Summary
Written by ThreatClusterfrom file listing, victim profile, leak post, screenshot, ransom noteEverest states that UNIRITA’s dataset has been exfiltrated, totaling 127.964 GB across 159,901 files, comprising personal data (employee evaluations, personnel identifiers, management comments, promotion-related material) and commercially sensitive records (customer prices, supplier charges, internal cost estimates, project acceptance documents). Sample filenames published include 20180402 1747 Office Lens.pdf and 20180402 2014 Office Lens.pdf. The leak post is published and shows a countdown timer; the ransom note states the files will be published after the timer ends. Victim profile on the leak page identifies UNIRITA as a Japan-based software and IT services company (domain unirita.co.jp).
Describes what the group claims on its leak site. A listing is not confirmation that a breach occurred.
Victim profile
- Platforms
- C C++ JavaScript VBA Assembler Java
What was taken
The UNIRITA dataset contains 159,901 files in 22,338 folders, occupying 127.964 GB. It combines corporate records, contracts, product engineering, customer implementation material, quality assurance, personnel assessments, structured application data and selected correspondence. The dated business material extends from historical development and company administration to internal documents prepared for September 2026. The software content includes readable C, C++, JavaScript, VBA and assembler implementations, Java test projects, build definitions, product packages, application repositories, technical specifications and retained test results. UNIRITA, BSP, BSP Solutions and related entities appear as developers, service providers, distributors and licensors in different parts of the records. Their own engineering material coexists with supplier programs, open-source dependencies, training exercises and demonstration data.
Ransom note
Published by the group on their leak site, reproduced verbatim.
The files will be published after the timer counts down. The company still has time to get in touch with us This post unlocks when the timer ends.
Leak-site images (11)
Images from the victim's leak listing. Thumbnails scraped from the onion page are blurred by default — click a thumbnail to view.