chaos
ransomware group · aka Chaos · unknown · active since 2026-07-14 (leak-site listings; link to the 2021 Chaos builder unconfirmed)
- Victims · 7d1flat vs prior week
- Victims · 30d3
- Victims · 90d19
- All-time (tracked)98since 2025-03-31
- Last post11-03 22:21UTC
- Estimated earnings—public reporting
Profile · grok-4.7 · updated Summaries by Vani AI
Chaos, as tracked here, is a data-extortion brand that posts victim names on a leak site. This dashboard records 29 listings from 2026-07-14 through 2026-10-01 (29 in 90 days, 8 in 30 days, and none in the past 7 days), so posting has slowed but the operation is not known to have been dismantled. Named organizations fall mainly in healthcare, manufacturing, industrial products, staffing, and life sciences; those names are leak-site claims, not independently confirmed breaches. A separate commodity .NET ransomware builder also called Chaos was documented by vendors from June 2021, with a variant reported as Yashma in 2022; any link between that builder and this leak-site brand is unconfirmed and should not be assumed. Origin, ransom revenue, and exploited CVEs for the current operation are unknown in widely cited public reporting.
Tactics & tooling
- Extortion via public leak-site posts that name organizations and pressure payment
- Initial access method: unknown
- Intrusion tooling and malware family for this leak-site cluster: unknown
- Encryption versus theft-only extortion: unknown; a leak site alone does not confirm file encryption
- No CVE publicly tied to these intrusions in widely cited reporting
- Claimed victims since 2026-07-14 cluster in healthcare, manufacturing, and industrial firms
Targeted sectors
HealthcareManufacturingIndustrial technologyStaffing and business servicesLife sciences
Notable public victims
parkdental.com, advantech.com, carolinaasthma.com, expresspros.com, glasfloss.com, steehausinc.com, mankatoclinic.com, artiflexmfg.com, copeplastics.com, evergenbio.com
Estimated earnings
No public figure.
Leak-site victims
98 posts · newest first| Victim | Discovered | Details |
|---|---|---|
| darrequipment.com | · 6h ago | Darr Equipment Co. is a family-owned, service first, industrial equipment supplier specializing in providing customized solutions to meet our clients' specific goals. Darr provides new and used forklift, material handling, earthmoving, and construction equipment to construction and industrial market… |
| mickeybody.com | · 11d ago | Mickey Truck Bodies has been family owned and operated since the company was started in High Point, NC in 1904. Today Mickey manufactures all-aluminum beverage bodies and beverage trailers, dry freight and refrigerated van bodies, emergency vehicles and specially engineered equipment for customers t… |
| astranahealth.com | · 25d ago | The company's management decided to pull out of the deal with us in order to save money. The data and diagnoses of millions of patients have been published in their entirety. The total data volume is 1,500 GB. Astrana Health, Inc. is a physician-centric, technology-powered healthcare company headqu… |
| parkdental.com | · Oct 1, 2026 | To the Management of Park Dental: Time is running out. Our previous attempts to establish a constructive dialogue regarding the security breach have been met with silence. If the management of Park Dental fails to get in touch with our team within the next 24 hours, we will proceed with the full p… |
| advantech.com | · Sep 29, 2026 | We are publishing 5% of the total data because the company's management is ignoring the situation and has not contacted us. The company's management has exactly 48 hours to contact us; otherwise, the entire dataset will be published. |
| carolinaasthma.com | · Sep 29, 2026 | Company management has 24 hours to reach an agreement with us. Otherwise, 290 GB of data will be disclosed, such as “Other Patient Forms” (name, date of birth, MRN, Social Security number, phone number, address… and so on) Administrative and financial matters, procurement, business services,… |
| expresspros.com | · Sep 17, 2026 | Express Employment Professionals — Data Breach Notification & Public Disclosure We have officially initiated the public release phase regarding expresspros.com. Despite our direct attempts to establish communication, company leadership and their representatives have chosen a strategy of silence… |
| glasfloss.com | · Sep 14, 2026 | DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data breach has exposed 402 GB of confidential corporate, financial, and employee records from Glasfloss. The compromised database contains internal documentation across multiple departments: • Accounting & Finance: Contracts, ESOP rec… |
