root@ransomvault:~$ tail -f threat_intel.log

RANSOMVAULT

Topics

Patch10Threat Intelligence8Vulnerability7Ransomware3Zero-Day3Malware1Knowledge1
Subscribe to the newsletter →

Ransomware

Akira Group Leaks 30GB of Data Allegedly Stolen from Pelham Plastics November 11, 2026

Darkintel Team1 min read

Akira ransomware group has listed Pelham Plastics on its data leak site. Pelham Plastics is a custom plastic engineering company that makes injection molds and custom equipment, mainly for medical applications. The listing was posted on November 11, 2026.

What the group claims
The group says it stole about 30GB of corporate data, including:

  • Employee personal information, including passport and driver’s license scans
  • Confidential internal files
  • Contracts and agreements
  • Client information
  • Non-disclosure agreements (NDAs)

Data already published
This is not just a threat to leak. The listing includes a download link to several archives with no password, so the data appears to be publicly available already. That usually means ransom negotiations either failed or never started.

Verification status
We have not independently verified the contents of the archives. Pelham Plastics has not made a public statement about the incident at the time of writing.

Potential risks

  • Employees: Exposed passport and driver’s license scans create a high risk of identity theft and fraud.
  • Clients and partners: The leaked contracts, NDAs, and client information could expose business relationships and confidential project details. Because the company serves the medical sector, this may include proprietary designs for medical devices and their parts.
  • Supply chain: Threat actors could use the leaked documents to write convincing phishing or invoice-fraud emails aimed at Pelham Plastics’ clients and suppliers.

Recommendations

  • Pelham Plastics’ employees should watch for identity misuse and consider credit monitoring or fraud alerts.
  • Clients and partners should be wary of unexpected emails or payment-detail changes that appear to come from Pelham Plastics, and should confirm any such request through a separate channel they already know.
  • Manufacturers serving the medical sector should review how they store sensitive client and employee documents, and monitor for large outbound data transfers.

We will update this post as more information becomes available.

ShareXLinkedInReddit

Newsletter

Get the latest cyber news in your inbox

Ransomware, breaches and exploited vulnerabilities, delivered by RansomVault.

Free. No spam. Unsubscribe in one click.

Latest news

How PHP2Shell Works, and Why It Gives Attackers Access Before Your Code Even Runs

Knowledge

PHP2Shell, the pair of critical PHP vulnerabilities tracked as CVE-2026-109618 and CVE-2026-109619, has become one of the most heavily exploited bugs of the year. It was exploited four days before PHP released patches on October 21, added to CISA’s Known Exploited Vulnerabilities catalog, and most recently used to break into Check Point Security Gateways and wipe VMware ESXi hosts. But how does it actually work? This post explains the vulnerability in plain terms, using technical research on th

FAA Grounds All U.S. Flights Over Nationwide Air Traffic Control Communications Failure

Threat Intelligence

On Friday afternoon, the Federal Aviation Administration (FAA) ordered a nationwide ground stop at every U.S. airport, citing "extraordinary circumstances" and safety concerns. U.S. Transportation Secretary Sean Duffy said a communications problem was affecting all Air Route Traffic Control Centers across the country. "FAA technicians are investigating the issue. We will provide immediate updates as we have them," Duffy wrote on X. Departing flights must stay on the ground until further noti

PHP2Shell Attacks on Check Point Gateways Deploy Data Wiper on VMware ESXi Hosts

Zero-Day / Threat Intelligence

Threat actors are exploiting vulnerable Check Point Security Gateways in a campaign that ends with data-wiping malware on VMware ESXi hosts. According to Check Point Research, the attacks began on October 30, 2026, first against Israeli organizations. A single actor ran the whole operation, from initial access to lateral movement and destruction. Background: PHP2Shell PHP2Shell is the name for two critical PHP vulnerabilities, CVE-2026-109618 and CVE-2026-109619, that allow unauthenticated remo