Ransomware Weekly, 25–31 Oct 2026: 21.3M Claimed Pitney Bowes Rows, AngMar and Omni Tanker

Coming later today: Breaches Weekly. Past editions.

Covers leaks indexed by HaveIBeenRansom between 2026-10-25 00:00 and 2026-10-31 23:59 UTC. Each case shows when it was listed and when its data became searchable. How we pick cases, read records and score attribution: methodology.

Why these three

This week's selection raises different defensive questions about business-contact data, employee-related fields and a concentration of technical log entries. The Pitney Bowes-labelled file has the largest indexed total of these three cases. AngMar has the clearest organisation-domain signal. Omni Tanker shows why a large corporate-email percentage can describe a narrow technical slice. All became searchable in the reporting window; their listing dates precede it. We include Pitney Bowes here because the file is associated with an extortion claim, even though the indexed copy was redistributed by a data-sharing channel.

.weekly-summary-region:focus{outline:2px solid #00f2ff;outline-offset:2px}

Scroll horizontally to read all cases. Keyboard users can focus the table region and use the arrow keys.

Key findings

The corporate/personal split below follows the index's mail-provider classification. Corporate means outside the recognised personal-provider bucket, not employee, internal or victim-owned. Domain-table percentages use their own bucket as denominator. File-type counters for AngMar and Omni Tanker exceed their respective record totals and are not additive; the cause has not been established. Small, ordered domain samples are not representative surveys. Scores are the API's v2.0 heuristic output, separate from our analytic confidence and from incident confirmation.

1 · Pitney Bowes (listed by ShinyHunters)

HIBR entry: Pitney Bowes on HaveIBeenRansom

What happened. The indexed copy is labelled as a ShinyHunters release and was reposted by Database World ROC; its HIBR posting/discovery date is 18 June 2026. Independently, Pitney Bowes told The Register that unauthorised access to its Salesforce environment was detected on 9 April after an employee-email phishing incident. The company said the affected material concerned business accounts and contacts, and reported no evidence of access to other systems or sensitive personal data. That is confirmation of an incident, not authentication of every row in this file. Company statement reported by The Register.

Scale. HIBR indexed 21,299,605 rows, of which 15,246,330 contain an email value. Separately, HIBP reports 8.2M unique email addresses in a Pitney Bowes release. The two measurements describe different units and have not been matched record by record; neither should replace the other. HIBP's independent account.

What the data contains. The metadata reports 21,299,597 CSV-associated rows across four CSV source files and eight text-associated rows from one text source file. In two ordered samples of 100 records each, filtered separately to pb.com and gmail.com, every profiled row carried id and status labels. Dates found in those samples ranged across 2022–2024. The samples are small and do not date the full archive. HIBP describes contact information and a subset of employment records. This is independently reported context; our narrow samples did not verify all of it.

Corporate vs Personal. The 92.00% corporate-classified share fits a business-contact use case, but its many domains also represent other organisations. pb.com leads that bucket at 7.19%; the presence of government or business domains does not establish compromise of those organisations. Treating all 14,025,920 corporate-classified email records as Pitney Bowes employees would be incorrect.

Fig 1. Pitney Bowes: provider classification and top domains. Each top-domain percentage is calculated within its respective category (corporate or personal). Source: HIBR entry.

Corporate-classified: 14,025,920 (92.00%); personal-provider: 1,220,410 (8.00%). Denominator: 15,246,330 email-bearing records, not unique people. Each domain percentage below uses its own bucket total.

Fig 2. Pitney Bowes: email-bearing records by provider classification. Corporate does not mean internal. Source: HIBR entry.

Attribution confidence: Insufficient evidence. The API returns insufficient evidence, with no numerical score: only 15 points of factors were evaluable, and the organisation domain was unresolved. Do not recycle its previous-version score or turn null into zero. Our assessment is that a relationship to the publicly reported release is likely, with moderate confidence, based on the label, business-contact profile and independent incident reporting. Direct validation of the exact archive would raise confidence; a demonstrated mismatch would lower it.

Why it stands out this week. It is the largest selected extortion-related file this week and shows why business-contact exposure deserves attention even when the principal data is not described as passwords or payment cards. The incident is confirmed, but verification of this dataset remains unresolved.

2 · AngMar (listed by Interlock)

HIBR entry: AngMar on HaveIBeenRansom

What happened. Interlock's listing, captured in HIBR with an 11 August 2026 discovery date, claims company and patient information. The actor's assertions about medical records and volume are not findings from this analysis. We found public reporting of a separate AngMar Management Services notice, but did not establish that it describes this same event or dataset. This entry therefore remains an unconfirmed Interlock claim, with no conclusion about encryption or operational disruption.

Scale. The indexed total is 10,601,037 records. Only 924,032, or 8.72%, contain an email value. The email split describes that minority, not the entire dataset. The declared organisation domain appears in 266,269 records in the attribution factor, with 7,256 distinct addresses reported; these are different units and neither is an affected-patient count.

What the data contains. Each of the employee_name, hire_date and Department labels was detected in 40 of 100 profiled records in the angmarcompanies.com slice and in 49 of 100 in the Gmail slice. These are separate per-label counts; co-occurrence and overlap between the two slices were not measured. That provides direct, bounded evidence of employee-related structured data. It does not verify the claimed patient material. Metadata includes CSV, XLS, XLSX and database categories. Their record counters sum to 16,129,808, above the headline total; we show them as separate counters and make no claim about why they overlap or differ. A zero identity-document counter is not evidence that sensitive identifiers are absent.

