Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

BigID

bigid.com
Group Thegentlemen
Discovered 2026-10-12 04:39 UTC
Est. attack date 2026-10-10
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation

Description:

bigid.com Revenue $100 Million BigID is the enterprise data security platform that finds and classifies sensitive data across cloud apps, databases and files, showing where private data lives and who can access it. It now focuses on AI, spotting shadow AI tools and checking what data Copilots and agents reach, and in September 2026 launched AgentIQ letting AI assistants trigger data cleanup and access reviews from Claude, Copilot or ChatGPT. It serves hundreds of enterprise clients like Telenor and Fiserv, one of which deleted 27,000 sensitive records from 2.5 petabytes of storage. Money comes from enterprise subscriptions priced per data source, with $175K as one AWS Marketplace benchmark. Around 600 employees work there after cutting 150 roles in May 2026 to go AI-first. It raised $320M at a $1B+ valuation and owns no factories or stores.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 8

Third Party Employee Credentials: 1

External Attack Surface: 10

Infostealer Distribution
Exposure Report
by ParanoidLab
180
Passwords
7 critical
372
Cookies
0 critical
Last queried 2026-10-12 04:39 UTC

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • abusegodaddy.com
MX Records
  • alt1.aspmx.l.google.com. Google Workspace
  • alt2.aspmx.l.google.com. Google Workspace
  • aspmx.l.google.com. Google Workspace
  • alt3.aspmx.l.google.com. Google Workspace
  • alt4.aspmx.l.google.com. Google Workspace
TXT Records
  • h1-domain-verification=oos8GRsF1g4vt17am788U35oywRfuDmPnSdN3VQyGRdRYhFs
  • ticket-1865
  • Sendinblue-code:07a3f452280f38e2bbabdf67e867dc4a
  • cursor-domain-verification-fm6zyq=T4zJ2tWyE5q9WH0Haz9bGliNc
  • OSSRH-80035
  • google-site-verification=9JDzgWXmbHhHTzJngEio3YmBe3fYaQBlCT21Eh9nngw
  • jetbrains-domain-verification=aukh4pcha8988sn77atko0h97
  • atlassian-domain-verification=8J1C/R1eRVn8NHq3Z3NWfuBlSYbRfcpZ/NE6UOEkE8LsfqjYd2P/z3hJidL7F6GT
  • openai-domain-verification=dv-tba7UVkLh2EVNclNUHmYj4tP
  • miro-verification=7766c63afe5537b08ed2a4fc676a3a975db377fe
  • mongodb-site-verification=9I6bKB2PMH6Xlh15mKbAib25m7rEzTkE
  • hubspot-domain-verification=YjcyMTU5NGQtZjczZS00ZmNhLTlhZDgtNDkwZmRjZmQ2ZTYw
  • opine-verification=83a3c53f-6997-4283-9330-76ae3b1f5a2b
  • mongodb-site-verification=lqarHBsKiLsSafSbnWvZhC6bGDIPQVkc
  • anthropic-domain-verification-6ebz5p=i02GWGhFUsnOH3xEkECfjCyf0
  • apple-domain-verification=c3xDlnNZHSFvjpME
  • protonmail-verification=78b08892bfd343e8314e68a1cdcfd2080918f697
  • zoom-domain-verification=ZOOM_verify_22f313dcd3a74e309d8a597295f77613
  • v=spf1 include:_spf.google.com include:spfsalesforce.bigid.com include:spfgreenhouse.bigid.com include:outbound.smtp.wisestamp.net include:spfhubspot.bigid.com include:sendgrid.bigid.com +mx -all
  • wiz-domain-verification=5ee09d966ad2ebec827ccaddcc499cb3eb5dfe77fd48b449fb575a895aaf518a
  • cl5v1dothtijqcli93v7mlepd1
  • 94633D982F
  • mongodb-site-verification=CmounKtGCWPr9m3QQyIMjbmhyUtSg0GO
Cloud / SaaS Services Detected
Anthropic Apple Atlassian Google Workspace Miro MondoDB OpenIA Proton Wiz Zoom

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.