Applied Cybernetics Group Sat, Nov 7, 2026 · data 12:17Z
thrunt.me thrunt me harder

Correlation · attacker × victim × analyst · recomputed daily

Convergence

A leak-site posting on its own is an attacker's claim. When the same company discloses an incident, in an 8-K or a breach notice to a regulator, or a researcher writes it up, it's probably real. This page lists every time that happens.

Converging now
7
On the record
37
On feeds alone
35 of 37
Window
14 days, 120 for a notice
Converging now as of Nov 7, 2026 · RSS · JSON

Photon Health

Leak siteSEC filingBreach noticeResearch Class action

Flagged the morning of Nov 7, 2026 · 2 of 3 parties

  1. 2026-08-19 leak Photon Health, Inc. listed by direwolf
  2. 2026-08-25 litigation Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)and 2 more class actions through 2026-09-02
  3. 2026-10-30 notice Photon Health filed a breach notice with the California Attorney General
  4. 2026-10-31 notice Photon Health filed a breach notice with HHS OCR, 30,625 affected
The record 37 organizations · 5 confirmed by their own filing · replayed Jun 4, 2026–Nov 7, 2026

Each entry comes from rerunning the daily query for every morning since leak-site coverage began, with each signal dated when its source published it. The 8-K collector and the report store were built partway through this period, so the record shows what the correlator would have flagged on those mornings. Some reports were added by hand after the outcome was known, and one name match was checked by hand. Breach notices were loaded in one backfill on October 28, and most portals date a notice by when it was submitted rather than posted, so an entry that depends on one may appear days or weeks before the notice was public. Each of these is marked on its card. 35 of 37 match on feeds and exact names alone.

BASS Medical Group

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Oct 28, 2026 · 5 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-10-22 notice BASS Medical Group filed a breach notice with the California Attorney General
  2. 2026-10-27 leak BASS Medical Group listed by Booba Project

Photon Health

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Oct 22, 2026 · 64 days after the first signal · 2 of 3 parties

  1. 2026-08-19 leak Photon Health, Inc. listed by direwolf
  2. 2026-08-25 litigation Data-breach class action filed: Carey v. Photon Health Inc (District Court, S.D. New York)and 2 more class actions through 2026-09-02
  3. 2026-10-21 notice Photon Health filed a breach notice with the Oregon Department of Justice, 521 affected
  4. 2026-10-23 notice Photon Health filed a breach notice with the Texas Attorney General, 3,085 affected
  5. 2026-10-30 notice Photon Health filed a breach notice with the California Attorney General
  6. 2026-10-31 notice Photon Health filed a breach notice with HHS OCR, 30,625 affected

Park Dental Partners, Inc.

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Oct 14, 2026 · 12 days after the first signal · 2 of 3 parties

Depends on a name match checked by hand rather than an exact-name match.

  1. 2026-10-01 leak parkdental.com listed by chaos
  2. 2026-10-13 filing Park Dental Partners, Inc. filed an 8-K disclosing a cybersecurity incident (Items 1.05)
  3. 2026-11-06 notice Park Dental Partners, Inc. filed a breach notice with the Texas Attorney General, 2,481 affected

Sheppard, Mullin, Richter & Hampton LLP

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Oct 6, 2026 · 3 days after the first signal · 2 of 3 parties

  1. 2026-10-02 notice Sheppard, Mullin, Richter & Hampton LLP filed a breach notice with the California Attorney General
  2. 2026-10-02 notice Sheppard, Mullin, Richter & Hampton LLP filed a breach notice with the Oregon Department of Justice, 204,001 affected
  3. 2026-10-05 leak Sheppard, Mullin, Richter & Hampton listed by SilentRansomGroup
  4. 2026-10-06 notice Sheppard, Mullin, Richter & Hampton LLP filed a breach notice with the Texas Attorney General, 2,326 affected
  5. 2026-10-07 litigation Data-breach class action filed: Pena Emilia Williams v. Sheppard, Mullin, Richter & Hampton LLP (District Court, C.D. California)

The Kenaitze Indian Tribe

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Sep 26, 2026 · 56 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-07-31 leak Kenaitze Indian Tribe listed by thegentlemen
  2. 2026-09-25 notice The Kenaitze Indian Tribe filed a breach notice with HHS OCR, 9,319 affected

WindRose Health Network

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Sep 17, 2026 · 30 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-08-18 leak WindRose Health Network listed by Storm
  2. 2026-09-16 notice WindRose Health Network filed a breach notice with HHS OCR, 33,158 affected

Interim HealthCare Inc.

