YOUR SITE HAS BEEN TAKEN OFFLINE

Reference: KC-2841 · Issued: 2026-09-05

To the team behind kenshin-co.com,

An unauthorized actor has gained full administrative control of this server and encrypted the files it serves using AES-256. Encrypted files now carry a .lock suffix. Your site is offline, and it will stay that way until you pay.

What we have

• A full copy of your database, taken off the server before encryption — every client inquiry and business lead on file (names, companies and e-mail addresses), plus all staff and administrator accounts.
• This data is already copied off the server and is ready to be published or sold to the highest bidder.

What you must do

Send exactly 25.30 XMR (approximately $3,000 USD) to the Monero address below:

The decryption key will be delivered to you only after your transaction is confirmed on-chain. Until that happens, no file can be recovered and no copy of your data will be released.

How to contact us

Use our secure payment portal: http://2hqu7zpp4gn3qkxgume2r7in5goy54kuzcexgqfsmbuvbet4ae5vdzqd.onion/. It is only reachable through the Tor network — get the Tor Browser from torproject.org, then open the address above. After sending your payment, submit your case code KC-2841 and the Monero transaction hash (txid) on the portal. We respond to every inquiry.

Deadline: 72 hours

You have 72 hours from the moment you read this. After that, we will publish your client inquiries and staff data, or sell them to the highest bidder. As a company that sells cybersecurity, a publicized breach through an unpatched WordPress install is a cost no backup restores — on request we will publish the full incident write-up alongside the data. Restoring your site from any backup will not give you back what we have: a complete copy of your database is already off this server and in our possession.

— WURM