Skip to main content
Darkfield

Ransomware victim disclosure

← All victims

Turn5, Inc.

Claimed by GLOBAL SECRET · listed 4 hours ago

328 GB (26,503 Files, 446 Folders)
Data size
26503 files records
Today
Age
since listed · listed for ransom

Status timeline

  1. ListedOct 6, 2026

Current state: Listed for ransom

At a glance

Group
GLOBAL SECRET
Status
Listed for ransom
Country
United States
Sector
Automotive Aftermarket, Auto Parts
Listed on leak site
Oct 6, 2026
Data size
328 GB (26,503 Files, 446 Folders)
Records
26503 files

About the victim

AI dossier — public-source company profile

Turn5, Inc. is an e-commerce retailer founded in 2003 and headquartered in Paoli, Pennsylvania, specializing in aftermarket auto parts. The company operates three primary brands—AmericanMuscle.com, ExtremeTerrain.com, and AmericanTrucks.com—serving enthusiasts in the muscle car, Jeep, and truck customization markets. With 400+ employees and approximately $84.4 million in annual revenue, Turn5 is a prominent player in the high-growth automotive aftermarket retail sector.

Industry
Automotive Aftermarket, Auto Parts & E-commerce
Address
Paoli, PA 19301, US
Employees
400-500
Founded
2003

Attack summary

Severity: high — Confirmed exfiltration of 328 GB of corporate data from a company with 400+ employees and significant customer base. The large volume and breadth of files (26,503 files across 446 folders) suggests exposure of sensitive business, employee, and potentially customer data, typical of a major e-commerce operation. No specific data categories are detailed, but the scale indicates material business and personal information at risk.

GLOBAL SECRET claims to have exfiltrated 328 GB of data comprising 26,503 files and 446 folders from Turn5's systems. The leak post does not specify the encryption status or detail which data categories were compromised, only that the files have been collected and are being published.

high

Data the group says was taken

AI dossier — extracted from the leak post
  • Corporate files and documents
  • Business records
  • Employee information
  • Customer data
  • Financial records

What the group claims

Located on their corporate campus in Paoli, PA, Turn5, Inc. is an e-commerce business specializing in the aftermarket auto parts industry. Founded by Andrew and Steve Voudouris, Turn5, Inc. is the operating company for award winning stores, AmericanMuscle.com, ExtremeTerrain.com and AmericanTrucks.com. Turn5 has grown exponentially and is poised to continue this expansion. With 400+ employees, the Turn5 team is driven by the company's emphasis on the customer experience and going above and beyond for their customers.

The leak post

captured from the group's site
Country: Pennsylvania 19301, US | Website: turn5.com | Revenue: $84.4 Million | Industry: Automotive Aftermarket, Auto Parts | Employees: 300-500 | Properties: 328 GB (26,503 Files, 446 Folders)
Located on their corporate campus in Paoli, PA, Turn5, Inc. is an e-commerce business specializing in the aftermarket auto parts industry. Founded by Andrew and Steve Voudouris, Turn5, Inc. is the operating company for award winning stores, AmericanMuscle.com, ExtremeTerrain.com and AmericanTrucks.com. Turn5 has grown exponentially and is poised to continue this expansion. With 400+ employees, the Turn5 team is driven by the company's emphasis on the customer experience and going above and beyond for their customers. Through their focus on providing prompt service and product delivery, Turn5 offers free same day shipping, pre-painted accessories and catalogs to supplement its robust website. The company's relationships – with car manufacturers, vendors, customers, civic organizations and collaborative partners – are important components to its growth. But Turn 5's leadership and its employees are truly the heart-and-soul. By working collaboratively every day with the brightest minds in tech…

Screenshot of the leak post

Leak screenshot for Turn5, Inc.

Sources

Source

Indexed 4 hours ago

This page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.

Is this your supplier? Your competitor? You?

Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.

Disclosure context

About GLOBAL SECRET

GLOBAL SECRET is an active ransomware group with 19 confirmed victims as of August 2026. It operates a single onion leak site. The limited victim count suggests a relatively early or low-volume operation. The group has been linked to 44 public disclosures across our corpus. The operation is currently active.

Timeline of this disclosure

  • October 6, 2026Turn5, Inc. listed by GLOBAL SECRET on the group's public leak site
Data size
328 GB (26,503 Files, 446 Folders)
Records
26503 files

Other recent disclosures by GLOBAL SECRET

GLOBAL SECRET has been linked to 44 public victims on Darkfield. A sample of the most recent:

See the full GLOBAL SECRET dossier →

Sector and geography

This disclosure adds to ransomware activity in the Automotive Aftermarket, Auto Parts sector. Geographically, Turn5, Inc. is reported in United States, a country with 3,175 ransomware disclosures in our corpus.

If your organisation is affected

A listing by GLOBAL SECRET means Turn5, Inc. appeared on a ransomware extortion site and is being pressured to pay before any publication. If this is your organisation, or a supplier you depend on, the priority is to confirm the intrusion and contain it before the window to act closes.

  • Engage your incident-response team and preserve forensic evidence before remediating — do not wipe affected systems first.
  • Force a password reset and revoke active sessions for exposed accounts; rotate any credentials, API keys or certificates that may have been in the stolen data.
  • Assess regulatory notification duties (GDPR, NIS2, sector regulators) — many carry a 72-hour reporting clock from awareness.
  • Report the incident to your national CERT, CISA (United States), as required for your jurisdiction.
  • Monitor for the data appearing on GLOBAL SECRET's leak site and across paste and breach channels, and brief downstream partners who may be exposed through you.

How we know this. Darkfield monitors public ransomware leak sites continuously, archiving every new disclosure and the data later released against the victim. Each entry on this page is sourced from the operator's own publication and cross-checked against complementary OSINT feeds (RansomLook, ransomware.live, RansomWatch). We do not collect or host stolen data — only the metadata, timestamps and screenshots needed to make the public disclosure searchable and accountable. Records here are corrected when the original post is edited, retracted, or merged with another disclosure.