Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshotThe leak states that Benshaw, Inc. (Pittsburgh) and affiliated UTG entities had data exfiltrated, including HR and recruitment records, payroll data (Canada), financials and bank details, ACH/NACHA files, oil and gas customer job packs, and UEdit source with a hardcoded XOR key 4148865678 and a date-based CalcBackDoor. The leak page shows a data publishing countdown of 8 days, 2 hours, 25 minutes, 53 seconds. The victim is identified as Benshaw, Inc., a Pittsburgh manufacturer, with UEdit listed as the platform.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Employees
- 0
- Domains
- benshaw.com
- Platforms
- Concur ADP UEdit
What was taken
Benshaw, Inc. (Pittsburgh) and affiliated UTG entities (Unico, Benshaw Canada, AuCom, Excel, Noble Victoria). Content verification confirms: ~100+ corporate Visa/PCard records with full PAN + SSN + DOB + home address; 637 former employees with full SSN/DOB/address on one spreadsheet; 88 active employee folders plus multi-year Canada payroll; State tax-portal passwords in cleartext Excel; Concur + ADP passwords in a Word document; Global bank account numbers; ACH NACHA files with vendor routing/account numbers; UEdit source with hardcoded XOR key 4148865678 and date-based CalcBackDoor(); Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC…).
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- Data Publishing
- 0 days : 15 hours : 29 min : 05 sec
- Data Publishing Countdown
- 8 days : 02 hours : 25 min : 53 sec
- Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC…)
- Oil & gas customer job packs (Chevron, Petrobras, EOG, Santos AU, KOC…)
Leak-site images (1)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.