Skip to content
Leak-site post naming AmSpec, captured by ThreatCluster

AmSpec

helix

Ransomware leak-site victim intelligence

Data size
Tier 1: 1019.2 MB; Tier 2: 208.83 GB; Tier 3: 120.88 GB; Tie
Files
814,528
Posted
Aug 22, 2026
Countdown
00 Days 00 Hours 00 Mins 00 Secs
Country
US
Industry
Energy & Utilities

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

Helix claims to have stolen 331.75 GB from AmSpec, comprising 814,528 files across four password-protected 7z archives named AmSpec_T1.7z, AmSpec_T2.7z, AmSpec_T3.7z and AmSpec_T4.7z. The leak page states the data is hosted on GoFile and SharePoint, with each archive passworded. The publication status is published, and the countdown on the page shows zero.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Platforms
SharePoint GoFile

What was taken

AmSpec is live. T1 unlocks on the current 24-hour cadence, then 24 hours per remaining tier.

Data categories
Mailbox / AttachmentsMailbox / EmailsAmspecllc / Lab LocationsAmspecllc / Brand IdentityAmspecllc / Client Marketing ReportsAmspecllc / Shipping Dangerous GoodsOther small sitesAmspecllc / HSE REFERENCE DOCUMENT LISTOneDrive / DocumentsAmspecllc / Quality ManualsAmspecllc / Legal And ComplianceOldSept2024EPACompliance / DocumentsEPACompliance / Gasoline Compliance DataARA / Quality Management SystemQSHEAmSpecEurope / DocumentsEPACompliance / 2025 NSTOPEPACompliance / 2024 NSTOPGestindecalidadAmSpecISO9001 / DocumentosEPACompliance / 2023 NSTOPEPACompliance / 2022 NSTOPEPACompliance / Attest 2022AmspecKwinanaLab / DocumentsEPACompliance / 2026 NSTOPEPACompliance / Attest 2024
File types seen
7z × 4
Sample files (4)
AmSpec_T1.7z
AmSpec_T2.7z
AmSpec_T3.7z
AmSpec_T4.7z

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Password
["AmSpec_T1.7z · 1019.2 MB · passworded .7z", "AmSpec_T2.7z · 208.83 GB · passworded .7z", "AmSpec_T3.7z · 120.88 GB · passworded .7z", "AmSpec_T4.7z · 1.02 GB · passworded .7z"]

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture