Skip to content
Leak-site post naming SiteProRentals, captured by ThreatCluster
Back to victims

SiteProRentals

emperador

Ransomware leak-site victim intelligence · EN

Data size
6.2 MB
Views
1,510
Posted
Sep 28, 2026
Industry
Hospitality

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot, ransom note

The emperador group claims it stole 6.2 MB of data from SitePro Rentals, a Texas-based construction and industrial equipment rental company. They state the data includes Social Security numbers, home addresses, birth dates, salaries, and pay records—claiming about 338,000 pay records—and publish sample files named sample1.csv, sample2.csv, and sample3.csv. The ransom note claims the ransom is relatively small—$150,000 USD in Monero—and says an email with instructions will follow. The leak page lists SitePro Rentals’ domain (siteprorentals.com) and Texas headquarters, and the post is published.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Founded
2021
Domains
siteprorentals.com

What was taken

SitePro Rentals is a Texas-based construction and industrial equipment rental company founded in 2021. A subsidiary of Sammons Industrial, it rents aerial lifts, forklifts, and earthmoving equipment, serving contractors across the U.S. from over 30 locations. We have every employee's Social Security number. Home addresses. Birth dates. Salaries. We know who's sick, who'S on leave, who got fired and why. We also have 338,000 pay records.... Shortly, you will receive an email containing the instructions on how to proceed with this situation. The ransom is relatively small, just $150k USD in XMR...

Data categories
Social Security numbershome addressesbirth datessalariespay records
Leak site tags
Sammons Industrial
File types seen
csv × 3
Sample files (3)
sample1.csv
sample2.csv
sample3.csv

Ransom note

Published by the group on their leak site, reproduced verbatim.

SitePro Rentals is a Texas-based construction and industrial equipment rental company founded in 2021. A subsidiary of Sammons Industrial, it rents aerial lifts, forklifts, and earthmoving equipment, serving contractors across the U.S. from over 30 locations.
We have every employee's Social Security number. Home addresses. Birth dates. Salaries. We know who's sick, who’s on leave, who got fired and why. We also have 338,000 pay records....
Shortly, you will receive an email containing the instructions on how to proceed with this situation.
The ransom is relatively small, just $150k USD in XMR...
If you do not receive the email, contact us at:
Email: [email protected]
Session: 05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

Session
05651c7323273b723588d47455471ee9e27feb5187a30f2933554a705aacb38358

Leak-site images (3)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
The image features a stylized red logo with angular shapes resembling a hooded figure or mask.
onion leak page1.2 MB
Screenshot of a terminal displaying a CSV file with employee data, including names and dates.
onion leak page567 KB

Negotiation
Email [email protected]