Ransomware victim disclosure

La Familia Adult Day Center

Claimed by NIGHT SPIRE · listed 18 hours ago

Today

Age

since listed · listed for ransom

Status timeline

Listed
Jun 6, 2026

Current state: Listed for ransom

At a glance

Group: NIGHT SPIRE
Status: Listed for ransom
Sector: Healthcare
Listed on leak site: Jun 6, 2026

About the victim

AI dossier — public-source company profile

La Familia Adult Day Center is a healthcare facility providing adult day care services. Based on the clearnet domain, the organization operates as a community health service provider.

Industry: Healthcare Services

Attack summary

Severity: medium — Claimed exfiltration of HR data, PII, and financial records from a healthcare organization; however, no proof files are currently accessible ('Data is not available now' repeated throughout), limiting confidence in the breach claim. Medium severity due to healthcare sector sensitivity and apparent scope of data types, but lack of proof reduces classification.

NIGHT SPIRE claims to have exfiltrated financial documents, HR data, supervisor information, QuickBooks files, tax returns, contracts, banking records, PII, and critical operational data. No proof files are currently accessible.

medium

Data the group says was taken

AI dossier — extracted from the leak post

Financial documents
HR data
Supervisor information
QuickBooks files
Scanned tax returns
Contracts
Banking & financial records
Personal data
POS data
Accounting & tax records
Email and SMS data
Employee records

The leak post

captured from the group's site

- Financial Documents- HR Data- Supervisor's Information
Data is not available now.
Data is not available now.
Data is not available now.
[la familia adualt day center](http://www.lafamiliaadultdaycenter.com)
Data is not available now.
Data is not available now.
- QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups
- Banking & Financial Records- Personal data- Critical POS Data
- Banking & Financial Data- Accounting & Tax Records
- Financial & Accounting Records- Human Resources- Sales & Marketing
- Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data
Data is not available now.
- Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files
- MSSQL-DB- HR Documents- Contracts
Data is not available now.
[Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com)
- Patients Information Records- Financial Records
[The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org)
- Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…

Screenshot of the leak post

Leak screenshot for La Familia Adult Day Center

Sources

Victim sitehttp://www.lafamiliaadultdaycenter.com
Leak posthttp://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/database

Source

Indexed 18 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About NIGHT SPIRE

NIGHT SPIRE is a ransomware group first observed in June 2026 with an apparent primary motivation of financial gain, having claimed at least 14 known victims across multiple continents within a relatively short operational window. Given the group's recent emergence and limited public documentation by major threat intelligence organizations such as CISA, FBI, or Mandiant at this time, a comprehensive technical profile cannot be fully established from open sources. Their targeting pattern, based on available victim data, reflects a geographically diverse focus spanning the United States, Singapore, Brazil, Panama, and Spain, suggesting either an opportunistic targeting approach or a deliberate strategy to operate across jurisdictions that complicate law enforcement coordination. The sectors most frequently impacted include Healthcare, Recruitment and Staffing, Hospitality and Recreation, Commerce and Trade, and Automotive, indicating the group likely targets organizations perceived as having lower cybersecurity maturity or higher operational pressure to restore services quickly, both of which increase ransom payment likelihood. No confirmed affiliations to known ransomware-as-a-service ecosystems, nation-state actors, or predecessor groups have been publicly documented as of this writing. NIGHT SPIRE's operational status as of mid-2026 reflects an active and emerging threat actor, and the breadth of their targeting across critical and commercially sensitive sectors warrants continued monitoring by defenders, particularly those operating in the identified high-risk verticals and geographies. The group has been linked to 14 public disclosures across our corpus. First observed on a leak site on June 6, 2026. The operation is currently active.

Also tracked as: nightspire.

Timeline of this disclosure

June 6, 2026La Familia Adult Day Center listed by NIGHT SPIREon the group's public leak site

Other recent disclosures by NIGHT SPIRE

NIGHT SPIRE has been linked to 14 public victims on Darkfield. A sample of the most recent: