Skip to content
Leak-site post naming sunshine-mills, captured by ThreatCluster

sunshine-mills

iah6477

Ransomware leak-site victim intelligence

Data size
130.1 GiB + 9.6 MiB
Files
223,743
Posted
Oct 15, 2026
Countdown
hosted until 2027-10-15 12:35 UTC · 343d 20h left
Industry
Agriculture and Food Production

Summary

Written by ThreatClusterfrom leak post, screenshot

The iah6477 leak post claims Sunshine-Mills is the victim and that 130.1 GiB across 223,743 files are claimed to have been stolen. The leak states the data types include HR and recruitment records, internal documentation and source code. Publication status is listed, and the post shows a countdown of 364 days 8 hours.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

archive: PUBLIC · free download

File types seen
zip × 4
Sample files (4)
sunshine-mills-part1of4.zip
sunshine-mills-part2of4.zip
sunshine-mills-part3of4.zip
sunshine-mills-part4of4.zip

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

archive: PUBLIC · free download
present
hosted until 2027-10-15 12:35 UTC
354d 3h left
archive: PUBLIC · free download hosted until 2027-10-15 12:35 UTC · 357d 23h lef
present

Leak-site images (1)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture