countdown |
| myronl.com myronl.com | Not Found | 410 GB of data, including: 1) drawings, Gerber files, SolidW | — | Nov 4, 2026 | countdown | |
| megastarfinancial.com megastarfinancial.com | Financial Services | — | — | Nov 4, 2026 | countdown | |
| novagroupgbc.com novagroupgbc.com | Other | GB | 70GB | — | Oct 21, 2026 | published |
| oflaherty-law.com oflaherty-law.com | Professional Services | IE | 32GB | — | Oct 21, 2026 | published |
| clinicaromero.com clinicaromero.com | Healthcare | AR | — | 16,000 | Oct 21, 2026 | published |
| sodali.com sodali.com | Professional Services | US | — | 13,000 | Oct 21, 2026 | countdown |
| srsnodgrass.com srsnodgrass.com | Professional Services | US | 100GB, 45,000 documents | 45,000 | Oct 21, 2026 | published |
| prosomnus.com prosomnus.com | Healthcare | US | 100GB | 78,000 | Oct 21, 2026 | countdown |
| olyortho.com olyortho.com | Healthcare | US | 105GB, 146,000 files | 146,000 | Oct 21, 2026 | countdown |
| mvjllp.com mvjllp.com | law firm | 1.66TB | — | Oct 21, 2026 | countdown | |
| huntcompanies.com huntcompanies.com | Not Found | US | We have 80 GB of data. | — | Oct 11, 2026 | published |
| latitudesubro.com latitudesubro.com | Manufacturing | BR | approximately 50 GB | — | Sep 29, 2026 | published |
| trailerbridge.com trailerbridge.com | Transportation | US | — | 76,200 | Sep 29, 2026 | published |
| mccordclaims.com mccordclaims.com | Healthcare and insurance | US | — | 78,400 | Sep 29, 2026 | published |
| goriteway.com goriteway.com | Not Found | US | 20.5 GB | — | Sep 29, 2026 | published |
| northeastrehab.com northeastrehab.com | Healthcare | US | — | 13,000 | Sep 29, 2026 | published |
Found by ThreatCluster
105 total from our crawlListed on this group's leak site and not present in the aggregated feeds.