THREAT WATCH · September 29, 2026 · RANSOMWARE LISTING

Insurance Claims Firm Listed on BRAINCIPHER Ransomware Tracker

A US-based organization operating in the insurance claims sector was recorded on the BRAINCIPHER ransomware tracker on September 29, 2026. The listing, identified by the domain mccordclaims.com, places the company in a high-risk posture given its sector and size. No public disclosure has been made by the organization as of the time of this report.

Key takeaways

• mccordclaims.com was recorded on the BRAINCIPHER tracker on September 29, 2026
• The organization operates in the Finance, Legal, and Insurance sector in the United States
• No public disclosure has been made by the organization as of this report
• A listing is a strong signal of targeting but does not confirm a confirmed data breach

What was recorded

The Intel128 tracker recorded a new entry on the BRAINCIPHER ransomware group's leak site. The entry references mccordclaims.com, a domain associated with an organization in the Finance, Legal, and Insurance sector. The listing date is September 29, 2026. The organization is based in the United States and employs more than 1,000 people.

A listing on a ransomware tracker means the group has published the organization's name or domain, typically as a pressure tactic to encourage payment. It does not confirm that data was exfiltrated or that systems were compromised. However, it is a strong indicator that the organization was targeted and that the attackers believe they hold leverage.

Why this matters

Several factors make this listing worth attention for security teams and executives:

• Sector exposure. Finance, legal, and insurance organizations routinely handle sensitive personal and financial data. A breach in this space carries regulatory and reputational risk that extends well beyond IT.
• Scale. With more than 1,000 employees, the organization likely has a broad digital footprint, multiple business units, and a large attack surface. Larger environments tend to have more integration points and legacy systems that can be exploited.
• Group activity. BRAINCIPHER is an active ransomware operation. Organizations listed by this group should treat the listing as a signal to verify their incident response posture immediately.
• No public disclosure yet. The absence of a public statement does not mean the organization is unaffected. It may indicate that internal investigation is still underway, or that the organization has not yet determined whether data was actually taken.

Recommended actions

Security leaders at this organization and similar entities should consider the following steps:

• Review network logs around the listing date for unusual outbound traffic or data staging activity.
• Confirm that all critical systems have tested, offline backups and that recovery procedures are current.
• Engage legal counsel to assess notification obligations under applicable state and federal regulations.
• Brief executive leadership and the board on the current status, even if the situation remains unresolved.
• Monitor the BRAINCIPHER tracker for any additional entries or data samples that may indicate what the group claims to hold.

Context on the listing process

Ransomware groups typically publish listings in stages. A domain may appear first as a teaser, followed by a countdown timer, and then by data samples if no payment is made. The presence of a listing alone does not confirm that data was stolen. Some groups list organizations they have contacted but not yet breached. Others list organizations where they believe they have exfiltrated data but have not yet released proof.

Intel128 will continue to monitor this entry and update this post if new information becomes available.

SOURCE: INTEL128 THREAT INTELLIGENCE FEED (UPDATED OCT 01, 2026). A listing is a record on an attacker-side ransomware tracker - strong signal, not a confirmed breach. Intel128 publishes what the feed shows and no more.