BRIEFRansomwarelowP43
Doommageddon ransomware publishes Turkish law firm Koray Topaç
Koray Topaç Hukuk Bürosu
Detected13 November 2026 · 12:14 UTC
The doommageddon ransomware group lists Koray Topaç Hukuk Bürosu, a Turkish law firm, as a victim currently under negotiation with a deadline of 2026-11-20. Law firms hold sensitive client, litigation and corporate data, making them attractive extortion targets and a source of downstream leaks affecting their clients. Firms and their corporate clients should watch for publication and prepare for potential data exposure.
CategoryRansomware
Severitylow
Priority score43
Detected13 November 2026 · 12:14 UTC
RansomwarePriority 46
Ransomware emperador publica a la fabricante de semiconductores CarsemThe emperador ransomware group has added Carsem, a major Malaysian semiconductor packaging and test provider, to its leak site and threatens to publish stolen data samples within three days. Semiconductor suppliers sit in high-value supply chains, so a data-extortion event here can expose partner and customer information. Organizations in the electronics supply chain should assess third-party exposure and monitor the leak page.RansomwarePriority 44
Ransomware safepay publica a la manufacturera Toyokiki TailandiaThe safepay ransomware group listed Toyokiki Thailand, a manufacturing and processing subsidiary of Japan's Toyokiki Industrial, on its leak site. Scale and data types are not yet disclosed, so impact appears limited to this regional subsidiary. Still worth tracking for supply-chain and industrial-sector defenders monitoring the group.RansomwarePriority 68
Ransomware incransom publica a la ingeniería aeroespacial AXISCADESThe incransom group listed AXISCADES, an aerospace, defence and heavy-engineering solutions provider, claiming a leak of over 6.6 TB of confidential data. The claimed haul includes proprietary software, client projects, computational models, personal data and machine-learning scripts. Defence and engineering supply-chain exposure of this scale matters for downstream government and industrial customers even outside the region.RansomwarePriority 54
Ransomware Curious Worm publica a Benchmark Senior LivingThe Curious Worm ransomware group listed Benchmark Senior Living, a large U.S. senior-care operator with roughly $330M in revenue, and marked its data as leaked. This healthcare-adjacent provider likely holds resident, medical and employee information that is especially sensitive. Healthcare operators should review third-party access and monitor for phishing using leaked contacts.RansomwarePriority 57
Ransomware Aoqin publica a la aerolínea pakistaní AirblueThe Aoqin ransomware group listed Airblue, a private Pakistani airline serving domestic and Gulf routes, on its leak site and marked the victim as 'not paid', with data publication referenced around late November 2026. Airline operational and passenger data is high-value and time-sensitive. Aviation and travel-sector defenders should assess exposure and monitor for related phishing.RansomwarePriority 50
Ransomware Panzer publica al Ministerio de Salud de MalasiaThe Panzer ransomware group listed the Ministry of Health of Malaysia, a government and defense sector victim, on its leak site. Government health data is highly sensitive and disruption to public health systems can directly affect citizens. Public-sector defenders should verify exposure and harden backups and identity controls.