Skip to content
Leak-site post naming The Metropolitan Entertainment & Convention Authority, captured by ThreatCluster

The Metropolitan Entertainment & Convention Authority

dark project

Ransomware leak-site victim intelligence

Data size
554 GB Data Analyzed
Files
100,000
Views
5,863
Posted
Aug 5, 2026
Country
United States
Industry
Public event venues management

Summary

Written by ThreatClusterfrom site fields, file listing, victim profile, leak post, screenshot

The dark project group claims that approximately 1 TB of Ruhrpumpen data was leaked in a cyberattack, consisting of 116,438 files and including personal and financial information. The leak post is published on the group’s site. The leak page identifies Ruhrpumpen as the victim—a Mexico-based manufacturing company with $350 million in revenue—and shows 3,059 views.

Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.

What was taken

As a result of a successful cyberattack on the company, MECA suffered damage; more than 500 GB of confidential information was stolen, specifically the company’s customer data, important financial documents, and the personal data of the organization’s employees. About 100 000 files are not secured by domain for now.

Data categories
customer datafinancial documentspersonal data of employees

Also stated on the leak page

Fields this group publishes that do not map to a standard column. Labels are the site's own.

TOX_ID
243AAD0D1875CA4D48034E799785F2C9EA225E4466C87FA9B9297F7BEADC694478C7DE0A7639
data_leak_link
http://667k2ck7qlzoqt52i6dq7evcfzko2ezfrhgv6zziccjet2cc653kvbid.onion/

Leak-site images (2)

Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.

ThreatCluster capture
Screenshot of a financial statement summary from Wells Fargo, detailing account values, balances, and transaction summaries for a specific period.
onion leak page600 KB

Negotiation

Open