worldleaks
ransomware group · aka WorldLeaks, WorldLeaks extortion group (widely reported as the successor to Hunters International) · unknown; vendor reporting in 2025 described WorldLeaks as the rebrand/successor of Hunters International, the operation that itself inherited the affiliate ecosystem of the Hive ransomware group · active since 2025 - Hunters International's pivot to the WorldLeaks brand was reported by security media in mid-2025; this dashboard's tracking of the group begins 2026-06-20
WorldLeaks is a data-extortion group that emerged in 2025 as the successor to Hunters International, the operation widely described as inheriting the Hive ransomware group's affiliate network. Vendor reporting in 2025 characterized the rebrand as a shift away from encrypting systems toward exfiltration-only extortion, pressuring victims by threatening to publish stolen data. The group maintains a public leak site listing victims; dashboard tracking shows a low posting cadence, with 8 victims since 2026-06-20 and the most recent post on 2026-07-22. Listed victims span manufacturing, education, financial services, IT services, and professional services, with no confirmed concentration in a single region. No specific initial-access techniques, exploited vulnerabilities, or revenue figures have been widely reported for this group.
- Exfiltration-only extortion: steals victim data and publishes it on a leak site; encryption reportedly abandoned after the Hunters International rebrand (vendor reporting, 2025)
- Inherits Hunters International lineage: reportedly reuses the affiliate network and infrastructure tied to the former Hive/Hunters International ecosystem (vendor reporting, 2025)
- Leak-site publication of victim data used as negotiation leverage (observed site behavior)
- Direct extortion negotiations with victim organizations (specific methods unknown)
- Initial access techniques: unknown - no widely documented access method or exploited CVE for this group
- Targets a mix of small, mid-sized, and larger organizations across multiple sectors, based on listed victims
Tata Electronics, PinnPACK, First Federal Savings & Loan, Reliance Group, Treet Group of Companies, Starpool, COMHAR, Centra Sota Cooperative, St. Francis Xavier Catholic School System, Service IT
No public figure.
Leak-site victims178 posts · newest first
| Victim | Discovered | Details |
|---|---|---|
| Washington Prime Group Inc | · Sep 23, 2025 | — |
| Paul Rossi Law Offices | · Sep 23, 2025 | — |
| Legend Senior Living | · Sep 18, 2025 | — |
| ACRO Automation Systems | · Sep 18, 2025 | — |
| City Wide | · Sep 18, 2025 | — |
| Survival Flight Inc | · Sep 12, 2025 | — |
| Northwest Medical Specialties | · Sep 11, 2025 | — |
| Risen Energy Co. | · Sep 3, 2025 | — |
| Motor Controls Inc. | · Aug 26, 2025 | — |
| Sneg Proprete | · Aug 26, 2025 | — |
| Sika Footwear | · Aug 26, 2025 | — |
| Springs Christian Academy | · Aug 26, 2025 | — |
| Exel Composites | · Aug 25, 2025 | — |
| Prosegur | · Aug 23, 2025 | — |
| MPOWERHealth | · Aug 19, 2025 | — |
| Nicke | · Aug 19, 2025 | — |
| Nutis Press | · Aug 12, 2025 | — |
| L3Harris Technologies | · Aug 10, 2025 | — |
| Prime Beverage Group | · Aug 7, 2025 | — |
| The Gisborne Group | · Aug 7, 2025 | — |
| Neway Valve | · Aug 7, 2025 | — |
| Origene | · Aug 5, 2025 | — |
| ACEA SpA | · Jul 28, 2025 | — |
| Dr. Falk Pharma | · Jul 28, 2025 | — |
| Able Home Care | · Jul 22, 2025 | — |
| Primoris | · Jul 22, 2025 | — |
| Dell Technologies | · Jul 21, 2025 | — |
| Thomas Bennett & Hunter | · Jul 18, 2025 | — |
| TCI Doors | · Jul 18, 2025 | — |
| DP Systems | · Jul 18, 2025 | — |
| DARA Pharma | · Jul 18, 2025 | — |
| Proactive Engineering Consultants | · Jul 18, 2025 | — |
| Racine Olson | · Jul 17, 2025 | — |
| Plane Business Kayan Aero | · Jul 12, 2025 | — |
| Operation PAR, Inc. | · Jul 11, 2025 | — |
| InnoMedica | · Jul 9, 2025 | — |
| McNealy Brown | · Jul 8, 2025 | — |
| NPK | · Jul 8, 2025 | — |
| RattanIndia Power | · Jul 8, 2025 | — |
| Act Legal | · Jul 8, 2025 | — |
| Becker Robotic | · Jul 8, 2025 | — |
| Coalinga Regional Medical Center | · Jul 8, 2025 | — |
| Scherer Sanitätshaus Gruppe | · Jul 8, 2025 | — |
| Kentfield Hospital | · Jul 4, 2025 | — |
| Integrated Silicon Solution Inc. | · Jul 4, 2025 | — |
| Operation PAR, Inc | · Jul 2, 2025 | — |
| Somotsoft | · Jul 1, 2025 | — |
| Tiscali SPA | · Jun 28, 2025 | — |
| ONGC Petro Additions Limited | · Jun 28, 2025 | — |
| Four Quarters | · Jun 28, 2025 | — |
In the newsAll →
No articles mention this group yet.