Skip to content
Leak-site post naming Foss Inc., captured by ThreatCluster

Foss Inc.

pear

Ransomware leak-site victim intelligence · EN

Data size
800 Gb
Posted
Sep 9, 2026
Country
USA
Industry
Civil Engineering Construction

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post

pear states that about 800 Gb of Foss Inc.’s data was taken, including financials, HR, partners' and vendors' data, clients' and customers' data, projects' details, mailboxes and email correspondence, and Dropbox-stored data. Sample filenames published include fossinc.com_fileTree.zip and fossinc.com. The leak page identifies Foss Inc. (domain fossinc.com) as the victim, in the USA Civil Engineering/Construction sector with reported revenue of $45M; named individuals listed are Nathan Downing, Ricky Wills, Steve Richardson, Brandi Pittaro and Brandi Doty. The leak post is published and lists onion download sources.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
fossinc.com
People named
Nathan Downing Ricky Wills Steve Richardson Brandi Pittaro Brandi Doty

What was taken

Leading provider of installation, maintenance services to the energy industry

Data categories
FinancialsHRPartners' & Vendors' DataClients' & Customers' DataProjects' DetailsMailboxes & Email CorrespondenceDropbox Stored Data
File types seen
zip × 1
Sample files (1)
fossinc.com_fileTree.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

downloads
["Download File Tree fossinc.com_fileTree.zip", "Download Data 1 (onion)", "Download Data 2 (onion)"]
download_sources
["http://njqaowdto3tfbbco575fkmhahszxfw7fiprbfmt6y6kfy5fntt45akyd.onion/fossinc.com_fileTree.zip", "http://smnalvhqecyjf7reptunoevh6jd6x7ofpz4tj2plyg5a4q667givgqyd.onion/fossinc.com", "http://3hzi7qjklm632atxj5k67p3bxdie5aipvf6tsbtc2xlfbcellujyxryd.onion/fossinc.com"]

Leak-site images (11)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image contains a stylized logo featuring the letters "FOSS" in a bold, modern font on a black background.
onion leak page16 KB
Logo featuring the word "KOVO" in gray with a blue accent on the right side.
onion leak page17 KB
Logo featuring the text "Edge Chem" in red and blue, with "PAINTS" in yellow at the bottom, set against a grid background.
onion leak page19 KB
Logo of "IslandNet" featuring purple and green colors with a stylized design that includes arrows and a curved line.
onion leak page31 KB
Text logo for "Mogren, Glessner & Ahrens, P.S." with the phrase "Attorneys at Law."
onion leak page25 KB
Logo with the text "First Commerce LLC" in a stylized font.
onion leak page17 KB
Logo featuring the text "Clifton" in large font, with the phrase "Architectural Glass & Metal" below it.
onion leak page26 KB
Logo featuring the text "LOOK BETTER FEEL BETTER" surrounding a stylized monogram "APSI" in the center.
onion leak page30 KB
The image features a stylized logo with a combination of blue and orange colors, incorporating the letters "P" and "C" along with a heartbeat line.
onion leak page62 KB
Logo of Club One Casino with a crown and a three-leaf clover design, featuring the text "CLUB ONE CASINO" and "GRANITE PARK."
onion leak page15 KB

Negotiation

Tox 457BB4E5DF0E650509322CA894758D925A568828090A3449D5AEEED30E9B8E18DDDFF71909ED