Leak-site post naming Cook Remodeling, captured by ThreatCluster
Back to victims

Cook Remodeling

global secret group

Ransomware leak-site victim intelligence · EN

Data size
23.2 GB
Files
47,193
Views
47,193
Posted
Aug 11, 2026
Publication
Aug 11, 2026
Country
Arizona, United States
Industry
Construction Management

Summary

Written by ThreatCluster from victim profile, leak post, screenshot

The group claims 23.2 GB of data and 47,193 files were taken from Cook Remodeling & Custom Construction. The leak post lists the publication status as listed. The victim is identified as Cook Remodeling & Custom Construction (cookremodeling.com), a Phoenix, Arizona-based remodeling firm.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Domains
cookremodeling.com

What was taken

Cook Remodeling & Custom Construction is an award-winning design/build home remodeling firm based in Phoenix, Arizona, with nearly 50 years of experience. They specialize in kitchen and bathroom remodeling, whole-house renovations, and outdoor living spaces, ensuring projects are completed on time and within budget. The company emphasizes a personalized approach, helping clients through every step of the renovation process while leveraging their expertise in universal design and green building. Their services cater to homeowners in various East Phoenix Valley cities, aiming to enhance the unique stories of each home.

Data categories
ContractsDatabasesEmailsPII
Leak site tags
ConstructionHome RemodelingUNIVERSAL DESIGN
File types seen
csv × 2pdf × 10xlsx × 5
Sample files (3)
ProjectPlan_Q3.xlsx
ClientList_2026.csv
DesignDrafts_Arizona.pdf

Leak-site images (7)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image contains a screenshot of a spreadsheet with personal information, including names, phone numbers, email addresses, project descriptions, and a scan of an Arizona driver's license.
onion leak page 381 KB
The image contains a table with various columns, including usernames, passwords, and security questions, along with a list of login credentials for different accounts.
onion leak page 323 KB
Screenshot of a spreadsheet containing contact information, including names, phone numbers, and email addresses.
onion leak page 247 KB
Screenshot of an Excel spreadsheet containing financial data with columns for names, principal amounts, total fees, and various monthly totals.
onion leak page 1.2 MB
The image is a certificate of liability insurance, featuring sections for the certificate holder, policy details, and coverage information.
onion leak page 374 KB
The image is a notice document that includes identification details for a construction company, along with a QR code for contractor verification.
onion leak page 219 KB