Intuitive Machines

About the organisation

Intuitive Machines, Inc. designs, manufactures, and operates space products and services in the United States. Its space systems and space infrastructure enable scientific and human exploration and utilization of lunar resources to support sustainable human presence on the moon. The company offers lunar access services, such µNova, lunar surface rover services, fixed lunar surface services, lunar orbit delivery services, rideshare delivery services to lunar orbit, as well as content sales and marketing sponsorships; and orbital services, including satellite delivery and rideshare, satellite servicing and refueling, space station servicing, satellite repositioning, and orbital debris removal. It also provides lunar data services, comprising Lunar data network, lunar south pole and far-side coverage, lunar positioning services, data relay, and data storage/caching. 70GB important information + 9 separate categories. 1. CONFIDENTIAL DATA (17GB); Price: $20 000 one hand / $10 000 many hands. 2. BUYBACK (30MB); Price : $500 one hand / $250 many hands. 3. CALCULATION COST OF PRODUCTION (786MB) - $15 000 one hand / $7500 many hands. 4. DIVIDENDS - $300 one hand / $150 many hands. 5. FINANCE (16GB) - $20 000 one hand / $10 000 many hands. 6. GUIDANCE (18.5GB) - $10 000 one hand / $5 000 many hands. 7. POSSIBLE VIOLATIONS $1 000 one hand / $500 many hands. 8. QUARTERLY REPORTS - $500 one hand / $250 many hands. 9. RESEARCH REPORTS - $7 500 one hand / $3 750 many hands.

What the listing means

Intuitive Machines appeared on the LeakBazaar leak site on 10 May 2026. Groups publish a victim once negotiations stall or as pressure during them, so a listing usually means data was already exfiltrated — the attack itself is dated 05 May 2026, 5 days before the listing. This group has not published new claims in the last 30 days.

Recommended actions

• Treat any unsolicited message referencing Intuitive Machines as suspicious — leaked data gets weaponised for phishing within days.
• If you hold an account on intuitivemachines.com, change that password now, update it anywhere you reused it, and enable two-factor authentication.
• Other Technology organisations should review this group's known TTPs and validate detection coverage against them.
• Watch for follow-on extortion: stolen data is often re-leaked or resold after the initial listing.
• A leak-site listing is a claim made by the attacker, not a confirmed breach — check the organisation's own disclosures before acting on it.

Leak-site evidence

Listing URL https://www.ransomware.live/id/SW50dWl0aXZlIE1hY2hpbmVzQExlYWtCYXphYXI=

Show leak-site screenshot

Captured from the group's extortion site. It may contain the victim's data or the attacker's messaging.