Ransomware victim disclosure
← All victimsRainforest Carwash & Oil Change
listed as rainforestclean.com · Claimed by m3rx · listed 22 days ago
Status timeline
- Listed
Apr 29, 2026
- Data leaked
At a glance
- Group
- m3rx
- Status
- Data leaked
- Country
- US
- Sector
- Consumer Services
- Listed on leak site
- Apr 29, 2026
About the victim
AI dossier — public-source company profileRainforest Carwash & Oil Change is a US-based regional chain offering car wash and oil change services, with multiple locations. The company provides monthly unlimited wash plans, FastPass memberships, and gift cards, and is noted for community involvement and fundraising activities.
- Industry
- Car Wash & Quick Lube Services
Attack summary
Severity: high — 259 GB / 77k files of confirmed exfiltrated data from a multi-location consumer services business likely contains customer PII (membership, payment, contact info) and employee records; data is marked as published, increasing exposure risk.The m3rx group claims to have exfiltrated approximately 259 GB of data comprising roughly 77,000 files from Rainforest Carwash & Oil Change, with the data described as published (disclosed).
Data the group says was taken
AI dossier — extracted from the leak post- Business files (77k files, 259 GB)
- Potentially customer records (FastPass/membership data)
- Potentially employee records (careers/HR data)
- Potentially financial/operational data
What the group claims
Rainforest Carwash and Oil Change, along with it’s owner, enjoys giving back to our local community. Hopefully you are inspired to help after seeing the ways in which we try to help others. Stolen: 259gb 77k files
The leak post
captured from the group's siteIf you are interested in this data, please contact our support.Tox: 9A1217BEDA4AB77052A25D17CB6FFB34AFA2BE462E607F2FD8E1DF1DDD4CA16A64E18B1A0BF2
Sources
Source
Indexed 22 days agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
