Skip to content
Leak-site post naming The Excalibur Group, captured by ThreatCluster

The Excalibur Group

dark project

Ransomware leak-site victim intelligence · EN

Data size
687 GB Data Analyzed
Files
476,863
Views
111
Posted
Oct 20, 2026
Country
United States
Industry
Defense, IT, Workforce, Environmental, and Legal sectors

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The group claims 687 GB of data were stolen from The Excalibur Group, a Washington, D.C.–based company, including banking and other financial information, personal data of employees and customers, and information marked “secret.” The leak page lists The Excalibur Group as a United States company operating in the defense, IT, workforce, environmental, and legal sectors, headquartered in Washington, D.C., with revenue of $57.3 million. The leak post indicates the publication status is countdown.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

Victim profile

Domains
theexcaliburgroup.com

What was taken

The Excalibur Group is a Washington D.C. based company that focuses on enhancing local, state, and federal programs through staff augmentation, training, and program management in the Defense, IT, Workforce, Environmental, and Legal sectors. They provide specialized job training and placement services for individuals in various industries, including transitioning soldiers. The company also offers both permanent and contingent labor to support clients' internal IT and R&D projects. Their mission is to deliver efficient contract management and cost-effective solutions while promoting meaningful Veteran employment.

Data categories
banking and other financial informationpersonal data of employees and customersinformation marked “secret”

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX_ID
243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a completed USCIS Form I-9 for employment eligibility verification, including personal information and signatures.
onion leak page357 KB