Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims7 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Southern California Telephone Company tracker page ↗ | akirafilter this group | · 4h ago | Southern California Telephone Company (SCTC) is a dynamic telecom provider with over 30 years of experience, offering a comprehensive range of services for both residential and business clients. Their product lineup includes high-speed internet, mobility solutions, virtual fax services, and VoIP offerings, catering to various connectivity needs.We will upload 34gb of corporate data soon. Employee personal information (passports, w-9s and so on), customer information (phone numbers and other sensitive information), contracts and agreements, NDAs, confidential certificates and so on. |
Lazyboyz tracker page ↗ | akirafilter this group | · 4h ago | Lazy Boyz - Harley-Davidson Oslo specializes in motorcycles and workshop services, particularlyfor Harley-Davidson and Royal Enfield, with over 30 years of experience. They offer a wide range of new and used motorcycles, as well as comprehensive services including repairs, customizations, and parts supply.We will upload corporate data soon. Employee personal information, financials, contracts and agreements and so on. |
Pilot Precision tracker page ↗ | akirafilter this group | · 4h ago | Pilot Precision Products specializes in industrial broaches, cutting tools, milling, drilling, and turning for machining operations. They offer a diverse array of products including CNC indexable broaching, solid carbide drills, and various types of milling tools.We will upload 30gb of corporate data soon. Employee personal information (SSN numbers, names, addresses and so on), detailed financials, lots of projects info, contracts and agreements, customers, partners and so on. |
AK Stamping tracker page ↗ | akirafilter this group | · 5d ago | AK Stamping is a leader in precision metal stamping technology, offering engineered design solutions and a complete package of manufacturing capabilities, including prototyping, tooling, andprecision stamping for various manufacturing scales.We will upload 30gb of corporate data soon. SQL and other internal files. |
Eagle Construction tracker page ↗ | akirafilter this group | · 5d ago | Eagle Construction specializes in building quality new homes across Virginia, offering a variety of communities, floor plans, and quick move-in options. Their services cater to a diverse clientele, including families and individuals looking for single-family homes, townhomes, and 55 communities.We will upload 70gb of corporate data soon. Detailed employee personal information (passports, DLs, SSNs, w-9 forms), internal confidential files, projects, clients information and so on. |
George Cameron Nash tracker page ↗ | akirafilter this group | · 5d ago | George Cameron Nash Interior Design operates showrooms in Dallas and Houston, Texas, specializing in high-end furniture and lighting. They represent a diverse range of brands, including Alexander Lamont, Chelsea Textiles, and Rubelli, offering products such as outdoor furniture, fabrics, textiles, and wall coverings.We will upload corporate data soon. Employee personal information, customer information, contracts. |
Kyodo USA tracker page ↗ | akirafilter this group | · 6d ago | Kyodo USA is a leading distributor of marine engine spares and ship operation equipment, boasting over 20 years of experience in the international maritime industry. The company serves over 300 clients across more than 100 countries, providing a highly diversified product line and reliable services.We will upload 30gb of corporate data soon. Detailed employee personal docs scans (DLs, passports, SSNs and other information), contacts and agreements, financials, confidential files, customer files, projects, NDAs and so on. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.