Ransomware victim disclosure
← All victimsHy-Vee
Claimed by Stormous · listed 2 months ago
Status timeline
- Listed
Mar 29, 2026
- Data leaked
At a glance
- Group
- Stormous
- Status
- Data leaked
- Country
- United States
- Sector
- Retail
- Listed on leak site
- Mar 29, 2026
- Data size
- 33 GB
- Ransom demanded
- $900
About the victim
AI dossier — public-source company profileHy-Vee, Inc. is a large employee-owned supermarket chain headquartered in West Des Moines, Iowa, operating more than 285 retail stores primarily across the Midwestern United States. The company offers grocery, pharmacy, fuel, and food service operations and is consistently ranked among the largest private companies in the United States. It employs tens of thousands of workers across its store network and corporate operations.
- Industry
- Grocery & Supermarket Retail
- Employees
- 10001+
- Founded
- 1930
Attack summary
Severity: high — Confirmed exfiltration of 33 GB of data including employee PII and internal infrastructure details, with the group actively publishing the data following refusal to pay; however, the specific data types described are business/operational rather than clearly regulated medical or financial data at scale.Stormous claims to have exfiltrated data from Hy-Vee after the company refused to pay a $900 ransom, and is proceeding to leak approximately 33 GB of extracted data including internal documents, infrastructure diagrams, employee data, and training materials.
Data the group says was taken
AI dossier — extracted from the leak post- Internal documents
- Infrastructure diagrams
- Employee data
- Training materials
What the group claims
Access obtained through compromised Atlassian accounts including Confluence and Jira. Internal documents, infrastructure diagrams, employee data, training materials, technical information related to operational systems
The leak post
captured from the group's siteInitial Access Brokers - Long-Term Collaboration We are currently seeking reliable Initial Access Brokers for long-term collaboration. ** Please do not waste time attempting complex exploit development or direct EDR confrontation. We are interested exclusively in stable corporate access. Local user access is acceptable. * Small to mid-sized enterprises: fixed payment starting at * Large enterprises: revenue share from final settlement FANASA.COM Half the data has been extracted Personally Identifiable Information (PII), Electronic Fiscal Documents (CFDI/XML), Financial Transaction Records, Commercial Invoices & Billing Data, Taxpayer Identification Numbers (RFC), Client & Vendor Database/Internal Corporate Documentation Administrative/System Files/ADMIN, DOAS, operational records, engineering drawings, schematics... Project Planning & Execution Documents... (Folders/Files) Email/Communication/System/Application Data AYEAPLICACIONES database/Log Data BDATOSFITCLOD, Software/Installation/Program Files AUTOBOU, Personal/Miscellaneous Files AvenaCubana All of this data is offered for sale (user information: email, phone number, full name, date of birth / payment and bookin…
Data the group says was taken
- PII
- passwords
- source_code
Sources
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
