Skip to content
Leak-site post naming Nexbex Solutions Private Limited, captured by ThreatCluster

Nexbex Solutions Private Limited

emperador

Ransomware leak-site victim intelligence · EN

Data size
600.0 MB
Files
1
Views
23,967
Posted
Sep 11, 2026
Country
India
Industry
Technology consulting and software engineering

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, our reporting

Emperador group's leak claims about 600 MB of Nexbex Solutions Private Limited's databases were taken in a single-file release (DB_sql.zip), containing names, emails, phone numbers and addresses. The victim is Nexbex Solutions Private Limited, described by the leak as an India-based technology consulting and software engineering firm headquartered in Malappuram, Kerala. Publication status on the leak page is listed.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Employees
0
Founded
2023
Domains
club7ms.com rayssportsnetwork.com hwzthat.com
Platforms
Nexi Paints Grace Petroleum

What was taken

Since there has been no response regarding the data breach, the data is being sold; you know you don't have all of it. If you don't buy it, I will sell it to the competition or publish it on various forums. Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc.

Data categories
namesemailsphone numbersaddresses
File types seen
zip × 1
Sample files (1)
DB_sql.zip

Ransom note

Published by the group on their leak site, reproduced verbatim.

Since there has been no response regarding the data breach, the data is being sold; you know you don't have all of it. If you don't buy it, I will sell it to the competition or publish it on various forums.

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Notes
We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc.
Domains
club7ms.com, rayssportsnetwork.com, hwzthat.com, etc.
Summary
We have the source code for all 200+ of their projects. 10 GB +. including its website. going up.
domains
club7ms.com, rayssportsnetwork.com, hwzthat.com, etc.
Subdomains
staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle, admin.bookings-staging, backend.academy, admin.spike.booking, etc.
To Publish
DB_sql.zip (600.0 MB)
Source code
We have the source code for all 200+ of their projects. 10 GB +. including its website. going up.
Subdomains Type
staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle
paid-up capital
10 million Indian rupees (₹10 Lakhs)
Admin Subdomains
admin.bookings-staging, backend.academy, admin.spike.booking, etc.
Data exposure claim
We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB.
Source code for all 200+ of their projects
10 GB + including its website; going up.
Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc.
present
We have the source code for all 200+ of their projects. 10 GB +. including its w
present

Leak-site images (4)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a stylized red logo with angular shapes resembling a mask or a face, set against a white background.
onion leak page1.2 MB
Directory listing of names and email addresses, along with associated usernames and some additional data.
onion leak page370 KB
Directory listing of files with various .tar.gz and .php extensions, including timestamps and file sizes.
onion leak page433 KB