| steelhausinc.com | · Sep 14, 2026 | Steelhaus boldly drives the market with innovative energy solutions; fusing practical, field proven experience, adaptable engineering, integrated manufacturing, and uncompromising safety with relentless delivery of unwavering customer service |
| mankatoclinic.com | · Sep 10, 2026 | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea… |
| artiflexmfg.com | · Sep 10, 2026 | ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica… |
| copeplastics.com | · Sep 9, 2026 | Cope Plastics is a leading U.S. distributor and fabricator of performance plastics, serving industrial and commercial customers since 1946. From our headquarters in Alton, Illinois and through multiple branch locations, we support clients across countless sectorsheavy equipment, transportation, aero… |
| evergenbio.com | · Sep 6, 2026 | Evergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs |
| corematerials.com | · Aug 28, 2026 | Core Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m… |
| macallister.com | · Aug 28, 2026 | MacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo… |
| singleton.com | · Aug 27, 2026 | Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia. |
| parkderochie.com | · Aug 25, 2026 | Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo… |
| mswalker.com | · Aug 25, 2026 | MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o… |
| copcp.com | · Aug 25, 2026 | Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en… |
| tomorrowsoffice.com | · Aug 5, 2026 | URGENT DATA LEAK NOTICE: TOMORROW'S OFFICE Target: Tomorrow’s Office (tomorrowsoffice.com) Status: Ongoing Data Publication Countdown Security researchers have successfully exfiltrated 125 GB of critical and confidential data from the internal infrastructure of Tomorrow’s Office (tomorrowsoff… |
| healthcarehighways.com | · Aug 5, 2026 | WARNING / DATA LEAK NOTICE Target: Healthcare Highways (healthcarehighways.com) Countdown: 24 Hours If corporate representatives do not establish contact via chat within the next 24 hours, a massive internal data cache comprising 235 GB of sensitive company and client records will be p… |
| thecranewaregroup.com | · Jul 28, 2026 | Craneware’s Public Deception: The Reality Behind the 'Non-Sensitive' Data Breach Recent public statements and regulatory filings by UK health-tech firm Craneware claim that the massive cyber-attack they suffered only exposed "non-sensitive or already public regulatory data." They would have the s… |
| vit-best.com | · Jul 27, 2026 | DATA BREACH NOTICE: VIT-BEST.COM Status: The first 3% of the total data (100%) has been published Countdown: 48 hours until the remaining 97% is published Situation Overview We have successfully breached VIT-BEST’s infrastructure and extracted a complete set of critical data. At this t… |
| remco.ca | · Jul 26, 2026 | Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry |
| neopharmlabs.com | · Jul 22, 2026 | Notice of Data Escalation: 3% Proof Publication Management is ignoring the seriousness of the situation and refusing to engage in dialogue. We are publishing a 3% sample of our 627 GB archive right now. We are giving management 48 hours to reach out to us. If they fail to contact us within this ti… |
| issvc.com | · Jul 22, 2026 | issvc.com Official Notice to Management and Stakeholders The time window has expired. Exactly 24 hours remain until the final deadline. If an agreement is not reached by the end of this period, the complete confidential dataset totaling 262 GB will be published into the public domain. Compromised… |
| argonautms.com | · Jul 22, 2026 | Target Organization: argonautms.com (Argonaut Manufacturing Services) Status: Unauthorized Access & Data Exfiltration Confirmed Volume: 295 GB of Critical Corporate, Technical & Operational Data Countdown: 48 Hours to establish contact before public release. Executive Summary The internal infras… |
| wikoff.com | · Jul 20, 2026 | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Data Volume: 650 GB Status: Full Compromise Confirmed We are officially confirming that the entire internal infrastructure of Wikoff Color Corporation—ranging from Board of Directors financial reports and proprietary R&D formulas… |
| radiax.com | · Jul 16, 2026 | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com. To prove the authenticity of our access, we have published an initial 5% of the total exfiltrated data. This is merely a sample. W… |
| sleemanbreweries.ca | · Jul 14, 2026 | Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ontario. The company now markets and distributes world-class domestic and imported products. |
| spectrumchemical.com | · Jul 14, 2026 | Public Notice: Final Ultimatum to Spectrum Chemical Management To the Management of Spectrum Chemical: We have provided you with sufficient time to engage in a productive dialogue regarding the security breach of your infrastructure. Your refusal to communicate and your attempt to ignore the sever… |
