Threat Watch · Sep 3, 2026

Law firms come up repeatedly in this window: SilentRansomGroup — logged as leakeddata on RansomLook — posted the US multinational firm Greenberg Traurig, a day after the same operation listed Holland & Knight, while Deadlock posted the Virginia family-law practice Shaheen Law Group. Firms of this kind hold merger, litigation and regulatory files in one place, which makes the targeting direction more notable than any single claim.

Group Activity

Inc Ransom — 7 new claims

The day's volume leader, spanning mid-sized industrial firms and public-service bodies across four countries: Panamanian steel and construction supplier Metales Panamericanos, Spanish asphalt and road-works contractor Asfaltos y Pavimentos (Asfalpasa), Canadian glass manufacturer Multiver Ltée, transport and logistics firm Trucka, US linen services company Specialty Textile Services, and two public-service organisations — Westfield Public School District in the US and Policlinico Triestino, a private healthcare network in Trieste, Italy, which runs hospitals, nursing homes and outpatient clinics. Both trackers logged the same set independently.

Sources: RansomLook · ransomware.live

Akira — 3 new claims

Pennsylvania structural steel fabricator PennFab, industrial input-systems and front-panel maker Algra Group, and ScrubaDub Auto Wash Centers, a New England car wash chain with over 20 locations across Massachusetts, New Hampshire, Maine and Rhode Island. The ScrubaDub post states that corporate data will be uploaded and names employee personal information among it. All three appear on both trackers.

Sources: RansomLook · ransomware.live

Direwolf — 2 new claims

PTT Oil and Retail Business, the fuel and retail arm of Thailand's PTT group, and Cartrack Holdings, a fleet-management and vehicle-tracking provider. Both are recorded independently by the two trackers, categorised as chemicals and software respectively.

Sources: RansomLook · ransomware.live

Eclipse — 2 new claims

Royal Plaza on Scotts, a five-star hotel on Singapore's Orchard Road, and part1.simplexengg.in, a subdomain of an Indian engineering firm.

Sources: RansomLook · ransomware.live

Notable Targets

SilentRansomGroup claims Greenberg Traurig

A large US-headquartered multinational law firm working across corporate law, real estate, litigation, intellectual property and government affairs. RansomLook files the claim under leakeddata while ransomware.live files it under SilentRansomGroup — the same bookkeeping split that appeared when the group listed Holland & Knight a day earlier, and neither tracker explains the naming discrepancy. The claim's contents are marked as pending disclosure.

Sources: RansomLook · ransomware.live

Deadlock claims Shaheen Law Group

A family law firm in Richmond, Virginia, established in 1995, with 48 employees across four offices in Richmond, Midlothian, Virginia Beach and Newport News. Family law case files routinely contain financial disclosures and information about minors.

Sources: RansomLook

Wallstreet claims Ormond Beach, Florida

The municipal government of a coastal city just north of Daytona Beach.

Sources: RansomLook · ransomware.live

Kairos claims Ville de Libercourt

The commune government of Libercourt in the Pas-de-Calais department of France's Hauts-de-France region. With the previous entry, this window carries two local governments and a US public school district.

Sources: RansomLook · ransomware.live

Payoutsking claims Proliance Surgeons

A large physician-owned surgical group based in Washington State, bringing together hundreds of independent surgeons across dozens of specialties including orthopedics, general surgery and sports medicine. In the same window, Insomnia claimed a medical centre with nine locations, its name redacted on the tracker, offering dentistry, imaging, mammography, lab testing and mental health counselling.

Sources: RansomLook · ransomware.live

The Gentlemen claim Leo Schachter Diamonds

A family diamond house founded in 1952, now in its fourth generation, a De Beers sightholder for over 60 years. Its branded diamond THE LEO is sold through roughly 2,000 stores including Kay and Jared, and it operates one of Botswana's largest cutting factories.

Sources: RansomLook

meowciety403 claims a UAE foreign-exchange brokerage

The post claims internal documents, 216 PDF files, HR management and legal material, daily corporate action reports, and explicitly lists API keys. Keys inside the dump mean the exposure does not end with the data itself.

Sources: RansomLook

All of the above are claims published by the groups themselves, not confirmed intrusions. Both trackers mirror the groups' own leak sites; where the text says both recorded a claim independently, that is the only cross-check available here.