Corporate vs Personal. The announced company domain accounts for 87.75% of the corporate bucket, while recognised personal providers account for 67.16% of all email-bearing records. Those observations can coexist because they use different denominators. Provider and recruiting-service domains should not be interpreted as employees, breached suppliers or an entry route.

Fig 3. AngMar: provider classification and top domains. Each top-domain percentage is calculated within its respective category (corporate or personal). Source: HIBR entry.

Corporate-classified: 303,416 (32.84%); personal-provider: 620,616 (67.16%). Denominator: 924,032 email-bearing records, not unique people. Each domain percentage below uses its own bucket total.

Fig 4. AngMar: email-bearing records by provider classification. Corporate does not mean internal. Source: HIBR entry.

Attribution confidence: 100/100 (high). The API reports 100/100 (high), calculated from 55 raw points out of 55 evaluable points. Its two analyst-dependent factors, data nature/provenance and external corroboration, remain pending. The result is not a 100% probability or a claim that the investigation is complete. We assess that the dataset is likely related to the named organisation, with moderate confidence, supported by the declared-domain presence and employee-related sample labels. Independent dataset validation and confirmation of incident linkage remain needed.

Why it stands out this week. The employee-related observations give security teams a basis for an authorised investigation into HR exports and account-related material. The actor's asserted patient exposure still needs separate supporting evidence.

3 · Omni Tanker (listed by Clop)

HIBR entry: Omni Tanker on HaveIBeenRansom

What happened. Clop listed omnitanker.com; HIBR records discovery on 12 August 2026 and indexing on 31 October. The actor claims databases, projects and other files. Omni Tanker's own website describes a manufacturer of specialised composite tank equipment, which gives context to the potential industrial relevance but does not confirm the listing. Company description.

Scale. There are 1,783,240 indexed records and 5,641 email-bearing records: just 0.32%. Of those email records, 5,622 fall in the corporate bucket. The 99.66% corporate figure must therefore not be projected onto 1.8M people or onto all indexed data. The exact announced domain appears in seven records and five distinct addresses in the attribution factor.

What the data contains. The file-type metadata reports 1,669,670 CSV-associated records, 107,983 JSON-associated records and 5,498 database-associated records, alongside smaller categories. The counters total 1,805,883, above the headline total, so they must not be added to derive a new total. We retrieved 60 rows from the dominant cloud.omnicompositetank.com domain slice; every source path contained a log keyword. Our field-name parser found none of its allowlisted labels in those rows. That is a parser limitation, not a finding that the records contain no sensitive data.

Corporate vs Personal. cloud.omnicompositetank.com accounts for 94.70% of the corporate bucket. Similar naming is not sufficient to establish ownership, and this analysis has not verified its relationship to Omni Tanker. Software-related domains also appear. Their presence does not identify a supplier compromise or show which product was exploited.

Fig 5. Omni Tanker: provider classification and top domains. Each top-domain percentage is calculated within its respective category (corporate or personal). Source: HIBR entry.

Corporate-classified: 5,622 (99.66%); personal-provider: 19 (0.34%). Denominator: 5,641 email-bearing records, not unique people. Each domain percentage below uses its own bucket total.

Fig 6. Omni Tanker: email-bearing records by provider classification. Corporate does not mean internal. Source: HIBR entry.

Attribution confidence: 24/100 (low). The API gives 24/100 (low), from 13 points out of 55 evaluated, with analyst provenance and corroboration pending. Our analytic confidence in a link beyond the named listing remains low: the declared-domain evidence is limited and ownership of the dominant technical domain still needs validation. We make no likelihood claim about a particular vulnerability, ransomware deployment or initial-access route.

Why it stands out this week. The industrial context and the low email coverage make this a useful counterpoint to the contact-heavy Pitney Bowes file. Investigators first need to establish which technical systems and business documents are represented. The row count cannot tell them how many people are involved.

What they have in common

• The indexing event is new to this edition; none of the dates in the table is presented as the date an intrusion occurred.
• Email coverage varies sharply: business-contact rows dominate one selected file, while the other two have much larger non-email portions. An assessment focused only on email risk would miss that difference.
• Neither a recognised company domain nor a high automated score identifies the attacker, the access route, the scope of theft or the number of people involved.

What defenders can do

For teams assessing the Pitney Bowes incident, prioritise the business-contact workflow: authenticate requests to change billing or account details through an established channel, and review CRM export permissions and unusual bulk access. These are preventive actions, not evidence of misuse of this indexed copy.

For an organisation investigating the AngMar listing, reconcile the employee-related field labels with authorised HR export inventories and the organisation's own incident evidence before defining the notification population. Restrict access to exports and review how employee information moves between systems. Do not infer patient exposure from the group's description alone.

For engineering suppliers evaluating the Omni Tanker claim, check ownership of the technical domain and the source systems behind it. Preserve relevant audit logs; review permissions on engineering exports and database backups. A low email-bearing fraction is not a reason to dismiss possible intellectual-property exposure, but the files and contents must be verified before claiming that exposure.

Across these workflows, phishing-resistant MFA, least-privilege access and tested, protected backups are grounded in the joint CISA #StopRansomware Guide. They are controls to apply to the relevant systems, not conclusions about which control failed in these cases. No case-specific exploit, malware family or ATT&CK intrusion chain can be established from the metadata examined.

---

Is your company — or one of your suppliers — in a ransomware leak? Search HaveIBeenRansom for free · Monitor your domains with HIBR for business

DarkEye Threat Research · Data: HaveIBeenRansom · Indexing methodology peer-reviewed in MDPI Electronics · Attribution confidence is a heuristic estimate (method v2.0), not a formal attribution.

← Previous edition · All Ransomware Weekly editions