Skip to content
Leak-site post naming PennEastern Architects LCC, captured by ThreatCluster

PennEastern Architects LCC

dark project

Ransomware leak-site victim intelligence · EN

Data size
100 GB Data Analyzed
Files
60,000
Views
1,839
Posted
Oct 12, 2026
Countdown
7d 11h 24m 07s
Country
United States
Industry
Architecture

Summary

Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot

The leak claims PennEastern Architects LCC suffered a cyberattack in which more than 100 GB of corporate data was stolen, including drawings, project documentation, customer data, employee data, and banking/financial information; about 60,000 files are unprotected. The leak page lists the victim as PennEastern Architects LCC (United States) with domain penneastern.com and $5 million in revenue, with several named individuals. Publication status is listed, with a countdown of 9d 11h 28m 54s.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
penneastern.com
People named
Paul Pasonick Andrew Pasonick Michael Amato Daryl Pawlush Emil Jarolen Norman Manovsky

What was taken

As a result of a cyberattack on Company PennEastern Architects, more than 100 GB of corporate data was stolen. The breach includes a large volume of confidential information, including drawings and project documentation, data on the company’s customers and employees, as well as documents containing banking and financial information. Currently, approximately 60,000 files are unprotected by Company PennEastern Architects.

Data categories
drawingsproject documentationcustomer dataemployee databanking informationfinancial informationconfidential information

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX_ID
243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Scan of an Indiana operator's license featuring a photo, personal details, and expiration date.
onion leak page104 KB