Ransomware victim disclosure
← All victimsNeptune Mechanical, Inc.
Claimed by nightspire · listed 2 months ago
Status timeline
- Listed
Apr 3, 2026
- Data leaked
At a glance
- Group
- nightspire
- Status
- Data leaked
- Country
- US
- Sector
- Manufacturing
- Listed on leak site
- Apr 3, 2026
About the victim
AI dossier — public-source company profileNeptune Mechanical, Inc. is a licensed, insured, and bonded Class A HVAC contractor based in Virginia Beach, Virginia, providing residential and commercial plumbing, heating, air conditioning, ductwork, and indoor air quality services. The company serves Virginia Beach and surrounding areas including Chesapeake, Sandbridge, Pungo, and Dam Neck. It operates as a local/regional service provider reachable at 757-821-6984.
- Industry
- Plumbing, Heating & HVAC Services
- Address
- Virginia Beach, Virginia, US
Attack summary
Severity: high — The group claims confirmed exfiltration and has published data covering employee PII, payroll, HR records, and financial/accounting data — constituting sensitive regulated personal and financial information. While the company is a small regional contractor, the breadth of data categories (PII, financial, payroll) elevates this beyond medium, though the limited scale of the organisation prevents a critical rating.The Nightspire ransomware group claims to have exfiltrated data from Neptune Mechanical, Inc. and has published it; the disclosed data categories include banking and financial system records, accounting and tax records, payroll and employee financial data, HR and employee personal data, and real estate and tenant data.
Data the group says was taken
AI dossier — extracted from the leak post- Banking & financial system records
- Accounting & tax records
- Payroll & employee financial data
- HR & employee personal data
- Real estate & tenant data
What the group claims
- Banking & Financial Systems- Accounting & Tax Records- Payroll & Employee Financial Data- HR & Employee Personal Data- Real Estate & Tenant Data
Sources
- Victim sitecallneptune.com
Source
Indexed 2 months agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
