Wilbert's

Wilbert's Family Enterprises, a New York automotive recycling company, was listed on the leak site of the qilin ransomware group on July 27, 2026. The listing, tracked by Ransomware.live and reported by HookPhish, claims the company's data was stolen during a ransomware attack. Qilin practices double extortion, meaning it typically demands payment both for a decryption key and to withhold stolen files from publication.

According to our investigation team, the breach involves roughly 106,010 rows of data tied to wilberts.com. Our team estimates the attack occurred on or around July 27, 2026. Wilbert's, founded in 1952 and based in the Rochester, NY area, operates auto parts stores, U-Pull It salvage yards, a tires and wheels shop, and a Christmas tree farm, which helps explain why vehicle records dominate the exposed data. The listing is the attacker's claim, and it does not by itself confirm what was taken. Company confirmation has not been located in sources reviewed as of September 25, 2026.

Limited public reporting: As of September 25, 2026, detailed company notices or major news coverage for this listing were limited in sources reviewed. The facts below rely primarily on the indexed fields plus any secondary sources cited.

What Information Was Compromised?

Our analysis found the following data types in this breach: names, street addresses, phone numbers, email addresses, dates of birth, Social Security numbers, driver's license numbers, vehicle identification numbers (VINs), and vehicle license plate numbers. The counts our team indexed include 80,920 names, 106,010 vehicle VINs, 48,745 street addresses, 48,305 phone numbers, 32,849 email addresses, 1,394 birthdays, 153 Social Security numbers, 82 license plates, and 4 driver's license numbers. Every record in the dataset includes a VIN, consistent with the company's auto parts and salvage business.

Not every individual is affected by every type of data listed here.

What Are the Potential Risks for Affected Individuals?

The combination of names, addresses, phone numbers, dates of birth, and Social Security numbers is enough for identity thieves to attempt account fraud, tax-related scams, or credit applications in someone else's name. Exposed email addresses and phone numbers feed targeted phishing, where scammers use real personal details to appear convincing. VINs and license plates are less sensitive on their own, but they can support vehicle-related scams, such as fake warranty offers or title fraud, when paired with names and addresses. Because only a small number of Social Security numbers and driver's licenses appear in the indexed data, the highest exposure for most people is contact information that fuels phishing rather than direct identity theft.

What Should You Do If You Were Affected?

If you have done business with Wilbert's or believe your data is in this breach, take these steps:

Review your credit reports at annualcreditreport.com and place a fraud alert or credit freeze with Equifax, Experian, and TransUnion.

Watch bank, credit card, and insurance statements for unfamiliar activity.

Be skeptical of unexpected calls, texts, or emails referencing your vehicle, its VIN, parts orders, or account details. Verify any claim by contacting the company directly through a number you look up yourself.

If your Social Security number was exposed, consider requesting a free IRS Identity Protection PIN to block fraudulent tax returns.

Change passwords on accounts that reuse credentials you may have shared with the company.