Ransomware victim disclosure
← All victimsThe Country Club of Darien
Claimed by NIGHT SPIRE · listed 18 hours ago
Status timeline
- Listed
Jun 6, 2026
Current state: Listed for ransom
At a glance
- Group
- NIGHT SPIRE
- Status
- Listed for ransom
- Country
- US
- Sector
- Hospitality/Recreation
- Listed on leak site
- Jun 6, 2026
- Data size
- 600 GB
About the victim
AI dossier — public-source company profileThe Country Club of Darien is a private country club located in Darien, Connecticut. The club serves as a social and recreational facility offering golf, dining, and member amenities typical of upscale country club operations.
- Industry
- Hospitality/Recreation - Country Club
- Address
- Darien, CT, US
Attack summary
Severity: high — Confirmed exfiltration of 600 GB including sensitive operational, financial, payroll, HR, and member data from a private club. No proof files advertised, but data inventory scope and size suggest significant exposure of regulated information (payroll, tax records) and personal employee/member data.NIGHT SPIRE claims to have exfiltrated approximately 600 GB of data from The Country Club of Darien, including sales/commercial operations data, HR records, financial documents, payroll, tax records, compliance documentation, and operational/billing systems. The group lists the data as available but provides no downloadable proof or screenshots.
Data the group says was taken
AI dossier — extracted from the leak post- Sales and agent/commercial operations data
- Business administration and office operations files
- Board and executive governance records
- HR, recruiting, and employee discipline files
- Finance, payroll, tax, and audit records
- Regulatory and licensing compliance documents
- EMS operational reporting and quality assurance materials
- Operations and billing records
- Communications and media assets
- Security and identity administration files
The leak post
captured from the group's site- Financial Documents- HR Data- Supervisor's Information Data is not available now. Data is not available now. Data is not available now. [la familia adualt day center](http://www.lafamiliaadultdaycenter.com) Data is not available now. Data is not available now. - QuickBooks Files- Scanned tax returns- Proposal, Contrats- QuickBooks automated backups - Banking & Financial Records- Personal data- Critical POS Data - Banking & Financial Data- Accounting & Tax Records - Financial & Accounting Records- Human Resources- Sales & Marketing - Sales Related Documents- Human Resources- Sensitive Employee Records- Email and SMS Data Data is not available now. - Technical Documents- Financial Sheets- Contracts & Invoices- Business strategy files - MSSQL-DB- HR Documents- Contracts Data is not available now. [Progressive Oral Surgery & Implantology](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/progressiveoralsurgery.com) - Patients Information Records- Financial Records [The Country Club of Darien](http://nspirep7orjq73k2x2fwh2mxgh74vm2now6cdbnnxjk2f5wn34bmdxad.onion/CCDarien.org) - Sales / agent / commercial operations- Industrial / manufacturing / tooling business dat…
Data the group says was taken
- Sales / agent / commercial operations
- Industrial / manufacturing / tooling business data
- Research & development / technical project data
- Business admin / office operations
- Software / digital assets / branding
- Board / executive governance
- Security / identity administration
- HR / recruiting / discipline
- Finance / payroll / tax / audit
- Regulatory / licensing / compliance
- EMS operational reporting / QA / training
Screenshot of the leak post
Sources
Source
Indexed 18 hours agoThis page surfaces a public ransomware disclosure indexed by Darkfield. Original posts come from the operator's own leak site; we cross-check against ransomware.live, RansomLook and RansomWatch where applicable. Share this URL freely.
Is this your supplier? Your competitor? You?
Pro plans monitor your domain, corporate emails, and crypto wallets across every new ransomware leak-site post, breach dump and Telegram callout — alerts within 5 minutes.