On April 18, 2025, the website Orl***********.com appeared on the leak site operated by the cloak ransomware group, which claims to have stolen and exfiltrated internal files during a ransomware attack. Anyone whose personal information, customer records, or contact details were stored in those systems may now be at risk of identity theft, phishing, or doxxing if the data becomes public or is sold on underground forums.
Already exposed?
You can’t unleak data. You can take away what it’s worth.
A leaked record is where it starts, not where it ends. What turns it into your front door is the look-up sites publishing your address beside your name — and those are what an AI reads when somebody asks about you. The free scan shows you both. We write to 580 companies.
See what is exposed about you — free scan →Watch Orl***********.com
Get alerted the next time Orl***********.com files a breach with any US regulator — the filing, dated and sourced. A free single-company slice of Signals; no account needed.
We’ll email you only about Orl***********.com’s future breach filings and how to watch a whole vendor list — not general marketing. Unsubscribe any time.
Watching your whole vendor list (50 to 500 companies, by tier) is GalaxyWarden Signals.
What Public Reporting Shows
Public reporting indicates the cloak ransomware group added Orl***********.com to its leak site on April 18, 2025. The group states it successfully exfiltrated internal files before encrypting systems or demanding payment. The exact number of people affected remains unknown, and the precise data types have not been independently verified beyond the group’s claim of internal files. No evidence has surfaced yet showing the full dataset for sale or freely downloadable, but ransomware operators routinely release or auction stolen data when victims do not pay.
Why This Matters for You and Your Family
When a company that holds names, addresses, phone numbers, email accounts, or payment details suffers a breach, that information can quickly reach people who want to impersonate you, open accounts in your name, or target your family with scams. Children’s records are especially valuable because they often lack credit history and can be used for years before detection. Even if you never directly used Orl***********.com, shared family records or joint accounts may still expose you. The breach adds one more credential or personal detail to the growing pool of information criminals stitch together.
The Doxxing and Identity-Chain Risks
Ransomware leaks like this one frequently cascade into doxxing chains. A single exposed email or username can be linked to gaming accounts, social-media handles, and family addresses. Once attackers map these connections, they can harass you, impersonate family members, or sell the full profile on specialized doxxing marketplaces. Credential leaks from one service are routinely tested against gaming platforms, where weak or reused passwords lead to account takeovers that reveal even more personal data, including chat logs, payment methods, and linked phone numbers.