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Sep 11, 2026 · 31 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-08-11 leak Interim HealthCare listed by genesis
  2. 2026-08-15 leak Interim HealthCare listed by anubis
  3. 2026-08-28 litigation Data-breach class action filed: Hilton v. Interim Healthcare Inc. (District Court, S.D. Florida)and 1 more class action through 2026-09-02
  4. 2026-09-10 notice Interim HealthCare Inc. filed a breach notice with HHS OCR, 1,283 affected

COMHAR, Inc.

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Sep 5, 2026 · 65 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-07-01 leak COMHAR listed by worldleaks
  2. 2026-09-04 notice COMHAR, Inc. filed a breach notice with HHS OCR, 501 affected

Mogren, Glessner & Ahrens, P.S.

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Sep 4, 2026 · 83 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-06-12 leak mgrlaw.com listed by threeam
  2. 2026-08-22 leak Mogren, Glessner & Ahrens, P.S. listed by pear
  3. 2026-09-03 notice Mogren, Glessner & Ahrens, P.S. filed a breach notice with the Washington Attorney General, 1,379 affected

Nutex Health Inc.

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Sep 2, 2026 · 1 day after the first signal · 2 of 3 parties

  1. 2026-08-31 filing Nutex Health Inc. filed an 8-K disclosing a cybersecurity incident (Items 1.05)
  2. 2026-08-31 litigation Data-breach class action filed: Flowers v. Nutex Health Inc. (District Court, S.D. Texas)
  3. 2026-09-01 leak Nutex Health listed by thegentlemen
  4. 2026-09-11 filing Nutex Health Inc. filed an 8-K disclosing a cybersecurity incident (Items 1.05)

McKesson Corporation

Leak siteSEC filingBreach noticeResearch PressClass action

Would have flagged the morning of Aug 29, 2026 · same day as the first signal · 3 of 3 parties · worked case →

  1. 2026-08-28 leak McKesson Corporation listed by shinyhunters
  2. 2026-08-28 filing MCKESSON CORP filed an 8-K disclosing a cybersecurity incident (Items 7.01,9.01)
  3. 2026-08-31 litigation Data-breach class action filed: Polaniec v. McKesson Corporation (District Court, N.D. Texas)and 6 more class actions through 2026-09-09
  4. 2026-09-01 press Mind: McKesson breach: the risk of sensitive unstructured dataadded by hand
  5. 2026-09-10 report MirageSec: Inside the ShinyHunters vishing playbook: two captured Okta clones and a passkey bypassadded by hand

Cascade Coffee, LLC

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Aug 27, 2026 · 6 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-08-20 leak Cascade Coffee listed by akira
  2. 2026-08-26 notice Cascade Coffee, LLC filed a breach notice with the Washington Attorney General, 610 affected

Advantage Home Health Care

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Aug 26, 2026 · 39 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-07-17 leak Advantage Home Health Care listed by thegentlemen
  2. 2026-08-25 notice Advantage Home Health Care filed a breach notice with HHS OCR, 19,851 affected

ADT, Inc.

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Aug 24, 2026 · 26 days after the first signal · 2 of 3 parties

  1. 2026-07-28 notice ADT, Inc. filed a breach notice with the Oregon Department of Justice, 331,536 affected
  2. 2026-07-28 notice ADT, Inc. filed a breach notice with the Texas Attorney General, 32,546 affected
  3. 2026-07-28 notice ADT, Inc. filed a breach notice with the Washington Attorney General, 5,129 affected
  4. 2026-08-23 leak adt.com listed by lockbit5

Baraga County Memorial Hospital

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Aug 22, 2026 · 48 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-07-04 leak Baraga County Memorial Hospital listed by Wallstreet
  2. 2026-08-21 notice Baraga County Memorial Hospital filed a breach notice with HHS OCR, 501 affected

Gardiner Family Chiropractic, PC

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Aug 15, 2026 · 14 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-07-31 leak Gardiner Family Chiropractic listed by interlock
  2. 2026-08-14 notice Gardiner Family Chiropractic, PC filed a breach notice with HHS OCR, 5,000 affected

RingCentral, Inc.

