ZeroHour

ransomhouse

ransomware group · aka Ransom House, White Rose (affiliate/related group per some public trackers, 2023; not confirmed) · Exact origin unknown. 2022 vendor reporting (e.g., Advanced Intel) described likely Russian-speaking, experienced operators, possibly veterans of established ransomware crews; attribution unconfirmed. · active since March 2022 (first leak-site listings; vendor reporting from April 2022 with the AMD incident)

Victims · 7d
2▲1 vs prev. week
Victims · 30d
5active targets
Victims · 90d
24
All-time (tracked)
253since 2022-08-18
Last post
09-15 17:38UTC
Estimated earnings
public reporting
Profile · glm-5.3-flash · updated

RansomHouse is a data-extortion operation first reported in spring 2022, best known for claiming large-scale data thefts such as the AMD and Seiko Epson breaches; in most incidents it extorts via threatened publication of stolen data, and researchers have noted limited evidence of actual file encryption. The group has been described as likely Russian-speaking with experienced operators and openly recruits affiliates and partners on criminal forums. Recent dashboard-tracked activity shows steady output: 24 victims posted since 2026-06-16 (6 in the last 30 days, 0 in the last 7), with the latest post on 2026-09-02. Recent listings span Japan (REXT Holdings, Nichirei), Brazil (Alya Construtora), Cyprus (TECHVENTURES BANK), and US municipalities (City of Beacon, City of McMinnville), indicating global, sector-agnostic targeting. No reliable public aggregate of illicit earnings exists.

Tactics & tooling
  • Data-theft extortion; threatens to publish stolen data without demonstrated file encryption in most cases
  • Claims large-volume exfiltration (e.g., ~70 GB claimed in the April 2022 AMD incident)
  • Tor-based leak site with countdown timers before data release
  • Openly recruits affiliates/partners on criminal forums for access and exfiltration
  • 2022 vendor reporting indicated use of purchased initial access from access brokers
  • Posts taunting statements blaming victims' security failures to pressure payment
Targeted sectors
Technology/semiconductorsManufacturing (electronics, food)Banking/financial servicesConstructionGovernment (municipal/local)
Notable public victims

AMD - April 2022; ~70 GB of data claimed stolen; AMD confirmed the breach (widely reported), Seiko Epson - May 2022; customer and employee data exposed; company confirmed (widely reported), REXT Holdings Co., Ltd. (Japan) - dashboard-tracked leak-site listing, 2026, Nichirei (Japan) - dashboard-tracked leak-site listing, 2026, TECHVENTURES BANK S.A. - dashboard-tracked leak-site listing, 2026, Alya Construtora (Brazil) - dashboard-tracked leak-site listing, 2026, PCL Holding - dashboard-tracked leak-site listing, 2026, City of Beacon (NY, USA) - dashboard-tracked leak-site listing, 2026, City of McMinnville (OR, USA) - dashboard-tracked leak-site listing, 2026

Estimated earnings

No public figure.

Leak-site victims

VictimDiscoveredDetails
[Apple Data]Luxshare Precision Industry Co. Ltd. · Jan 19, 2026
Fedcap · Jan 8, 2026
[DISCLOSED]Assolim · Jan 8, 2026
Luxshare Precision Industry Co. Ltd. · Jan 8, 2026
ESSPL · Dec 29, 2025
Arkan · Dec 29, 2025
[DISCLOSED]Soderstrom Architects, LTD · Dec 26, 2025
[DISCLOSED] Diaz Gill Medicina Laboratorial S.A. · Dec 24, 2025
Assolim · Dec 22, 2025
Lawsoft · Dec 19, 2025
Diaz Gill Medicina Laboratorial S.A. · Dec 15, 2025
Armis Group · Dec 3, 2025
[EVIDENCE PACK 3]ASKUL · Dec 2, 2025
Industrial Steam · Dec 1, 2025
Astrofein · Dec 1, 2025
Soderstrom Architects, LTD · Dec 1, 2025
Swedish Arts Council · Nov 24, 2025
Fucerep · Nov 21, 2025
Makro · Nov 20, 2025
[DISCLOSED]Victorian Chemical · Nov 17, 2025
[DISCLOSED] Fulgar S.p.A. · Nov 17, 2025
Vennerhus Weine AG · Nov 12, 2025
Soleol · Nov 12, 2025
Fulgar S.p.A. · Nov 12, 2025
Octomeca Oy · Nov 11, 2025
Public Safety Mutual Benefit Fund · Nov 11, 2025
Polidano Group · Nov 11, 2025
MARCK Industries · Nov 10, 2025
[DISCLOSED]Kurogane Kasei Co. · Nov 10, 2025
[EVIDENCE PACK 2]ASKUL · Nov 10, 2025
[DISCLOSED]S Food Co., Ltd. · Nov 10, 2025
First Resources · Nov 6, 2025
UnitedLayer · Nov 3, 2025
Victorian Chemical · Nov 3, 2025
ASKUL · Oct 30, 2025
OCI International Holdings · Oct 24, 2025
Kurogane Kasei Co. · Oct 24, 2025
[DISCLOSED]WEBER · Oct 24, 2025
S Food Co., Ltd. · Oct 23, 2025
United Lube Oil · Oct 22, 2025
WEBER · Oct 17, 2025
GWP Engineering · Oct 2, 2025
Weber Flavors · Oct 2, 2025
The Plainview Volunteer FD · Oct 1, 2025
M8 Group · Sep 10, 2025
DLCOSMETICS O.E. · Aug 25, 2025
Greater Pittsburgh Orthopaedic Associates · Aug 20, 2025
Maxell Asia · Aug 19, 2025
EUC Sjlland · Jun 9, 2025
Vinda Group · Jun 2, 2025

In the newsAll →

No articles mention this group yet.

Victim posts come from the group's leak site via RansomLook and are claims, not confirmations. The profile is written by the model from public reporting and refreshed monthly; earnings figures cite their source and year. First tracked .