Summary
Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom noteBruin Group LLC, a telecom expense management firm, is claimed to have 119.0 MB of data taken across six PDF files, according to the group emperador’s leak page. The leak states the stolen data includes financial and telecom data. The ransom note reportedly demands 1,000,000 in BTC or XMR and promises payment ends the matter; if not paid, the group says it will contact Bruin’s clients with their documents and publish one company at a time; the leak page lists a bruin-export.zip (119.0 MB) for publication and shows the status as published.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
What was taken
Bruin Group LLC is a telecom expense management (TEM) and communications auditing firm. Companies hand them carrier invoices, circuit inventories, wire instructions, letters of authorization, and internal ticket correspondence so Bruin can audit and recover overcharges. Bruin sits on a concentrated pile of third-party financial and telecom data for every client they serve. We have your entire ticket repository. Wire instructions, account numbers, W-9s, EINs, signed LOAs, Tenet patient call traces, all of it, for every client you manage. Tenet. Welltower. USDA. MarineMax. Allegis. Lincare. Salvation Army. Realogy. Delek. Quiktrip. CubeSmart. SRS. Baymark. Partial list.
Ransom note
Published by the group on their leak site, reproduced verbatim.
We have your entire ticket repository. Wire instructions, account numbers, W-9s, EINs, signed LOAs, Tenet patient call traces, all of it, for every client you manage. Tenet. Welltower. USDA. MarineMax. Allegis. Lincare. Salvation Army. Realogy. Delek. Quiktrip. CubeSmart. SRS. Baymark. Partial list. $1,000,000 in BTC or XMR. Pay and it ends. Don't and we contact your clients directly with their own documents, then publish one company at a time.
Also stated on the leak page
Fields this group publishes that do not map to a standard column. Labels are the site's own.
- Session
- 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358
- To Publish
- bruin-export.zip (119.0 MB)
Leak-site images (4)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.