genesis
ransomware group · aka unknown · unknown · active since 2026-06-18 (first post on the group's leak site as tracked by this dashboard; any earlier activity unknown)
Victims · 7d
2▲2 vs prev. week
Victims · 30d
4active targets
Victims · 90d
26
All-time (tracked)
115since 2025-10-21
Last post
09-15 00:40UTC
Estimated earnings
—public reporting
Profile · glm-5.3-flash · updated
Genesis is a ransomware/data-extortion operation first tracked by this dashboard on 2026-06-18, when its leak site posted its initial victims; it accumulated 26 listings by 2026-08-25. The group follows a leak-site-based extortion model, naming victims across healthcare, construction, real estate, professional services, and IT, with listings to date skewing toward small and mid-sized, mostly US-based organizations. Aliases, country of origin, and any affiliate lineage are unknown in widely available public reporting. Posting cadence slowed in the most recent tracked period (0 victims in the last 7 days, 3 in the last 30), though the group remained active as of its last post on 2026-08-25. No vendor, law-enforcement, or blockchain-analytics sources have published revenue figures or CVE attributions for this group as of the profile date.
Tactics & tooling
- Operates a dedicated leak site naming victims, consistent with a double-extortion model
- Claims victims across multiple verticals in a single operation, with healthcare providers among the most frequently named
- Victim profile to date skews toward small and mid-sized organizations, including regional US healthcare and construction firms
- Most named victims are US-based; at least one European target (Boyum IT Solutions, Denmark) listed
- Initial access techniques, malware/encryptor details, and infrastructure: unknown (no widely published technical reporting)
- Ransom demands and negotiation behavior: unknown
Targeted sectors
HealthcareConstructionReal estateAccounting/Professional servicesIT/Software
Notable public victims
Interim HealthCare, Hospitality Health ER (Longview), Consolidated Medical Practices of Memphis, Boyum IT Solutions, Westlake Realty Group, Inc., C.A. Walker Construction, Building Envelope Systems, Williams Accounting Professional, JJP Slip Forming Inc.
Estimated earnings
No public figure.
Leak-site victims115 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Continental Global Group | · Nov 11, 2025 | A subsidiary of PPI Global |
| Lows Orkney | · Nov 11, 2025 | A legal and accounting provider |
| Manusos General Contracting, Inc | · Nov 11, 2025 | A general contracting construction company |
| Heimbrock | · Oct 28, 2025 | Heimbrock Inc. is a national refractory contractor. |
| Advantage CDC | · Oct 28, 2025 | A company that provides long-term loans |
| Kipp & Christian | · Oct 28, 2025 | A law firm located in Salt Lake City |
| Southern Specialty and Supply | · Oct 21, 2025 | About company: Southern Specialty & Supply, Inc. is a reliable supplier for the oil and gas industry, serving the Gulf Coast region since 1987. Revenue: $5 Million Website: https://southernspecialtysupply.com Description: -400 Gb of data available. -Data from employees and management hosts. -Data from company fileserver. -Operational data. |
| Roth & Scholl | · Oct 21, 2025 | About company: Florida Law firm of Roth & Scholl, providing legal service in Commercial Litigation, Real Estate, Business Law in Coral Gables, Miami, Florida. Revenue: $5 Million Website: http://rothandscholl.com Description: - 100 Gb of data available - Data from company fileserver: - including legal cases - personal data - medical data |
| River City Eye | · Oct 21, 2025 | About company: Eye care services. From thorough eye exams and precise contact lens fittings to personalized dry eye treatments and eye disease management. Revenue: $2 Million Website: https://rivercityeye.com Description: -200 Gb of data available. -Medical data and medical records. -Data from company management hosts. -Various data from fileservers. |
| Austin Capital Trust | · Oct 21, 2025 | About company: Austin Capital Trust Company, LLC is a Nevada-chartered trust company that offers a range of financial services including trust and custody, retirement plan services, turnkey asset management, and a unified managed household platform. Revenue: $5 Million Website: https://www.austincapitaltrust.com info Our Summary: This network also contains databases belonging to another company, FinTech Automation, which is linked to the founders and executives of published company. We want to highlight that personal data at both organizations is stored almost everywhere on file servers, systems logs, product folders, technical and personal folders, which is a violation of data protection rules. This is grounds for the Attorney General and the Federal Trade Commission to investigate this breach, as the organization's customers' personal and financial files are stored without any protection in accordance with regulations or even basic compliance standards. There is no encryption, no access separation, no data transfer monitoring, nothing reasonable. Description: - 500 GB of accessible data. - Data from the company's file server. - Network user data. - Large amounts of personal data of all kinds. - Medical and financial data. - Data from Fintech Automation. - Data from Mora Law. - Business and operational data, structured financial data. - System logs. |
| Healthy Living Market and Café | · Oct 21, 2025 | About company: Established in 1986 and headquartered in South Burlington, Vermont, Healthy Living Market & Cafe is a marketplace that focuses on providing its customers with locally sourced organic foods and holistic health and wellness products. Revenue: $104.5 Million Website: https://healthylivingmarket.com/ Description: - 400 GB of accessible data. - Data from the company's file server. - Detailed financial data. - Detailed payroll data. - Detailed HR and personal data. - Managed folders. - Network users folders. - Board materials. |
| Claimlinx | · Oct 21, 2025 | About company: ClaimLinx helps businesses by providing health insurance benefits for their employees. Revenue: $6 Million Website: https://www.claimlinx.com Description: - 200 GB of accessible data. - Data from the company's file server. - Banks of clients personal data. - Banks of clients medical data. - Financial data. |
| Ronemus & Vilensky | · Oct 21, 2025 | About company: Ronemus & Vilensky LLP is a New York-based law firm specializing in personal injury, civil rights, medical malpractice, and accident cases. Revenue: $10 Million Website: https://www.ronvil.com info Our Summary: This company was notified through 5 various channels with evidence of the network breach. Yet each time, its representatives claimed that they had not received any messages, which is a lie. Given the quality of the data we have, we strongly recommend filing a complaint with the New York State Attorney General's Office and preparing for a class action lawsuit on behalf of customers whose data this company cared so little about that it did not even contact them to fully validate the leak. All customer and contractor contacts will be provided here shortly. In the meantime, you can explore the data tree to check the list of files we have. |
| Dependable Plastic | · Oct 21, 2025 | About company: A janitorial supplies company based in Brooklyn, New York. Revenue: $6 Million Website: https://www.dependableplastic.com Description: - 120 GB of accessible data. - Data from company file server. - Network users folders. - Personal data. - Business data - Financial data. |
| I-Tek Medical Technologies | · Oct 21, 2025 | About company: I-Tek Medical Technologies is a leading provider of contract design, development, and manufacturing in a healthcare industry. Revenue: $6 Million Website: https://i-tekmedical.com Description: - 120 GB of accessible data. - Data from the company's file server. - Detailed technical data. - Contracts and NDA. - SQL backups. |
In the newsAll →
No articles mention this group yet.
Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .