root@ransomvault:~$ tail -f threat_intel.log

Ransomware

Akira Group Leaks 30GB of Data Allegedly Stolen from Pelham Plastics November 11, 2026

RansomVault Team1 min read

Akira ransomware group has listed Pelham Plastics on its data leak site. Pelham Plastics is a custom plastic engineering company that makes injection molds and custom equipment, mainly for medical applications. The listing was posted on November 11, 2026.

What the group claims
The group says it stole about 30GB of corporate data, including:

  • Employee personal information, including passport and driver’s license scans
  • Confidential internal files
  • Contracts and agreements
  • Client information
  • Non-disclosure agreements (NDAs)

Data already published
This is not just a threat to leak. The listing includes a download link to several archives with no password, so the data appears to be publicly available already. That usually means ransom negotiations either failed or never started.

Verification status
We have not independently verified the contents of the archives. Pelham Plastics has not made a public statement about the incident at the time of writing.

Potential risks

  • Employees: Exposed passport and driver’s license scans create a high risk of identity theft and fraud.
  • Clients and partners: The leaked contracts, NDAs, and client information could expose business relationships and confidential project details. Because the company serves the medical sector, this may include proprietary designs for medical devices and their parts.
  • Supply chain: Threat actors could use the leaked documents to write convincing phishing or invoice-fraud emails aimed at Pelham Plastics’ clients and suppliers.

Recommendations

  • Pelham Plastics’ employees should watch for identity misuse and consider credit monitoring or fraud alerts.
  • Clients and partners should be wary of unexpected emails or payment-detail changes that appear to come from Pelham Plastics, and should confirm any such request through a separate channel they already know.
  • Manufacturers serving the medical sector should review how they store sensitive client and employee documents, and monitor for large outbound data transfers.

We will update this post as more information becomes available.

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

BYOD Ransomware Group Claims Breach of Toyota

Ransomware

The BYOD ransomware group has added Toyota to its data leak site. The post is marked “PSA” and was last updated on November 10, 2026. According to the listing, the stolen data includes: * Full names * Email addresses * Physical addresses * Phone numbers * Dates of birth * Kiosk device data In an unusual remark, the group says that “a lot was actually isolated.” This suggests Toyota’s defenses contained much of the intrusion, but the attackers claim they found “a few cracks” to get thro

Critical Fortinet2Shell Vulnerability

Vulnerability / Patch

Fortinet has warned about a critical flaw in FortiClient that lets a remote attacker run code on a user’s computer. The attacker only needs the user to visit a malicious website. The bug is tracked as CVE-2026-121529 and carries a CVSS score of 9.1. Fortinet published the advisory on November 10, 2026. The issue is an origin validation error, classified as CWE-346. Researcher Kevin Joensen from Baldur Security discovered it during internal research and humorously dubbed it “Fortinet2Shell.” He

Pre-Authentication Authorization Bypass and Command Injection Vulnerabilities in Certain Barracuda Products - Updates Available

Vulnerability / Patch

Barracuda has identified two vulnerabilities affecting certain Barracuda products: a pre-authentication authorization bypass vulnerability and a command injection vulnerability. The vulnerabilities have been assigned CVE-2026-116606 and CVE-2026-111560, respectively. Successful exploitation requires an attacker to have access to the administrative interface of an affected product. If exploited in combination, these vulnerabilities could allow an attacker to bypass authorization controls and o