FrenchCreek Production

This record is a provider-reported ransomware claim attributed to akira. It is an allegation and has not been independently confirmed.

Claim context

Provider-reported sector: Energy & Utilities
Provider-reported country: United States
Group-published claim date: 2026-10-30T00:00:00.000Z
First tracked: 2026-10-30T14:29:54.286Z
Last observed: 2026-10-30T16:26:06.000Z
Monitoring providers: 4
Independent monitoring providers: 4
Website: fcsafety.com
Post URL: https://cybercrime.works/leaks/cc31c930-53b4-453c-9f36-b1fbff7e178a
Data source: unified
Duplicate records merged: 3

Provider observation timeline

Newest observations first. Provider observations are not independent confirmation of an incident.

Monitoring provider: observed 2026-10-30T16:26:06.000Z; source-published 2026-10-30T16:26:06.000Z; retrieved 2026-11-02T09:21:51.155Z.
Monitoring provider: observed 2026-10-30T15:26:06.807Z; source-published 2026-10-30T15:26:06.807Z; retrieved 2026-10-30T15:31:03.016Z.
Monitoring provider: observed 2026-10-30T15:01:56.662Z; source-published 2026-10-30T00:00:00.000Z; retrieved 2026-11-03T10:05:19.544Z.
Monitoring provider: observed 2026-10-30T14:29:54.286Z; source-published 2026-10-30T00:00:00.000Z; retrieved 2026-10-30T15:01:02.832Z.

Provider records

Every stored provider record behind this claim, newest first.

Provider credit
RansomFeed.it
Provider URL
https://ransomfeed.it/
Feed id
ransomfeed
Provider record id
37693
Observed
2026-10-30T16:26:06.000Z
Source-published
2026-10-30T16:26:06.000Z
Retrieved
2026-11-02T09:21:51.155Z
Format
json-array
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
RansomLook
Provider URL
https://www.ransomlook.io/
Feed id
ransomlook
Provider record id
derived-sha256:b3536d724f1f73c838f873fd28222d3f854b0bf38a730ba9370cb05d27ed9965
MISP event UUID
d59e3690-ecc7-5c1b-b18c-73d5711e10f1
Observed
2026-10-30T15:26:06.807Z
Source-published
2026-10-30T15:26:06.807Z
Retrieved
2026-10-30T15:31:03.016Z
Format
json-array
Transport
https-rest
Overlap class
primary
Independent corroboration
yes
Provider credit
ransomware.live
Provider URL
https://www.ransomware.live/
Feed id
privtools-ransomposts
Provider record id
derived-sha256:ec3ce3b63ccffb80ffec6d57ccde6f0f6071337929dac8bbc32a7d3406583ac4
Observed
2026-10-30T15:01:56.662Z
Source-published
2026-10-30T00:00:00.000Z
Retrieved
2026-11-03T10:05:19.544Z
Format
json-array
Transport
https-json
Overlap class
primary
Independent corroboration
yes
Provider credit
cybercrime.works
Provider URL
https://cybercrime.works/leaks/cc31c930-53b4-453c-9f36-b1fbff7e178a
Feed id
cybercrime-works
Provider record id
cc31c930-53b4-453c-9f36-b1fbff7e178a
Observed
2026-10-30T14:29:54.286Z
Source-published
2026-10-30T00:00:00.000Z
Retrieved
2026-10-30T15:01:02.832Z
Format
paginated-rest
Transport
https-rest
Overlap class
primary
Independent corroboration
yes

Tracker record history

Newest entries first. These dates describe tracker records, not attack dates.

Provider update: recorded 2026-11-02T09:25:26.255Z; associated provider observation 2026-10-30T14:29:54.286Z.
Provider update: recorded 2026-10-30T15:31:32.768Z; associated provider observation 2026-10-30T14:29:54.286Z.
Initial tracker record: recorded 2026-10-30T15:07:31.572Z; associated provider observation 2026-10-30T14:29:54.286Z.