Ransomware victim disclosure
← All victimsTricolor Holdings
Claimed by kittykatkrew · listed 3 months ago
Status timeline
- Listed
Feb 25, 2026
- Ransom deadline
Mar 3, 2026
- Data leaked
At a glance
- Group
- kittykatkrew
- Status
- Data leaked
- Country
- United States
- Sector
- Financial Services
- Listed on leak site
- Feb 25, 2026
- Ransom deadline
- Mar 3, 2026
About the victim
AI dossier — public-source company profileTricolor Holdings is a mission-driven auto lender based in the United States focused on expanding access to affordable vehicle ownership, particularly for underserved communities. The company operates in the consumer finance sector, providing subprime or near-prime auto loans nationwide. No further operational details are publicly available from the provided sources.
- Industry
- Automotive Lending & Consumer Finance
Attack summary
Severity: high — Tricolor Holdings operates as an auto lender handling consumer financial and PII data at scale; a disclosed ransomware/extortion event in financial services involving potential customer financial records warrants high severity, even without explicit proof of exfiltration volume, given the regulated nature of the data and the 'data_published' disclosure status.The kittykatkrew ransomware group claims an attack on Tricolor Holdings and has published the disclosure with a contact deadline of 2026-03-03, indicating a ransomware or extortion event; the post notes the status as 'Awaiting Contact,' suggesting the group is pressuring the victim to negotiate but has not yet detailed specific data exfiltrated or encrypted.
Data the group says was taken
AI dossier — extracted from the leak post- Potentially customer loan records
- Potentially personal financial information
- Potentially employee data
What the group claims
Mission-driven auto lender expanding access to affordable vehicle ownership nationwide. Deadline: 2026-03-03T00:00:00+00:00 Status: Awaiting Contact
Sources
Source
Indexed 3 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