| aphenapharma.com | · Jul 14, 2026 | Aphena Pharma Solutions We have gained full access to your corporate infrastructure. During this operation, we stole 142 GB of your most critical corporate data. The stolen data includes: Financial statements: capital expenditures (CAPEX), fixed assets, accounts receivable and accounts payabl… |
| corepharma.com | · Jul 8, 2026 | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu… |
| opportune.com | · Jul 8, 2026 | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi… |
| gisy.com | · Jul 6, 2026 | Target: Gisy.com Status: Data Exfiltration Confirmed Volume: 1.1 TB (341,712 files) Deadline: 24 Hours We have successfully exfiltrated 1.1 Terabytes of internal data from Global Industries’ (gisy.com) primary network servers. This archive contains comprehensive documentation covering every layer… |
| aircreebec.ca | · Jul 6, 2026 | Air Creebec, founded in 1982, is a regional airline company based Waskaganish, Quebec. The company provides regular flights, air charter, medical transportation, and cargo services. |
| universalplant.com | · Jun 30, 2026 | FINAL NOTICE: UNIVERSAL PLANT SERVICES (UPS) We are in possession of 315 GB of your corporate, financial, and operational data. Our analysis confirms that this archive contains highly sensitive information, including: Financial & Accounting: Full audits, tax filings (ADP), payroll, bank transa… |
| ingerman.com | · Jun 26, 2026 | Ingerman is a developer, builder and manager of multifamily housing communities throughout the Mid-Atlantic region. |
| roofdepot.com | · Jun 25, 2026 | Founded in 1998 and headquartered in Alpharetta, GA, Roof Depot is a roofing manufacturer that specializes in roof installation, repairs & replacement |
| randa.net | · Jun 23, 2026 | Randa Apparel & Accessories is a global powerhouse and one of the world's leading apparel and lifestyle accessories companies, headquartered in New York City at 417 Fifth Avenue, 11th Floor. Founded in 1910, with the founder's family having been in the neckwear business since that time and the curre… |
| graymont.com | · Jun 22, 2026 | NOTICE: Graymont – Final Warning We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly sensitive data. The scope of our access covers the entire core of your operations, from executive financial strategy to individ… |
| airespring.com | · Jun 9, 2026 | Founded in 2001, AireSpring is a Managed Services Provider specializing in Unified Communications, Managed Network, and IT Services, serving thousands of businesses nationwide. AireSpring provides fully managed and connected end-to-end, next-generation solutions for multi-location enterprise custome… |
| entransinternational.com | · May 28, 2026 | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Entrans International (entransinternational.com) THE REALITY OF ENTRANS INTERNATIONAL We have been in possession of your internal data for some time. Throughout this period, we have attempted to engage with your management, but their si… |
| powerhousenow.com | · May 28, 2026 | STATUS: PENDING PUBLICATION | TIME REMAINING: 72 HOURS ENTITY: Powerhouse (powerhousenow.com) THE REALITY OF POWERHOUSE We have been in possession of your internal data for some time. We have attempted to engage with your management to resolve this incident professionally, but their silence speaks… |
| sterlingindustries.com | · May 27, 2026 | STERLING INDUSTRIES: FINAL NOTICE BEFORE FULL RELEASE STATUS: PENDING FINAL PUBLICATION ENTITY: Sterling Industries (sterlingindustries.com) LEAK SIZE: ~503 GB ATTENTION MANAGEMENT We are currently in the final stages of preparing your data for public release. We have provided you with ample time… |
| wtitransport.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. WTI Transport is a flatbed trucking company headquartered… |
| cstindustries.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Founded in 1893, CST is a manufacturer and construction co… |
| fallprotect.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Diversified Fall Protection specializes in the design, fab… |
| challenge-mfg.com | · May 17, 2026 | Company management has exactly 72 hours to contact us. Otherwise, the organization’s data—which contains confidential information—will be published on our public platform, and the possibility of further negotiations will be ruled out. Challenge Manufacturing is a leading Tier 1 automotive sup… |
| vacaero.com | · May 4, 2026 | If the company's management does not reach an agreement with us within 4 days, we will publish 250 GB of the company's internal data. Founded in 1959, VAC AERO provides vacuum heat treating and thermal & paint coating services as well as vacuum furnace systems and controls to aerospace and high-tec… |
In the news
AllNo articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .