Ransomware Group: WORLDLEAKS

VICTIM NAME: Sapp Bros

NOTE: No files or stolen information are [exfiltrated/downloaded/taken/hosted/seen/reposted/disclosed] by RedPacket Security. Any legal issues relating to the content of the files should be directed at the attackers directly, not RedPacket Security. This blog is simply posting an editorial news post informing that a company has fallen victim to a ransomware attack. RedPacket Security is in no way affiliated or aligned with any ransomware threat actors or groups and will not host infringing content. The information on this page is fully automated and redacted whilst being scraped directly from the WORLDLEAKS Onion Dark Web Tor Blog page.

AI Generated Summary of the Ransomware Leak Page

The leak page centers on Sapp Bros, a United States–based operator of a Midwest network of service centers and travel plazas. The company, described in the page’s content as having been founded in 1971, now operates 17 full‑service travel centers offering restaurants, merchandise, fuel products, truck service centers, and petroleum and propane services. The available data identifies the leak post date as September 23, 2025 at 17:30:44, and notes that no compromise date is provided in the text, so this timestamp is treated as the leak post date.

The post is associated with a ransomware context and lists Sapp Bros as a victim within the worldleaks campaign. A claim URL is indicated on the leak page, though the exact address is not reproduced here. The dataset shows no screenshots or image content on this listing (zero images) and there are no downloadable files mentioned. No ransom amount is provided in the available data. Taken together, the content reflects a data‑exfiltration narrative typical of ransomware leak posts, with the stated post date serving as the published date in the absence of a separate compromise date.