ransomhouse
ransomware group · aka Ransom House, White Rose (affiliate/related group per some public trackers, 2023; not confirmed) · Exact origin unknown. 2022 vendor reporting (e.g., Advanced Intel) described likely Russian-speaking, experienced operators, possibly veterans of established ransomware crews; attribution unconfirmed. · active since March 2022 (first leak-site listings; vendor reporting from April 2022 with the AMD incident)
RansomHouse is a data-extortion operation first reported in spring 2022, best known for claiming large-scale data thefts such as the AMD and Seiko Epson breaches; in most incidents it extorts via threatened publication of stolen data, and researchers have noted limited evidence of actual file encryption. The group has been described as likely Russian-speaking with experienced operators and openly recruits affiliates and partners on criminal forums. Recent dashboard-tracked activity shows steady output: 24 victims posted since 2026-06-16 (6 in the last 30 days, 0 in the last 7), with the latest post on 2026-09-02. Recent listings span Japan (REXT Holdings, Nichirei), Brazil (Alya Construtora), Cyprus (TECHVENTURES BANK), and US municipalities (City of Beacon, City of McMinnville), indicating global, sector-agnostic targeting. No reliable public aggregate of illicit earnings exists.
- Data-theft extortion; threatens to publish stolen data without demonstrated file encryption in most cases
- Claims large-volume exfiltration (e.g., ~70 GB claimed in the April 2022 AMD incident)
- Tor-based leak site with countdown timers before data release
- Openly recruits affiliates/partners on criminal forums for access and exfiltration
- 2022 vendor reporting indicated use of purchased initial access from access brokers
- Posts taunting statements blaming victims' security failures to pressure payment
AMD - April 2022; ~70 GB of data claimed stolen; AMD confirmed the breach (widely reported), Seiko Epson - May 2022; customer and employee data exposed; company confirmed (widely reported), REXT Holdings Co., Ltd. (Japan) - dashboard-tracked leak-site listing, 2026, Nichirei (Japan) - dashboard-tracked leak-site listing, 2026, TECHVENTURES BANK S.A. - dashboard-tracked leak-site listing, 2026, Alya Construtora (Brazil) - dashboard-tracked leak-site listing, 2026, PCL Holding - dashboard-tracked leak-site listing, 2026, City of Beacon (NY, USA) - dashboard-tracked leak-site listing, 2026, City of McMinnville (OR, USA) - dashboard-tracked leak-site listing, 2026
No public figure.
Leak-site victims253 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| [DISCLOSED] California School Employees Association | · 3h ago | — |
| California School Employees Association | · 5d ago | — |
| [EVIDENCE]REXT Holdings Co., Ltd. | · 13d ago | — |
| REXT Holdings Co., Ltd. | · 14d ago | — |
| [DISCLOSED]Alya Construtora | · 28d ago | — |
| [DISCLOSED]PCL Holding | · Aug 14, 2026 | — |
| [DISCLOSED]TECHVENTURES BANK S.A. | · Aug 13, 2026 | — |
| [DISCLOSED]City of Beacon | · Aug 12, 2026 | — |
| [DISCLOSED]City of McMinnville OR | · Aug 10, 2026 | — |
| [DISCLOSED]Nichirei | · Aug 9, 2026 | — |
| Alya Construtora | · Aug 7, 2026 | — |
| TECHVENTURES BANK S.A. | · Aug 6, 2026 | — |
| City of Beacon | · Aug 6, 2026 | — |
| lya Construtora | · Aug 6, 2026 | — |
| City of McMinnville OR | · Aug 6, 2026 | — |
| PCL Holding | · Aug 3, 2026 | — |
| [DISCLOSED]Fidelity Services Group | · Aug 3, 2026 | — |
| Nichirei | · Jul 22, 2026 | — |
| Megawork | · Jul 16, 2026 | — |
| Fidelity Services Group | · Jul 15, 2026 | — |
| [DISCLOSED]Prince George County | · Jul 6, 2026 | — |
| [EVIDENCE]Prince George County | · Jul 3, 2026 | — |
| Bonacio | · Jun 29, 2026 | — |
| [DISCLOSED]Karl Chevrolet | · Jun 23, 2026 | — |
| Prince George County | · Jun 17, 2026 | — |
| Promepla | · Jun 16, 2026 | — |
| Aegle Aviation | · Jun 8, 2026 | — |
| Ma Pak Leung Company Limited | · Jun 8, 2026 | — |
| Trellix (McAfee & FireEye) | · May 7, 2026 | — |
| Karl Chevrolet | · Apr 29, 2026 | — |
| Cybersecurity Vendor | · Apr 28, 2026 | — |
| Star Energy Geothermal Salak | · Apr 24, 2026 | — |
| Jiangsu Zenergy Battery Technologies Group Co., Ltd. | · Apr 21, 2026 | — |
| Winnitex (Americas) Limited | · Apr 17, 2026 | — |
| Transaction Packing Inc | · Apr 13, 2026 | — |
| [DISCLOSED]Accelerated Services | · Apr 8, 2026 | — |
| [DISCLOSED]Bioptik Technology | · Apr 6, 2026 | — |
| [DISCLOSED] Irec Sas | · Mar 26, 2026 | — |
| Irec Sas | · Mar 13, 2026 | — |
| Bioptik Technology | · Mar 12, 2026 | — |
| Neinver | · Feb 27, 2026 | — |
| Accelerated Services | · Feb 27, 2026 | — |
| [Internal database pack 4] Warren County Sheriff’s Office | · Feb 18, 2026 | — |
| Associated Endocrinologists | · Feb 6, 2026 | — |
| [Internal database pack 2] Warren County Sheriff’s Office | · Feb 5, 2026 | — |
| [Apple Data, Additional evidence (Apple Watch) pack-2]Luxshare Precision Industry Co. Ltd. | · Feb 4, 2026 | — |
| [Internal database pack 1] Warren County Sheriff’s Office | · Jan 30, 2026 | — |
| [Weapons License] Warren County Sheriff’s Office | · Jan 29, 2026 | — |
| [Apple Data, Additional evidence]Luxshare Precision Industry Co. Ltd. | · Jan 26, 2026 | — |
| Warren County Sheriff’s Office | · Jan 23, 2026 | — |
In the newsAll →
No articles mention this group yet.