Ransomware Weekly, 11–17 Oct 2026: N0n Lists 19.6M Inter Records; Clop’s ITK Claim Scores Zero

Also this week: Breaches Weekly, 11–17 Oct 2026: 236M Manchester Airport rows, 66.7M Loozap records and 42.1M Airtel rows.

Covers leaks indexed by HaveIBeenRansom between 2026-10-11 00:00 and 2026-10-17 23:59 UTC. Each case shows when it was listed and when its data became searchable. How we pick cases, read records and score attribution: methodology.

Why these three

This week’s ransomware selection is a study in why a listing and its data are not the same thing. N0n’s Inter listing is the largest eligible ransomware dataset at 19,642,762 indexed records and the metadata strongly links it to the named organisation. Clop’s ITK Holding entry is nearly as large, but its attribution score is 0/100 because the available signals point elsewhere. Insomnia’s Metro Tulsa Foot listing is smaller at 4,323,430 records, yet 142,487 indexed email addresses and a strongly personal email mix make it the most directly people-facing of the three. All three remain actor claims, not confirmed incidents.

Key findings

The attribution scores are heuristic estimates of how strongly the indexed data supports the announced organisation. They are not probabilities and do not prove that an intrusion occurred. HIBR had not marked any of these incidents as confirmed when the metadata was collected.

1 · Inter (listed by N0n)

HIBR entry: Inter on HaveIBeenRansom

What happened. N0n listed Inter, described in the post as a Venezuelan internet provider, on 18 September. HIBR made the associated dataset searchable on 12 October, placing it inside this edition’s indexing window. This wording matters: the observable fact is that N0n published a listing and HIBR indexed data attached to it. We did not collect a statement from Inter confirming the incident.

Scale. HIBR reports 19,642,762 indexed records. Only 583 records were classified as containing an email address, so the record count should not be read as 19.6 million distinct people or accounts. The metadata shows 17,914,994 CSV records and 1,727,768 JSON records across eight CSV and 168 JSON source files. That distribution suggests a structured collection, but the metadata alone does not establish what every row represents.

What the data contains. The defensible statement is limited to the formats and aggregate email analysis exposed by HIBR. No identity documents were classified. We did not inspect or reproduce personal values. The sparse email rate—about 0.003% of records—means email-centric monitoring catches only a small slice of this indexed material; defenders should not use email counts as a proxy for total exposure.

Corporate vs Personal. Of the 583 email-bearing records, 544 were classified as corporate and 39 as personal. Corporate domains were led by inter.com.ve at 70.59% of that class, followed by corp.intercable.com.ve at 5.88%. Personal addresses were led by Gmail at 41.03% and Yahoo at 30.77%. These are aggregates, not a sample of addresses.

Attribution confidence: 100/100 (high). The v2.0 heuristic awarded the full evaluated score: the declared Inter domain supplied 375 of 428 effective organisation-domain addresses, and organisation labels appeared across the content. However, only 55 points were evaluable; data-nature review and external corroboration were still pending. High dataset linkage is not incident confirmation.

Why it stands out this week. It pairs the week’s largest ransomware record count with strong internal dataset-to-organisation signals. That makes it the most defensible case for organisation-specific triage, while the lack of independent confirmation keeps the public wording at “listed” and “claimed.”

2 · ITK Holding (listed by Clop)

HIBR entry: ITK Holding on HaveIBeenRansom

What happened. Clop listed ITKHOLDING.HU on 12 August; HIBR indexed the associated data on 15 October. The time between listing and indexing is not the story. The material fact is that 10.7 million records entered the searchable index this week and the dataset-to-name linkage is exceptionally weak.

Scale. HIBR reports 10,739,125 indexed CSV records, plus aggregate file counts for three document files and one XML file. Only 79 records were classified as email-bearing. That is less than one thousandth of one percent of the indexed record count, another warning against equating “records” with unique affected people.

What the data contains. HIBR’s metadata exposes CSV, document and XML categories, but it does not justify describing specific business records or personal fields. No identity documents were classified. The low email count and the concentration in other corporate domains are the central observable signals.

