ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen32▲9157413413activeno public figure
2qilin18▲2115359359activeno public figure
3krybit13▲11479696activeno public figure
4direwolf5▼6456262activeno public figure
5storm44▲44445656activeno public figure
6akira7▼1388282activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
7coinbase cartel0=375656activeno public figure
8inc ransom3▼636106106activeno public figure
9lockbit55▼1278686activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10shinyhunters1▼2243434activeno public figure
11safepay14▲8226767activeno public figure
12leakeddata0▼7203838activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15audit team10▲6181919activeno public figure
16panzer6▲3172424activeno public figure
17kazu0▼17171717activeno public figure
18emperador6▲5161919activeno public figure
19play4▲4144444activeno public figure
20vexy4▼6141414activeno public figure
21black nevas13▲13131313activeno public figure
22chaos5▲4123434activeno public figure
23everest0▼4123434activeno public figure
24pear1▼1122727activeno public figure
25rhysida3▲1121515activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents82 records · full details

VictimGroup / typeDiscoveredDetails
Pioneer Construction
tracker page ↗
akirafilter this group · Jul 15, 2026Established in 1933, Pioneer Construction is headquartered in Grand Rapids, Michigan. They provide construction solutions throughout the United States including general contracting, crane services, program management, and more.We will upload 168gb of corporate data soon. Scanned employee personal documents (passports, DLs and other docs), projects information, detailed financials, client internal information, contracts and agreements, confidential correspondence and other files, NDAs and so on.
Transworld Signs
tracker page ↗
akirafilter this group · Jul 13, 2026Transworld Signs produces and sources a complete range of promotional and POP graphics. The company offers digital and standard menu boards, large scale graphics and any other interior graphics or signage to support the company's customers' needs.We will upload 17gb of corporate data soon. Employee personal information (names, DOB and so on), projects files, financials, client internal information, contracts and agreements and so on.
Ironmark
tracker page ↗
akirafilter this group · Jul 13, 2026Founded and headquartered in Annapolis Junction, Maryland, Ironmark is a provider of marketing,creative, printing and communications services. They specialize in marketing strategy, creative & web development, digital marketing, printing services, and more.We will upload 190gb of corporate data soon. Employee personal information (passports, DLs and other personal information), projects information, detailed financials, client internal information, contracts and agreements, NDAs and so on.
Vandalia Rental
tracker page ↗
akirafilter this group · Jul 10, 2026Vandalia Rental has served the Greater Dayton and Greater Cincinnati and Northern Kentucky markets since 1961. Vandalia Rental proudly services construction rental accounts ranging from small businesses to large publicly traded corporations, government agencies, and municipalities throughout the Ohio, Indiana, and Kentucky regions, and sales accounts throughout the country.We will upload 40gb of corporate data soon. Detailed employee and client personal information (SSN numbers, name, DOB and so on), projects files, financials, client internal information, contracts and agreements and so on.
Wade's Dairy
tracker page ↗
akirafilter this group · Jul 8, 2026A family-owned business for over a century, Wade's Dairy has been a staple in the Connecticut community.We will upload corporate data soon. Detailed employee personal information (name, DOB, SSN, DL,height, weight, race, sex, eyes and hair color, tattoo information, emails, phones and so on),projects files, financials, customers, contracts and agreements and so on.
Chisholm Persson & Ball
tracker page ↗
akirafilter this group · Jul 7, 2026Chisholm, Persson & Ball, PC is a law firm located in Laconia, NH, specializing in various legal services including Estate Planning, Probate Administration, Family Law, Business Law, and Civil Litigation. The firm has been recognized for its excellence, winning multiple awards in the Lakes Region for Best Law Firm and other categories.We will upload 45gb of corporate data soon. Client and employee personal information (client passports, visas, DLs, SSNs and so on), confidential client docs, financial, contracts and agreements, court files, police reports and other legal files.
RISE Architecture
tracker page ↗
akirafilter this group · Jul 7, 2026RISE Architecture is a full-service architectural firm based in New York and New Jersey that specializes in dynamic design solutions for complex real estate projects across residential, commercial, mixed-use, industrial, and institutional sectors.We will upload 57gb of corporate data soon. Employee personal information, a bit of client files, projects files, financials, contracts and agreements and so on.
Excalibur Rentals
tracker page ↗
akirafilter this group · Jul 7, 2026Excalibur Rentals is dedicated to providing reliable rental equipment services, ensuring that clients can complete their jobs safely, on time, and within budget. They offer a range of equipment including boom lifts, telehandlers, and light towers.We will upload 45gb of corporate data soon. Employee personal information (name, addresses, SSNs and so on), contracts and agreements, a bit of financials, customers info, etc.
