# Onmion LLC — One IT Provider, Three Breached Companies, 3,000+ Victims **Subject:** Onmion LLC (Mukilteo, WA) — Managed IT Provider **Clients compromised:** 3 | **Individuals at risk:** 3,000+ | **SSNs exposed:** 426+ | **Data:** 179+ GB --- ## Who Is Onmion LLC? **Onmion LLC** — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — **onmion.com** A managed IT and software services provider that markets itself as "empowering businesses with cutting-edge software technology." In practice, Onmion LLC stored all of its clients' most sensitive data — Social Security Numbers, banking records, healthcare credentials, tax filings — on shared, unencrypted infrastructure with no segmentation between client environments. Through Onmion's FTP servers, backup systems, and SolarWinds N-Central RMM platform, we obtained complete access to three client organizations simultaneously. **When contacted and offered the chance to resolve this privately, Onmion LLC refused to respond.**  *Screenshot 1 — onmion.com — "Empowering businesses with cutting-edge software technology"* --- ## Three Clients, One Point of Failure  *Screenshot 2 — All three client datasets on the same shared FTP infrastructure* | # | Client | Website | Location | Data | Individuals | |---|--------|---------|----------|------|-------------| | 1 | **Lake Connor Park** | lcpmembers.com | Tulalip, WA | 178.8 GB | 500+ members | | 2 | **Port Susan Camping Club** | portsusan.com | Stanwood, WA | Full K/T/V drives | 2,490 sites, 400+ SSNs | | 3 | **CarneVita / Cured by Visconti** | curedbyvisconti.com | Wenatchee, WA | 278 MB+ active QBW | 26+ SSNs | --- ## Onmion's Failures  *Screenshot 3 — N-Central RMM backup archives from Onmion's management server*  *Screenshot 4 — Healthcare portal credentials (AETNA, UHC, Humana, Cigna) stored unencrypted*  *Screenshot 5 — Summary of Onmion's security failures* 1. **No segmentation** — all clients on shared FTP with no access controls 2. **N-Central RMM exposed** — 44 daily backups (45 GB) with device inventories and remote access credentials 3. **Plaintext passwords** — production databases storing user credentials in cleartext 4. **Healthcare credentials in Word docs** — 25+ login pairs for major US insurers unencrypted 5. **No encryption** on W-2 forms, QuickBooks files, bank statements, HR files 6. **Refused to respond** when notified — no action, no client notification --- # CLIENT 1 — Lake Connor Park **lcpmembers.com** — Tulalip, WA — Gated residential/RV community — 500+ members — **178.8 GB exfiltrated** | Category | Details | |----------|---------| | SQL Databases | 92+ GB — member records, POS transactions, user credentials | | N-Central RMM | 45 GB — 44 daily backups of IT management server | | Gate Access Logs | 700+ daily logs — 363+ members with names, cards, timestamps | | Member Database | 500+ records with full PII, passwords in plaintext | | Healthcare Creds | 25+ pairs — AETNA, UHC, Humana, Cigna, others | | Source Code | 99 VB.NET files — POS, QuickBooks integration | | System Backups | 656 DAR archives (4.8 GB), Jan–Sep 2026 |  *Screenshot 6 — 178.8 GB data archive*  *Screenshot 7 — MAAS member database: 500+ individual PII records*  *Screenshot 8 — Daily gate logs: names, card numbers, timestamps*  *Screenshot 9 — Healthcare credentials in plaintext*  *Screenshot 10 — SQL Server database backups (92+ GB)*  *Screenshot 11 — User passwords stored in cleartext in production DB*  *Screenshot 12 — 44 daily N-Central RMM backups* --- # CLIENT 2 — Port Susan Camping Club **portsusan.com** — Stanwood, WA — Tribal nonprofit (Tulalip Tribes) — 2,490 sites — $7.4M revenue — **400+ SSNs exposed** | Category | Details | |----------|---------| | Financial Records | 20+ years (2006-2026): budgets, balance sheets, audits, tax filings | | Employee PII | 219 individuals (91 active + 128 terminated) — full SSN | | W-2 Forms | 2020-2025 — SSN for every employee | | Vendor W-9s | 202 forms — EIN/SSN for all vendors | | Banking | 7 Heritage Bank accounts with numbers, statements, reconciliations | | HR Investigations | 10 named cases — harassment, misconduct, legal | | IRS/Tax | 990T, 1099, PPP/SBA loan records | | IT Infrastructure | 10 security policies, AD/Entra ID docs, network maps |  *Screenshot 13 — Three data drives: Finance (K), HR (T), Departments (V)*  *Screenshot 14 — 20+ years of financial records*  *Screenshot 15 — 91 active employee personnel files*  *Screenshot 16 — W-2 forms (2020-2025) with employee SSNs*  *Screenshot 17 — 7 Heritage Bank accounts with full account numbers*  *Screenshot 18 — 202 vendor W-9 forms with EIN/SSN*  *Screenshot 19 — 10 confidential HR investigation files* --- # CLIENT 3 — CarneVita / Cured by Visconti **curedbyvisconti.com** — 1501 N Miller St, Wenatchee, WA — Food production — **26+ SSNs** — $3.4-4.8M revenue Three entities compromised through a single shared backup: | Entity | EIN | QuickBooks | |--------|-----|------------| | CarneVita, LLC | 33-3284096 | 64 MB (active) | | Cured by Visconti, LLC | 85-0659112 | 201 MB (active) | | 3 Boots Ranch & Custom Cuts | — | 13 MB (active) | | Category | Details | |----------|---------| | QuickBooks Files | 278 MB+ — complete financials for all 3 entities | | IRS W-2 Forms | 26 employees — full SSN, names, wages | | IRS 941/940/W-3 | Quarterly + annual federal tax returns | | Transactions | 2,018 documents — invoices, POs, receipts | | Backups | 70+ automated QBW backups (Feb 2025 — Apr 2026) | | Investment | Fidelity account statements |  *Screenshot 20 — W-2 forms with employee SSNs*  *Screenshot 21 — Form 941 CarneVita: 15 employees, $176K quarterly wages*  *Screenshot 22 — Form 941 Cured by Visconti: 11 employees*  *Screenshot 23 — QuickBooks files for all three entities*  *Screenshot 24 — 2,018 transaction documents*  *Screenshot 25 — PII summary across all three entities* --- ## Combined Impact | Metric | Total | |--------|-------| | Organizations compromised | 3 | | Data exfiltrated | 179+ GB | | Individuals with PII exposed | 3,000+ | | Social Security Numbers | 426+ | | Bank accounts exposed | 10+ | | Healthcare credentials | 25+ portal logins | | Financial history | 20+ years | | IRS documents | W-2, W-3, W-9 (202), 990T, 941, 940, 1099 | | Member/client sites | 2,990+ | --- ## What Affected Organizations Should Do 1. **Terminate Onmion LLC** — they knew and chose silence 2. **Engage independent cybersecurity counsel** 3. **Begin breach notification** per WA State RCW 19.255.010 4. **Notify banks** — Heritage Bank (PSCC), Wells Fargo (LCP), QuickBooks banking (CarneVita) 5. **Report to WA Attorney General** and relevant authorities 6. **Offer credit monitoring** to all individuals with exposed SSNs **All data will be published in full if Onmion LLC continues to refuse engagement.** --- *Onmion LLC — 10620 62nd Pl W, Mukilteo, WA 98275 — (425) 349-9636 — onmion.com* *Lake Connor Park — lcpmembers.com | Port Susan Camping Club — portsusan.com | CarneVita — curedbyvisconti.com*