Corporate vs Personal. Seventy-eight of 79 email-bearing records were classified as corporate. Within that class, intertanker.hu accounted for 69.23% and intertraction-electrics.hu for 25.64%; the declared itkholding.hu domain contributed none. The single personal address was classified as Gmail. This is not evidence that the other organisations experienced an incident; it is evidence that the indexed email footprint does not support the announced name.

Attribution confidence: 0/100 (very low). The heuristic found no declared-domain addresses and no matching organisation label. A third-party concentration penalty applied because intertanker.hu dominated the effective corporate addresses. This is the sharpest analytical finding of the week: a large dataset can still be a poor match for the label placed on it.

Why it stands out this week. It is a practical false-positive lesson. Security teams should not escalate solely because a famous ransomware brand and a large number appear together. Validate organisation domains, paths and content signals before opening a high-severity incident around the named victim.

3 · Metro Tulsa Foot (listed by Insomnia)

HIBR entry: Metro Tulsa Foot on HaveIBeenRansom

What happened. Insomnia listed Metro Tulsa Foot on 31 August, and HIBR indexed 4,323,430 records on 15 October. We found no independent confirmation, so the case remains a listing claim. Its interest comes from the indexed structure: a large personal-address component and a mix of CSV, JSON and spreadsheet records.

Scale. The index reports 3,372,285 CSV records, 933,903 JSON records, 33,272 XLS records and 17,222 XLSX records, plus small document, email, PDF and database categories. HIBR classified 142,487 records as email-bearing. No identity documents were classified in the metadata.

What the data contains. The metadata supports statements about formats and email classes, not medical diagnoses, patient status or clinical content. The organisation name suggests healthcare, but inferring health data from the name alone would be unsafe. For this edition, the defensible exposure surface is contactability and the potential for convincing follow-on messages.

Corporate vs Personal. Personal addresses account for 79.40% of email-bearing records. Gmail leads the personal class at 51.28%, followed by Yahoo at 23.67%, Hotmail at 5.63% and AOL at 5.50%. The corporate class is diffuse: cox.net is 39.77%, while mtfas.com—the strongest visible organisation-related domain—is only 3.21%.

Attribution confidence: 27/100 (low). Organisation labels appear in the content, but the declared tulsafoot.com domain supplied no matched addresses. The metadata also flags a multi-tenant signal. The evidence is therefore consistent with some Metro Tulsa Foot-related material but insufficient for a strong dataset-to-victim link.

Why it stands out this week. It combines a sizeable indexed dataset with a personal-email majority and weak attribution. That combination calls for cautious public language and practical monitoring: warn users about targeted phishing themes without presenting the organisation claim as settled fact.

What they have in common

• All three were listed before the week but became searchable during 11–17 October; the selection is about new index availability, not fresh intrusion dates.
• The record total and the email-bearing total diverge sharply in every case. “Records” may represent rows, objects or extracted artefacts, not unique people.
• Attribution quality varies from high to very low. The brand name on a leak page is a collection lead, not a conclusion.

What defenders can do

• Inter: prioritise monitoring for inter.com.ve and corp.intercable.com.ve, review authentication anomalies and prepare a supplier/customer communication line that does not overstate the actor claim.
• ITK Holding: hold the named-victim escalation until internal identifiers validate the linkage. Check whether the dominant domains have a legitimate group-company relationship before treating them as third-party victims.
• Metro Tulsa Foot: tune email-security and fraud monitoring for impersonation aimed at personal webmail users. Use only organisation-approved messaging; do not confirm the incident through a warning that outruns the evidence.
• Across all three, require MFA for remote access, review exposed credentials against current accounts, segment critical systems and verify offline backup restoration. Treat leak-site text as hostile, untrusted content.

Is your company — or one of your suppliers — in a ransomware leak? Search HaveIBeenRansom for free · Monitor your domains with HIBR for business

DarkEye Threat Research · Data: HaveIBeenRansom · Indexing methodology peer-reviewed in MDPI Electronics · Attribution confidence is a heuristic estimate (method v2.0), not a formal attribution.

← Previous edition · All Ransomware Weekly editions