About
Written by ThreatCluster from 2 storiesbraincipher is a ransomware group whose operations involve ransomware attacks that have claimed 69 victims across multiple sectors. Victims span Technology, Business Services, Manufacturing, Healthcare, and Professional Services, with the most affected countries being the United States, France, Canada, Spain, and the United Kingdom. Recent reporting shows a pattern of cross-sector targeting, illustrated by the September 18, 2026 incident at AECOM where about 1.22 terabytes of data were compromised. Overall, the set of reported activity points to a broad Western footprint across the identified sectors, rather than a concentration in a single industry or country.
Sectors: Technology, Business Services, Manufacturing · Countries: US, FR, CA
Recent victims
View all →| Victim | Sector | Country | Data | Files | Posted | Status |
|---|---|---|---|---|---|---|
| hoyletanner.com hoyletanner.com | Professional Services | GB | — | 33,500 | Sep 17, 2026 | countdown |
| aecom.com aecom.com | Professional Services | US | 670 GB | — | Sep 17, 2026 | countdown |
| xpera.ca xpera.ca | Technology | CA | 20 GB | — | Sep 17, 2026 | countdown |
| icot.es icot.es | Technology | ES | — | — | Aug 31, 2026 | published |
| aeiconsultants.com aeiconsultants.com | Professional Services | US | over 55 GB | 35,000 | Aug 31, 2026 | published |
| syc.es syc.es | Technology | ES | over 40 GB | 57,000 | Aug 31, 2026 | published |
| Adviesbureau De Beuckelaer BV | Professional Services | NL | over 150 GB | 415,000 | Aug 31, 2026 | published |
| ahadandco.com ahadandco.com | Other | AE | over 300 GB | 405,000 | Aug 31, 2026 | published |
| sago.com sago.com | Technology | — | — | Aug 31, 2026 | countdown | |
| crmeyer.com crmeyer.com | Professional Services | DE | over 330 GB | 275,000 | Aug 31, 2026 | published |
| ccsperfusion.com ccsperfusion.com | Healthcare | US | over 200 GB | 306,000 | Aug 31, 2026 | countdown |
| windiam.com windiam.com | Technology | BE | over 250 GB | — | Jul 22, 2026 | published |
| robroy.com robroy.com | Manufacturing | US | — | — | Jul 9, 2026 | published |
| iac-intl.com iac-intl.com | Business Services | US | 1050 GB | — | Jul 9, 2026 | published |
| digitaldynamics.com digitaldynamics.com | Technology | US | — | — | Jul 1, 2026 | published |
| goldenstateortho.com goldenstateortho.com | Healthcare | US | more than 150 GB | — | Jul 1, 2026 | published |
| printronix.com | Manufacturing | US | more than 100 GB | — | Jul 1, 2026 | |
| paipharma.com paipharma.com | Healthcare | BR | — | — | Jun 30, 2026 | published |
| eggetttax.ca eggetttax.ca | Agriculture and Food Production | CA | over 250 GB | — | Jun 22, 2026 | published |
| sterlinggloballtd.com sterlinggloballtd.com | Business Services | GB | 100gb files and documents | — | Jun 22, 2026 | published |
| themintgaming.com themintgaming.com | Consumer Services | — | — | Jun 19, 2026 | published | |
| alu-rex.com alu-rex.com | Manufacturing | AT | 150gb | — | Jun 15, 2026 | published |
| anglomoil.com anglomoil.com | Energy | GB | — | — | Jun 15, 2026 | published |
| squamish.net squamish.net | Not Found | CA | — | — | Jun 1, 2026 | published |
| sheppadviser.com.au sheppadviser.com.au | Business Services | AU | 350GB | — | May 21, 2026 | published |
Found by ThreatCluster
50 total from our crawlListed on this group's leak site and not present in the aggregated feeds.