Space Bears Ransomware Gang Leaks Sensitive Data from Victorian Financial Firm 3P Corporation In early April, the Russia-linked ransomware group Space Bears listed 3P Corporation, a Melbourne-based financial services firm, as a victim on its darknet leak site. The hackers claimed to have stolen a trove of sensitive data, including financial documents, employee records, and client information. By 10 April, Space Bears published details of the alleged breach, setting a ransom deadline of 18 April. After the deadline passed, the group released a 213.3GB compressed archive on a public file-hosting site, which had been downloaded 196 times by the time of reporting. The leaked data includes: - Hundreds of authority-to-deduct forms with full bank details and customer signatures - Trust account statements and remittance advices on 3P letterhead - Employee payslips, internal templates, and files on over 4,500 business clients, including tax returns and signed deeds - A document containing over 2,700 tax file numbers 3P Corporation, a holding company founded in 2013 by TV personality Peter Ziggy, provides accounting, tax, financial planning, and legal services. A spokesperson confirmed the 7 April attack, stating that their systems detected the intrusion before data could be encrypted. However, the leaked files suggest otherwise. The company reported the incident to the Australian Signals Directorate’s Australian Cyber Security Centre (ACSC) and notified staff and potential clients. Space Bears, a relatively new ransomware group that emerged in April 2024, has claimed 71 victims to date, including NSW charity Christian Community Aid in January 2025. The group’s tactics highlight the growing threat of ransomware attacks targeting financial and professional services firms.