Orient Corporation

This record is a provider-reported ransomware claim attributed to Orova. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Fire Suppression / Safety
Group-published claim date: 2026-10-14T00:00:00.000Z
First tracked: 2026-10-14T05:09:09.396Z
Last observed: 2026-10-14T09:33:02.171Z
Monitoring providers: 4
Independent monitoring providers: 4
Post URL: https://cti.fyi/
Data source: unified
Duplicate records merged: 4

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-10-14T09:33:02.171Z; source-published 2026-10-14T09:33:02.171Z; retrieved 2026-10-14T07:41:52.901Z.
Monitoring provider: observed 2026-10-14T09:33:02.171Z; source-published 2026-10-14T09:33:02.171Z; retrieved 2026-10-14T16:41:56.195Z.
Monitoring provider: observed 2026-10-14T07:45:31.232Z; source-published 2026-10-14T07:45:31.232Z; retrieved 2026-10-14T07:41:52.901Z.
Monitoring provider: observed 2026-10-14T05:09:09.396Z; source-published 2026-10-14T00:00:00.000Z; retrieved 2026-10-22T12:19:46.633Z.
Monitoring provider: observed 2026-10-14T05:09:09.396Z; source-published 2026-10-14T04:58:11.000Z; retrieved 2026-10-15T00:26:58.712Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:3358088a3eb375a42a4c95bbb8d40ea4922c6591dccb00efdd9a2aa14eec0e16
MISP event UUID
068540d0-e24d-5683-a998-90b1e6bcbcad
Observed
2026-10-14T09:33:02.171Z
Source-published
2026-10-14T09:33:02.171Z
Retrieved
2026-10-14T07:41:52.901Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
Darkfield by Orizon
Provider URL
https://darkfield.orizon.one/victims/e22e3156-55a2-497d-ac33-b0402267afb2
Feed id
darkfield
Provider record id
e22e3156-55a2-497d-ac33-b0402267afb2
Observed
2026-10-14T09:33:02.171Z
Source-published
2026-10-14T09:33:02.171Z
Retrieved
2026-10-14T16:41:56.195Z
Format
json-object
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/ce47c1c7-b163-4be7-9f1c-c08a083bb498
Feed id
cybercrime-works
Provider record id
ce47c1c7-b163-4be7-9f1c-c08a083bb498
Observed
2026-10-14T07:45:31.232Z
Source-published
2026-10-14T07:45:31.232Z
Retrieved
2026-10-14T07:41:52.901Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:f3aa7f15314c82b5f892407b71aade53e3eb730c162d838f45a7661922e15132
Observed
2026-10-14T05:09:09.396Z
Source-published
2026-10-14T00:00:00.000Z
Retrieved
2026-10-22T12:19:46.633Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
CTI.FYI
Provider URL
https://cti.fyi/
Feed id
cti-fyi
Provider record id
derived-sha256:e723404381d696410f5c30b6cd4a490a6d19f344f1bc76f458a9a8cc1a173ef3
Observed
2026-10-14T05:09:09.396Z
Source-published
2026-10-14T04:58:11.000Z
Retrieved
2026-10-15T00:26:58.712Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-10-22T12:23:46.455Z; associated provider observation 2026-10-14T05:09:09.396Z.
Provider update: recorded 2026-10-15T04:03:31.171Z; associated provider observation 2026-10-14T05:09:09.396Z.
Provider update: recorded 2026-10-15T00:30:53.744Z; associated provider observation 2026-10-14T05:09:09.396Z.
Provider update: recorded 2026-10-14T07:46:13.127Z; associated provider observation 2026-10-14T07:45:31.232Z.
Initial tracker record: recorded 2026-10-14T07:43:57.175Z; associated provider observation 2026-10-14T09:33:02.171Z.