Sponsored by Hudson Rock – Use Hudson Rock's free cybercrime intelligence tools to learn how Infostealer infections are leading to ransomware attacks

Enjoying ransomware.live? Help us keep tracking ransomware gangs and shipping new features. Support us
Logo

Eyemart Express

eyemartexpress.com
Group Payoutsking
Discovered 2026-04-30 00:42 UTC
Est. attack date 2026-02-19
Country US
Sector
Agriculture and Food Production Education Energy & Utilities Financial Services Government & Defense Healthcare Hospitality Manufacturing Other Professional Services Retail & E-Commerce Technology Transportation
Data exfiltrated 435GB

Description:

[AI generated] Eyemart Express is a United States-based retail optical chain specializing in prescription eyeglasses and contact lenses. Founded in 1990 and headquartered in Farmers Branch, Texas, the company operates hundreds of stores across the country. It offers eye exams, frames, and lenses with an emphasis on fast turnaround times. Eyemart Express competes in the optical retail industry alongside brands like LensCrafters and Visionworks.
Infostealer activity detected by HudsonRock

Compromised Employees: 0

Compromised Users: 386

Third Party Employee Credentials: 2

External Attack Surface: 43

DNS Records:

The following DNS records were found for the victim's domain.

WHOIS Emails
  • 0897a88f8fcdee4a28fe549aefc28fd539d8641b50698918a8cfb11b8da2c3a1eyemartexpress.com.whoisproxy.org
  • 0897a88f8fcdee4a28fe549aefc28fd5ce9eb39fec3c501d5ce5afb38a87e59eeyemartexpress.com.whoisproxy.org
  • 0897a88f8fcdee4a28fe549aefc28fd539a398f2e1c89133cbbad6676649a650eyemartexpress.com.whoisproxy.org
  • 0897a88f8fcdee4a28fe549aefc28fd52a439994faa768304f586cf2d51dbca5eyemartexpress.com.whoisproxy.org
  • trustandsafetysupport.aws.com
MX Records
  • us-smtp-inbound-2.mimecast.com. Mimecast
  • us-smtp-inbound-1.mimecast.com. Mimecast
TXT Records
  • MS=ms10393083
  • MS=ms47307001
  • _7pcgk8bl6jjegcv3a7r82kif9znq2yy
  • apple-domain-verification=PTvpAgNaND3NPGyX
  • google-site-verification=7ItXS8FKiOELJ2LinQuzGexFYESB-VM3MwTpLX-UHCM
  • google-site-verification=NINJI0myo6VBWY5dCaXz1Rte6qYS9-7MmAR1V9tckiU
  • google-site-verification=Xalp0zW5bMGhO6eF01UcFq44OWM2O0s_9JKViPGw8UY
  • have-i-been-pwned-verification=e27a5aa30967dbd01d5ea911d0dae066
  • k9n3zr46p9bfqqq8sv1gvh4x2n23zxp4
  • smartsheet-site-validation=XVpBTWgVBQFK2rqCDWMol9mqYJXHwX6F
  • smartsheet-site-validation=vXJwpWBwMKbTjUYXQOJcEXU3QyrYa16K
  • sp5ph6p006myw7s4n9g9sdj5tknjxvcs
  • twilio-domain-verification=9109ec6113187556e3521af164a2b9bc
  • v=spf1 redirect=5ss0qoto._spf._d.mim.ec
  • zscaler-verification-140678813-05112025-Ytfdsb5JBGY
  • 1password-site-verification=C6JWNRL2MNB3BFDALMUMRRGJPU
  • 6bsg9bqg42g4x92kqfbfyh9bd9v5nq95
  • 98b9b8ef6c635c59db759150fd2d123c
Cloud / SaaS Services Detected
1Password Apple Have I Been Pwned Microsoft 365 Mimecast Smartsheet Twilio Zscaler

Leak Screenshot:

Leak Screenshot

Legal Disclaimer: Ransomware.live does not engage in the acquisition, exfiltration, downloading, possession, hosting, access, consultation, redistribution, or disclosure of unlawfully obtained data. This platform indexes only publicly visible information posted by ransomware operators and open web sources without accessing or obtaining the underlying stolen content. The service is provided to support public awareness, legitimate research, and cyber-resilience. No stolen personal or confidential data is collected or distributed via this site.