Ransomware Weekly, 4–10 Oct 2026: Suunto, CyrusOne and an Akira Listing Five Months Old

Also this week: Breaches Weekly, 4–10 Oct 2026: a 642M-row courier file, an alleged utility dump and 8M microloan records

Period covered: 2026-10-04 00:00 UTC → 2026-10-10 23:59 UTC, selected by indexing date in HaveIBeenRansom (HIBR). Each case shows both its listing date and its indexing date. Data: HaveIBeenRansom (/api/fullmetadata/<id>, plus record-level reading of the leak content).

Why these three

This week's selection follows the indexing date: a leak qualifies if HIBR indexed it between 4 and 10 October, even when the group listed it earlier. We picked the three with the strongest mix of volume, organisation type and data sensitivity. Suunto was listed on 23 September and CyrusOne on 23 August; Pipestone was listed back on 5 May and only reached the index this week. So none is a new claim. What is new is that their data became searchable, which is the moment defenders can check exposure.

Everything below describes what the groups claim and what the indexed data contains. A listing is not a confirmed intrusion, and a domain appearing in a leak does not prove how anyone got in.

Key Findings

The records without an email are not empty. They hold other data (documents, ledger rows, order lines), so "% with email" understates how much information each leak holds. We have not quantified the non-email types.

How to read the percentages

Each percentage names its base. Personal means an address on a fixed list of free-webmail providers; Corporate is everything else, so it does not mean "belongs to the victim". Shares in the top-5 tables are within their class. "Records read" means the records returned for the named domain, up to 500 here, read in context; they describe those records and are never extrapolated to the whole leak.

1 · Suunto (listed by clop)

What happened. clop listed Suunto, the Finnish maker of sports watches and dive computers, on 23 September. The HIBR entry covers suunto.com and suunto.cn, and the description is AI-generated by HIBR. The data was indexed on 7 October.

Scale. 36,859,757 records, the largest of the week's ransomware set, almost all CSV rows. Only 0.04% of records contain an email address.

What the data contains. For suunto.com, 9,570 records matched. In the 500 we read, 100% carry object-class names such as wt.epm.EPMDocument, wt.pdmlink.PDMLinkProduct and wt.audit.AuditRecord, plus lifecycle states ("In Work") and an assembly label. Hypothesis, not fact: those names match the PTC Windchill PLM product family, which would make this engineering and product-design metadata (documents, assemblies, audit trail) rather than customer data. Only 0.4% of those 500 records have a distinct email, so the same few addresses repeat.

Corporate vs Personal. 99.82% Corporate, 0.18% Personal (of 15,725 addresses).

Other Amer Sports brand domains appear next to the parent's. That is consistent with group-wide engineering collaboration, but we cannot tell from the records whether those brands' own systems were touched.

Attribution confidence: 47/100 (medium). Organisation-domain share and label-in-content support it; there is no external corroboration in our evaluation yet, and one third-party domain concentration lowers it. It is an estimate of how well the data fits the announced victim, not a verdict.

Why it stands out this week. It is the largest ransomware dataset indexed in the period, and engineering data for a consumer-hardware brand is mostly an intellectual-property and supply-chain exposure question, not a consumer-privacy one.

2 · CyrusOne (listed by shinyhunters)

What happened. shinyhunters' post, dated 23 August, says the victim refused a $13 million demand and gave a 24-hour deadline. According to the post, the group holds 12.9 million Salesforce records and a SharePoint dump of 369.6 GB compressed (288,729 files). The post says it removed the client's name; HIBR links the entry to cyrusone.com. CyrusOne is a data-center operator. HIBR indexed the data on 4 October. We have not seen a public confirmation of the incident or of the demand.

What the post claims is inside (claims, not verified by us): about 182,000 Salesforce "Contacts" rows, over 8,300 rows of employee data, executed contracts and leases, physical key inventories, data-center floor plans and electrical diagrams, security policies, and credential and access-control artifacts such as a password list and badge reports.

Scale. 8,407,718 records; 24.7% contain an email address. File-type counts overlap, so they are approximate: xls and xlsx together are about 28% of the type counts, and csv is the largest type.

What the data contains. For cyrusone.com the API reports at least 10,000 matching records (its cap). In the 500 we read, 41.6% carry billing and lease-ledger fields (account and tenant IDs, charge code, debit/credit, service period, property name, lease type). The word "salesforce" appears in 4.4% of them. So the part we read looks like finance and lease-accounting exports, which is a different slice from the contact and security material the post lists.

