# ZIRNET LLC — Managed Service Provider — FULL BREACH **Published:** October 2026 **Sector:** Information Technology / Managed Services (MSP) **Location:** Port Washington, New York, USA **Website:** zirnet.com --- ## Summary ZIRNET LLC is a Managed Service Provider (MSP) based in Long Island, New York, providing IT management, cloud services, VoIP, and network infrastructure to over 20 small and mid-size businesses across New York, New Jersey, and Florida. We have obtained **complete access** to ZIRNET's internal servers, including **all client data they manage**. This represents a catastrophic MSP supply-chain breach affecting **13+ organizations** and hundreds of individuals. **Total data: 2,260,963 files across ZIRNET and 12 client server backups.** --- ## Affected Organizations ZIRNET's negligent security practices have resulted in the exposure of the following companies' complete IT environments: | # | Company | Industry | Location | Files | |---|---------|----------|----------|-------| | 1 | **AlphaOne USA LLC** | Marine & Construction Supply | Miami, FL / Long Island City, NY | 148,118 | | 2 | **ASK Construction Corp** | General Contracting | New York, NY | 92,247 | | 3 | **Dynotec Contracting Inc (DCI)** | Construction | Brooklyn, NY | 180,858 | | 4 | **Industrial Solutions NY (ISNY)** | Industrial Supply & Services | New York, NY | 262,702 | | 5 | **King Contracting Corp** | General Contracting | New York, NY | 67,997 | | 6 | **Lanmark General Contracting** | General Contracting | New York, NY | 251,861 | | 7 | **M&M Plumbing & Heating NY** | Plumbing & HVAC | New York, NY | 122,626 | | 8 | **Pibbs Industries** | Salon Equipment Manufacturing | Hauppauge, NY | 214,495 | | 9 | **Rising Sun General Contracting** | General Contracting | New York, NY | 340,559 | | 10 | **Seabreeze General Contracting** | General Contracting | New York, NY | 53,665 | | 11 | **The USA Roofer / USA GC** | Roofing & Contracting | NY / FL | 469,495 | | 12 | **Tristate Safety Corp** | Safety Products & Services | New York, NY | 53,597 | **Additional organizations with exposed credentials and data:** - Skylatus Property Capital LLC (Real Estate) - ClearScope (myclearscope.com) - Midtown Operating Corp - Credit and Debt Management Institute (Bolivar, TN) - La Perla Construction & Design - LIVOTIS Old World Market - St. Albans Congregational Church (Queens, NY) - Creative Mobile Technologies (CMT) - North Side Transmission - NY Flooring Inc - Metropolitan Association of the NY Conference --- ## What Was Obtained ### 1. ZIRNET Internal Data (2,743 files) - **QuickBooks databases** — Zirnet.QBW (163 MB) and 2025.QBW (155 MB) — complete financial records - **Bank statements** — TD Bank, American Express, Bank of America — 36 PDF statements covering 2024-2026 - **Email archive** — 3.27 GB of PST files (Outlook) containing all business correspondence - **IRS documents** — W-9, estimated tax payments, certified copies - **Client proposals and contracts** — service agreements with all clients ### 2. Complete Credential Database (100+ accounts) For each managed client, ZIRNET stored passwords in **cleartext** text files. We obtained: - **King Contracting:** 30+ Active Directory and M365 accounts with plaintext passwords - **Industrial Solutions (ISNY):** 39 email accounts with passwords - **ClearScope:** 8 Microsoft 365 accounts with passwords - **Skylatus Property Capital:** Full IT documentation export including 33 accounts, firewall admin, DNS admin, VPN pre-shared keys, Barracuda admin, Azure credentials - **St. Albans Church:** 18 email accounts + Azure tenant secret key - **LIVOTIS:** 3 accounts + VoIP portal access - **AlphaOne USA:** Banking passwords (AMEX, Chase, CitiBusiness) ### 3. Hidden Backdoor Account on ALL Client Machines ZIRNET created a **hidden administrator account** on every managed workstation and server: ``` Username: NetworkAccess Password: [REDACTED] ``` This account is hidden from the Windows login screen using registry manipulation and has full local administrator privileges. This represents a **serious security malpractice** — a single credential compromise gives access to every machine ZIRNET manages. ### 4. Credit Card Numbers (with CVV) Three client credit cards stored in plaintext files, including full card numbers, expiration dates, and CVV codes. ### 5. Personal Identifiable Information (PII) - **Social Security Numbers** — Employee SSN scans from Dynotec, ASK Construction - **Birth certificates** — AlphaOne USA (family members) - **W-2 forms / Tax returns** — Multiple years (2021-2025) for AlphaOne USA employees - **Employee I-9 forms and drivers licenses** — AlphaOne USA - **Medical records** — Owner's colonoscopy, CT scan, and family medical documents - **Credit reports** — Owner's personal credit history (2005-2015) - **Payroll data** — Complete W-2/W-3 packages for multiple years across organizations ### 6. Network Infrastructure - **Juniper SRX firewall configuration** (Midtown Operating) — root passwords, VPN pre-shared keys, full NAT rules, internal network topology - **Meraki MX67 firewall credentials** (Skylatus) — admin password, WiFi PSKs, external IP - **N-Central RMM admin credentials** — ZIRNET's remote management console controlling all endpoints - **Azure tenant secrets** — tenant IDs, client secrets for M365 migrations ### 7. Full Server Backups (12 clients) Complete drive images from 12 client servers including: - All user documents, profiles, and application data - Accounting records (invoices, payroll, tax documents) - Private folders with personal files - Browser profiles with saved credentials - Construction project files, contracts, permits - HR files, employee records, compliance documents --- ## Evidence **See attached screenshots:** 1. `01_clients_list.png` — Full client listing with file counts 2. `02_credentials.png` — Sample of extracted credentials (partially redacted) 3. `03_financial.png` — ZIRNET financial data and bank accounts 4. `04_pii_sensitive.png` — PII and sensitive document inventory 5. `05_infrastructure.png` — Network backdoors and firewall configurations --- ## Impact Assessment This breach affects: - **13+ organizations** across New York, New Jersey, Florida, and Tennessee - **500+ individuals** (employees, contractors, clients of affected companies) - **Multiple regulatory frameworks:** NY SHIELD Act, FTC Safeguards Rule, PCI DSS (credit card data), HIPAA (medical records), IRS Pub 4557 (tax return data) ZIRNET's security practices represent gross negligence: 1. **Storing all client passwords in plaintext text files** 2. **Using a single hidden backdoor account across all clients** 3. **No encryption on sensitive data storage** 4. **Storing credit card numbers with CVV in plain text** 5. **Mixing personal medical/financial records with business data** --- ## Contact ZIRNET LLC has **7 days** to make contact before the full unredacted dataset is published. Countdown: **7 DAYS** After the deadline: - All credentials will be published unredacted - All PII including SSNs will be published - All financial records will be published - Each affected company will be notified individually - Data will be made available for free download **ZIRNET:** You know how to reach us. The clock is ticking. --- *This post will be updated as more data is analyzed. Additional client data may be published as proof of access.*