About
Written by ThreatCluster from 4 storiesmetaeencryptor is a ransomware group that uses an extortion model centered on a public leak site where victims are listed to pressure payment. It has 27 victims claimed, spanning Manufacturing, Business Services, Healthcare, Transportation/Logistics, and Other sectors, with the United States, Germany, Canada, Japan, and South Korea among the most affected countries. As illustrated by the reporting, the pattern shows victims being posted on the leak site; on 2026-09-15 SFA Engineering Corporation (South Korea) and Nippon Steel Corporation (Japan) were listed as victims. Overall, the reporting indicates ongoing focus on manufacturing and related industrial targets across the United States, Germany, Canada, Japan, and South Korea.
Sectors: Healthcare, Aerospace, Energy and Defense, Asset management · Countries: US, DE, CA
Recent victims
View all →| Victim | Sector | Country | Data | Files | Posted | Status |
|---|---|---|---|---|---|---|
| MyMichigan Health mymichigan.org | Healthcare | United States | — | — | Oct 12, 2026 | listed |
| VIATechnik viatechnik.com | AEC industry | United States | 12.5 TB | — | Oct 12, 2026 | listed |
| GE Vernova Inc. gevernova.com | Energy & Utilities | United States | — | — | Sep 25, 2026 | listed |
| PKF Hadiwinata pkfhadiwinata.com | Public accounting / professional services | Indonesia | 1.4 TB | — | Sep 25, 2026 | published |
| Platinum Healthcare Staffing platinumhs.com | Healthcare staffing | United States | 50 GB | — | Sep 25, 2026 | listed |
| Astemo, Ltd. astemo.com | Automotive parts | Japan | 18.109 TB | — | Sep 21, 2026 | listed |
| Hudson MD Group, LLC hudsonmdgroup.com | Healthcare | United States | — | — | Sep 21, 2026 | listed |
| Bruker Corporation bruker.com | Life Science Research and Diagnostics Solutions | United States | 121 GB | — | Sep 21, 2026 | published |
| Flex Ltd flex.com | Technology manufacturing and supply-chain | United States | 365 GB | — | Sep 21, 2026 | published |
| HyVision System. Inc en.hyvision.co.kr | Manufacture of automatic test and measurement equipment for mobile camera modules | South Korea | 80 GB | — | Sep 21, 2026 | published |
| Visual Intelligence, Inc. visualintelligenceinc.com | Telecom | United States | 135 GB | — | Sep 21, 2026 | published |
| Beckman Coulter, Inc beckmancoulter.com | biomedical testing instrument systems and clinical diagnostics | United States | 213 GB | — | Sep 17, 2026 | listed |
| AECOM aecom.com | Infrastructure consulting and engineering | United States | 1.2 TB | — | Sep 17, 2026 | published |
| Promantra, Inc promantra.us | Healthcare technology and business process services | United States | 40 GB | — | Sep 17, 2026 | listed |
| SFA Engineering Corporation sfa.co.kr | industrial automation, robotics, and manufacturing equipment | KR | 70 GB | — | Sep 15, 2026 | listed |
| Nippon Steel Corporation nipponsteel.com | Steelmaking | Japan | 109 GB | — | Sep 15, 2026 | listed |
| EllisDon Corporation ellisdon.com | construction services and technology | Canada | 1.4 TB | 3 | Sep 7, 2026 | published |
| SIFCO Industries INC. sifco.com | Aerospace, Energy and Defense | United States | 251 GB | — | Sep 7, 2026 | listed |
| ST Engineering stenng.com | Technology, defence and engineering | United States | 1064 GB | — | Sep 7, 2026 | listed |
| Hologic, Inc. hologic.com | Medical technology | United States | — | — | Sep 7, 2026 | listed |
| Woodlore International Inc. woodlore.ca | Furniture manufacturing | Canada | 68 GB | 3 | Aug 23, 2026 | listed |
| Trailer Transit Inc trailertransit.com | Logistics / trucking | United States | 8 GB | — | Aug 23, 2026 | listed |
| Weber Water Resources weberwaterresources.com | water resource solutions | United States | 38 GB | 3 | Aug 23, 2026 | published |
| MPA Pharma GmbH mpapharma.com | pharmaceuticals | Germany | 14 TB | 3 | Aug 23, 2026 | listed |
| Aquamar Inc aquamarseafood.com | Seafood (retail and foodservice) | United States | 540 GB | — | Aug 23, 2026 | listed |
Found by ThreatCluster
85 total from our crawlListed on this group's leak site and not present in the aggregated feeds.