Corporate vs Personal. 99.5% Corporate, 0.5% Personal (of 2,079,024 addresses).

Real-estate and consulting domains (jll.com, cbre.com, accenture.com) fit a customer, broker or vendor relationship; that is a hypothesis.

Attribution confidence: 87/100 (high). The share of cyrusone.com addresses and the organisation label in file paths and content drive the score. Incident confirmation and dataset-to-incident linkage are not evaluated yet, so "high" refers to the data fitting the named organisation, not to a confirmed breach.

Why it stands out this week. The victim operates critical facilities, and the claimed material includes physical-security and access-control information. The risk to its customers is operational, not just privacy-related.

3 · Pipestone (listed by akira)

What happened. akira listed Pipestone on 5 May 2026. The listing text attached to the HIBR entry reads: "We will upload 137gb of corporate data soon. Detailed client and employee personal documents (passports, SSNs, DLs, financial and medical information), DBs with personal info, litigation docs, contracts and agreements, insurance files, NDAs, etc." The descriptive paragraph in the same entry names a different company, ATF Aerospace, a CNC parts manufacturer, which does not match what the records show; we cannot tell why. HIBR infers the organisation domain pipestone.com from the post title, and indexed 7,130,072 records on 7 October, five months after the listing. Those claims about passports and licences are the group's; we found no identity documents among the indexed records (0 classified).

What the data contains. For pipestone.com, at least 10,000 records matched (the API cap). The 500 we read come from several unrelated source files, so this is a mixed corporate dump, not one system. By source file: 49.2% are rows of a user list (two names and numeric IDs); 20.2% are retirement-plan participant notice rows (contract number, participant name, consent flag, delivery method, SSN shown only as XXXXX plus four digits); 7.2% are marketing customer links; 6.2% are an HR roster with a nine-digit SSN field, employee ID, 401(k) policy flag and personal phone; 4.8% are customer-account fields (address, credit limit); the rest are role, location, contact, vendor and policy-acknowledgement tables, plus a small acquisition-related roster with SSN/ID and date of birth (0.8%). In total, 7.0% of the records read carry a full-length SSN/ID field. Table names such as FARMBOOKS and the city of Pipestone suggest an agricultural business, which is an inference. Distinct emails are 77.4% of the 500, so addresses mostly do not repeat.

Scale. Almost all records are CSV rows (6,996,633), plus 135,885 xls, 133,439 xlsx and 6 doc; file-type counts overlap, so they are approximate. 1.9% of records have an email address (132,101 addresses), so the email count says little about how much personal data is inside.

Corporate vs Personal. 43.80% Corporate, 56.20% Personal (of 132,101 addresses).

The other corporate domains include regional ISPs (netins.net, frontiernet.net) and farm and veterinary names, which fits a customer and employee base around an agricultural company; that is a hypothesis.

Attribution confidence: 76/100 (high). The share of pipestone.com among corporate addresses (44.2%, a lower bound) and the organisation label in 14.4% of record contents drive the score. The data-nature and external-corroboration factors are not evaluated yet, and the organisation domain was inferred from the name, so "high" means the data fits the named organisation, not a confirmed breach.

Why it stands out this week. It is the smallest of the three by volume, and it enters the selection only because the indexing date counts for ransomware. It is also the one whose records are personal: employee SSN fields, retirement-plan notices and customer contacts support identity fraud and targeted phishing more than the other two cases.

What they have in common

• All three were listed well before they were indexed, from two weeks (Suunto) to five months (Pipestone). A listing date alone would have hidden them from a "this week" view.
• None is mainly a mailbox dump. The most useful reading came from the record context (engineering objects, lease ledgers, HR and plan-notice rows), not from email counts.
• The three cover a manufacturer, a critical-infrastructure operator and an apparent agricultural business: different exposures (intellectual property, physical security, employee and customer identity data) from the same extortion model.

What defenders can do

If you are a customer, supplier or broker of CyrusOne or Pipestone, or you work with Amer Sports brands, ask the vendor what was exposed and rotate credentials or access artifacts shared with them. Treat any contact data in these leaks as usable for targeted phishing. Pipestone employees and plan participants should watch for identity-fraud signs and consider a credit freeze.

Is your company, or one of your suppliers, in a ransomware leak? Check if your organization appears on HaveIBeenRansom

DarkEye Threat Research · Data: HaveIBeenRansom · Attribution confidence is a heuristic estimate (method v2.0), not a formal attribution.