Skip to content
Leak-site post naming JS Constructor, INC, captured by ThreatCluster
Back to victims

JS Constructor, INC

emperador

Ransomware leak-site victim intelligence · EN

Data size
153.0 GB
Views
6,032
Posted
Oct 23, 2026
Country
Philippines
Industry
recruitment and overseas employment

Summary

Written by ThreatClusterfrom leak post

The group claims 153.0 GB of data was exfiltrated from JS Contractor Inc., described as a Philippine recruitment and manpower agency. The leak page on the group's site lists the publication status as listed and identifies JS Contractor Inc. as the victim. These statements are presented as the group's claims; no independent verification is provided here.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Founded
1977
Domains
www.jscon.com.ph

What was taken

JS Contractor Inc. is a Philippine recruitment and manpower agency that specializes in recruiting, screening, processing, and deploying Filipino workers for overseas employment. Established in 1977, the company connects qualified applicants with international employers across industries such as manufacturing, engineering, technical services, and skilled labor. Through its website, applicants can explore job opportunities, submit applications, and access information about overseas employment.

Data categories
resumesvaccination recordsapplicant informationPI dataSPI data
File types seen
zip × 5
Sample files (5)
SAMPLES.zip
VACC_DIR.zip
doc_dir.zip
JSCON.COM.PH_DATABASE.zip
DOC_DIR_2026.zip

Ransom note

Published by the group on their leak site, reproduced verbatim.

We have all your critical files, encrypted with the strongest encryption, along with over 150,000 resumes and applicants' vaccination records. This includes 3.5 GB of your databases containing sensitive applicant information. PI and SPI data. A total of millions.
Contact us, or we will publish your applicants' data and critical files. Other threat actors will use it for identity theft and other crimes. We will ensure your company's reputation will be in hell. Your business integrity will be compromised. Loss of stakeholders will follow. And the company's credibility will be damaged. This will be your downfall.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

session
05690c095fbbc61a04e6bdb09d92c535f4866f571db2e2d54e31bbb245ac886d43

Leak-site images (8)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a stylized red logo resembling a geometric figure with sharp angles and a central emblem that suggests a face or mask.
onion leak page1.2 MB
The image is a resume featuring personal information, education, work experience, and professional skills of an individual.
onion leak page575 KB
Document containing a resume with sections for personal background, objective, and educational background, including details like name, date of birth, and school information.
onion leak page273 KB
Screenshot of a spreadsheet containing columns with headers such as Name, Address, Phone Number, and various personal details.
onion leak page1.2 MB
Grid of various document thumbnails, including scanned forms, screenshots, and multiple PDF icons, with some images of individuals.
onion leak page2.6 MB
The image is a COVID-19 vaccination certificate featuring a QR code, personal details, vaccination dates, and information about the vaccine administered.
onion leak page344 KB
The image is a COVID-19 vaccination certificate featuring a QR code, personal details, vaccination dates, and manufacturer information for the vaccines administered.
onion leak page322 KB

Negotiation
Onion emprdr4p7iwlhpky33tswt3k2qdeljyjcdpoysabudmmrz4z32laexad.onion
emprdrcfhpvym7uwqvxky6ympquibzxfxuor6qeexk7lz3sxz5t2ubqd.onion/client