insomnia
ransomware group · aka Insomnia · unknown (no public attribution to a region, language group, or known ransomware brand/family in widely available vendor reporting) · active since 2024 (first widely reported public claim: Panera Bread breach, mid-2024); first post tracked by this dashboard: 2026-09-07
Insomnia is a low-volume ransomware and data-extortion operation that uses a double-extortion model and names victims on a Tor-hosted leak site. It first drew public attention in mid-2024 when it claimed a breach of Panera Bread, an incident the company publicly acknowledged. Public technical reporting on the group is scarce, with no widely published malware analysis, IOC sets, or affiliate relationships documented as of the latest vendor research. Activity on this dashboard is minimal: a single leak-site listing (NorthShore Health Centers) tracked since 2026-09-07. Leak-site posts represent gang claims and are not independently confirmed breaches.
- Double extortion: exfiltrates data and threatens publication if ransom is unpaid
- Operates a Tor-hosted data-leak site naming non-paying victims
- Sporadic, low-volume victim claims rather than sustained high-volume campaigns
- Public claims to date assert bulk data theft; specific tooling, initial-access methods, and encryption tradecraft not widely documented
- Sector targeting appears opportunistic (hospitality and healthcare claims to date; sample size too small to infer a pattern)
Panera Bread - claimed by the gang on its leak site in 2024; company acknowledged a cybersecurity incident (per BleepingComputer/vendor reporting, 2024), NorthShore Health Centers - listed on the group's leak site 2026-09-07 (per this dashboard's leak-site tracking; claim not independently confirmed)
No public figure.
Leak-site victims52 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Enviro-Hub Holdings | · Feb 8, 2026 | — |
| Chiarottino | · Feb 8, 2026 | — |
In the newsAll →
No articles mention this group yet.