ShadowByt3$ Claims to Have Stolen 14,476 John Engel Team Customer Profiles
Summary
ShadowByt3$ claims it stole 14,476 customer profiles and other business data from John Engel Team and threatens to leak or sell the data unless negotiations occur within 72 hours. The claims are unverified.
Key points
- The ransomware group ShadowByt3$ claims to have breached US-based John Engel Team; the report says it cannot confirm the claims.
- The group alleges it took 14,476 customer profiles, including behavioral and engagement analytics.
- The group also claims possession of invoices, payment data, branding materials, and contact information.
- It threatens to leak or sell the data if negotiations do not occur within 72 hours.
- The monitoring record lists a source at transfer[.]it and a claimed leak date of September 12, 2026.
Article Details
- Victim
- John Engel Team
- Claim Date
- 2026-09-10
- Encryption Status
- Unknown
- Exfiltration Status
- Claimed by ShadowByt3$; not independently confirmed
- Exfiltrated Data
- The actor claims the data includes customer profiles, behavioral and intent analytics, invoice and payment data, and branding and onboarding materials.
- Exfiltrated Size
- The actor claims 14,476 unique customer profiles.
- Ransom Demand
- The actor demands negotiation within 72 hours to avoid public release; no monetary amount is reported.
- Leak Status
- Threatened; the actor alleges a leak date of 2026-09-12, but publication is not confirmed.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
shadowbyt3s@proton[.]me | Email address the actor provides as a negotiation contact. |