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Jul 30, 2026 · 2 days after the first signal · 2 of 3 parties

Depends on a report added by hand after the outcome was known. Without it there is no match.

  1. 2026-07-27 leak RingCentral, Inc. listed by shinyhunters
  2. 2026-07-29 report Bridewell: From a Vishing Call to a Shared Shared Com Ecosystem Kit | BCON Collective by Bridewelladded by hand
  3. 2026-08-05 litigation Data-breach class action filed: Searle v. RingCentral, Inc. (District Court, N.D. California)

Ernst & Young LLP

Leak siteSEC filingBreach noticeResearch Class action

Would have flagged the morning of Jul 28, 2026 · 12 days after the first signal · 2 of 3 parties

  1. 2026-07-15 notice Ernst & Young LLP filed a breach notice with the California Attorney General
  2. 2026-07-17 notice Ernst & Young LLP filed a breach notice with the Texas Attorney General, 873 affected
  3. 2026-07-19 litigation Data-breach class action filed: Martinez v. Ernst & Young, LLP (District Court, S.D. New York)and 5 more class actions through 2026-07-27
  4. 2026-07-27 leak Ernst & Young listed by shinyhunters

The Lawson Roofing Co Inc.

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Jul 23, 2026 · 34 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-06-18 leak Lawson Roofing listed by rhysida
  2. 2026-07-22 notice The Lawson Roofing Co Inc. filed a breach notice with the California Attorney General

Michigan Surgical Center, LLC

Leak siteSEC filingBreach noticeResearch

Would have flagged the morning of Jun 10, 2026 · 6 days after the first signal · 2 of 3 parties

Depends on a breach notice from the October 28 backfill, dated by when it was submitted. The regulator may have posted it later, so this match may not have been possible as early as shown.

  1. 2026-06-04 leak Michigan Surgical Center listed by thegentlemen
  2. 2026-06-09 notice Michigan Surgical Center, LLC filed a breach notice with HHS OCR, 7,578 affected
Method deterministic · no model in the loop
Three parties
An organization converges when two of three parties name it. The attacker names it in a leak-site listing (ransomware.live). The victim names itself in an SEC filing (a Form 8-K reporting a cybersecurity incident under Item 1.05, 7.01 or 8.01) or a breach notice filed with a state attorney general or HHS; an 8-K and a notice from the same company count as one party. An analyst names it in research: vendor reports and government advisories collected by RSS, or a report added by hand, which is marked. A vendor writing about its own incident doesn’t count, and reposts of the same listing count once.
Corroboration
Press stories (DataBreaches.net) and data-breach class actions (complaints in federal court, via CourtListener) appear on a card when they name the organization. They can’t create a convergence by themselves, since most repeat a listing or a notice already on the card.
Fourteen days, or 120 for a notice
A signal counts toward a morning if it was published in the 14 days before. Breach notices trail the breach by weeks, so a notice can pair with another party’s signal up to 120 days apart, as long as the later of the two falls in the last 14 days. Sources that give only a date (filings, notices, press datelines) are treated as published at the end of that day, so nothing counts before it was public.
Exact names
Every source spells an organization its own way. Each name is reduced to a key: lowercase, without punctuation or corporate suffixes, or the registrable domain when there is one. Two signals join only when their keys match exactly. An early version matched on prefixes and joined every “National …” to every other. The exception is a short list of hand-checked matches, such as parkdental.com → Park Dental Partners, marked on any card that uses one. A report counts when it names the organization as a proper noun or lists an indicator domain containing its name.
What it misses
Private companies don’t file 8-Ks, so they can converge only through a breach notice or a report, and only eight states and HHS publish notices we can read (see sources). Leak sites censor some names, and a censored name can’t be matched. Organizations named with ordinary English words aren’t matched in report text. Reports come in by RSS, so a post a publisher leaves out of its feed arrives late or not at all.
What a convergence means
Independent parties are describing the same organization at the same time. A leak listing is a criminal’s claim, so a convergence doesn’t prove a breach happened, and it says nothing about who did it. Every signal is linked so you can check it.