BRIEFRansomwarehighP80
Redact ransomware publishes US energy firm ONEOK
ONEOK, Inc.
Detected16 October 2026 · 19:56 UTC
The Redact ransomware group listed ONEOK, Inc., a major US oil & gas pipeline and energy operator with ~$39.4B revenue, on its leak site. A confirmed listing signals data theft and potential operational disruption across critical energy infrastructure. Energy-sector defenders should treat this as a live extortion threat and watch for downstream/supply-chain impact.
CategoryRansomware
Severityhigh
Priority score80
Detected16 October 2026 · 19:56 UTC
Ransomware● 48
Ransomware n0n publica al laboratorio dental BladeTech IncThe n0n group listed BladeTech Inc, a Missouri dental laboratory (CAD/CAM), exposing full patient names, case designs, CNC toolpaths and a 4.4 GB production archive dated September-October 2026. PHI leakage triggers HIPAA obligations and downstream patient privacy risk. Recent production files indicate an active, current compromise.Ransomware● 52
Ransomware n0n publica a la constructora Xinos Construction (Nueva York)The n0n group published Xinos Construction Corp, a New York construction firm, claiming exposure of employee W-2 forms with SSNs, 2024 partnership tax returns, the QuickBooks Enterprise archive and a state sales-tax audit file. This is highly sensitive PII and financial data enabling tax fraud and identity theft. Small contractors rarely detect such intrusions quickly.Ransomware● 70
Ransomware Redact publica a Parker-Hannifin CorporationThe Redact group listed Parker-Hannifin, a US industrial-machinery manufacturer with ~$21.5B revenue and a significant aerospace/defense supply-chain footprint. A compromise of such a contractor carries downstream risk to defense programs. Manufacturing defenders and their partners should treat this as a live extortion event and watch for data exposure.Ransomware● 55
Ransomware n0n publica a la clínica EnVision Eye CareRansomware group n0n published US ophthalmology practice EnVision Eye Care, exposing 13,308 patient records with names and dates of birth plus the full 2018-2025 database backup and eye-scan archive. Healthcare data of this depth fuels medical identity theft and extortion. It reflects the ongoing healthcare ransomware wave, though the victim sits outside Latin America.Ransomware● 46
Ransomware pear publica a Solar CommunicationsThe 'pear' ransomware group has listed Solar Communications International, a US supplier of wireless-infrastructure products, as a victim. Telecom and wireless-infrastructure suppliers are sensitive targets given downstream dependencies. Defenders in telecom supply chains should note the claim and monitor for leaked data.Ransomware● 44
Ransomware pear publica a Macfarlan Capital PartnersThe 'pear' ransomware group has published Macfarlan Capital Partners, a US real estate investment firm serving institutional and high-net-worth investors, as a victim. Financial services victims face data theft and extortion with regulatory consequences. Though outside Latin America, it indicates an active extortion campaign.