Summary
Written by ThreatClusterfrom site fields, victim profile, leak post, screenshotIncransom states that AHEAD, a Chicago-based IT consulting and engineering firm, is the victim of the incident. The leak page describes AHEAD’s business scope and, per the group’s claims, revenue exceeding $3.7 billion after CDI’s acquisition and more than 2,500 employees across 40 locations. A separate Victim Profile on the page lists revenue as $30 million, creating a discrepancy; the page does not specify what data were taken. The leak post is published and listed on the leak site.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 0
What was taken
AHEAD is a Chicago-based IT consulting and engineering firm specializing in the digital transformation of large enterprises. It offers strategic consulting and managed services across cloud, cybersecurity, data and AI, infrastructure, and operations. The company positions itself as an "engineering-led" partner that takes responsibility for outcomes at every stage — from design to ongoing operations. Following its acquisition of CDI, AHEAD's revenue exceeded $3.7 billion, with a workforce of more than 2,500 employees across 40 locations worldwide.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- city_times
- New York 16:14 pm; Los Angeles 13:14 pm; London 21:14 pm; Paris 22:14 pm; Moscow 23:14 pm; Beijing 04:14 am; Tokyo 05:14 am
Leak-site images (1)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.