Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot, ransom note, our reportingThe emperador group claims it stole an OnTrac employee database, totaling 44.4 MB across two CSV files (sample.csv and ontrac_employees_MASTER.csv) containing about 197,000 employee PII records. The ransom note demands 1 million and threatens to publicly post the data unless paid; it provides contact emails and instructions. The leak post is listed on the group’s site.
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Domains
- ontrac.com
What was taken
OnTrac is a major last-mile e-commerce delivery company formed by the 2021 merger of LaserShip and OnTrac. It positions itself as a direct alternative to FedEx and UPS, offering coast-to-coast coverage, 7-day-a-week operations, and competitive rates to reach over 75% of the U.S. population.
Ransom note
Published by the group on their leak site, reproduced verbatim.
We hold your full employee database, 197k records of employee PII: employeeNumber, xrefCode, firstName,middleName, lastName, loginId, employeeId, hireDate, originalHireDate, startDate, terminated, roles, legalEntity, legalEntityAddress, homePhone, mobilePhone, businessPhone, businessMobile, pager, personalFax, personalEmail, businessEmail, facebook, linkedin, addressPrimary1, addressPrimary2, addressMailing1, addressMailing2, userApproved, nativeAuth, culture & more. We demand an amount of $1M USD in XMR, otherwise your data WILL be publicly posted. Instructions will be emailed to you shortly. If you do not receive them, contact me on session, or email me. Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358 Email: [email protected], [email protected] (I prefer session.) If you do not cooperate, your partners and employees will be targeted, we will also sell the data to interested parties. Emails were sent to: [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Leak-site images (3)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.