Edge Solutions | Stone Ridge Payments
tracker page ↗
akirafilter this group · Jul 7, 2026Edge Solutions is dedicated to leveraging technology to create a better world. With a focus on integrity, they offer top-notch services to help clients achieve their business objectives. Their team is committed to future-proofing businesses through innovative solutions.We will upload 67gb of corporate data soon. Employee personal information (400 passports and DL scans, SSNs, w9 forms and so on), financials, contracts and agreements, confidential documents, lots of NDAs, etc.
Refinery Hotel
tracker page ↗
akirafilter this group · Jul 1, 2026Refinery Hotel is a luxury hotel located near Bryant Park in New York City, offering a modern reinterpretation of a historic hat factory. The hotel features 197 stylish rooms with industrialaccents and modern amenities, alongside dining options such as the Parker & Quinn restaurant and the Refinery Rooftop bar.We will upload 15gb of corporate data soon. Employee personal information (passports, DLs, SSNs, w9 forms), guests information, financials, contracts and agreements, lots of NDAs, etc.
Advanced Business Systems
tracker page ↗
akirafilter this group · Jun 30, 2026Advanced Business Systems, Inc. is a locally owned business serving the Quad Cities area, specializing in a wide range of office products and solutions including copiers, printers, IT services, phone systems, and furniture.We will upload 31gb of corporate data soon. Employee personal information (88 SSNs, passports and other docs), NDA, projects, contracts and agreements, customer information and so on.
About Todd Hamaker & Johnson
tracker page ↗
akirafilter this group · Jun 30, 2026Todd, Hamaker & Johnson, LLP is a professional tax and accounting firm based in Lufkin, Texas, dedicated to providing personalized services to both individuals and businesses. The firm offers a comprehensive range of services including tax, accounting, audit, and financial guidance.We will upload 40gb of corporate data soon. Lots of client and employee personal information (passports, SSNs, DLs and other information), detailed financials, client financials and other confidential client docs, contracts and agreements, etc.
Precise Forms
tracker page ↗
akirafilter this group · Jun 26, 2026Precise Forms, Inc. specializes in manufacturing high-quality aluminum forms for concrete construction, offering a complete line of standard and decorative forms along with necessary accessories. Their products cater to a variety of applications including residential homes, commercialbuildings, and swimming pools, designed for rapid setting and stripping to meet the needs of competitive contractors.We will upload 10gb of corporate data soon. Employee personal information (DLs (at least 15 numbers), 75 SSNs, and other personal docs), NDAs, projects, contracts and agreements, customer information and so on.
Padget Technologies
tracker page ↗
akirafilter this group · Jun 25, 2026Padget Technologies specializes in advanced robotics and automation solutions tailored for efficient and cost-effective production. Their services include designing and fabricating custom machinery, assembly systems, and pre-engineered robotic palletizing cells.We will upload corporate data soon. Employee personal docs (DLs, SSNs, w9s and other sensitive docs), payment details, lot of NDAs, projects, contracts and agreements, client information, etc.
JMS Southeast
tracker page ↗
akirafilter this group · Jun 25, 2026JMS Southeast, Inc. specializes in high-quality temperature measurement and control products, including thermocouples, RTDs, thermowells, and transmitters, catering to various industries such as aerospace, pharmaceuticals, and oil and gas.We will upload 25gb of corporate data soon. Employee personal information (name, addresses and so on), payment details, NDAs, projects, contracts and agreements, agreements with government, customer information and so on.
Jit Ex
tracker page ↗
akirafilter this group · Jun 24, 2026JIT-EX, LLC is a privately owned for-hire trucking fleet based in Memphis and Nashville, specializing in regional and local truckload services, dedicated fleets, and crossdock solutions. Thecompany offers a variety of services including transloading, dock services, and storage trailers, aiming to be a one-stop solution for transportation needs.We will upload 40gb of corporate data soon. Employee personal docs (passports, DL numbers of 317 persons, SSNs, w9s and so on), credit card details, payment details, lot of NDAs, projects, contracts and agreements, customer information, etc.
Miami Machine
tracker page ↗
akirafilter this group · Jun 24, 2026Miami Machine Inc. specializes in machining, fabrication, and engineering services tailored forthe paper, power, steel, and OEM markets. With over 50 years of experience and a manufacturingspace of 86,000 sq. ft, they provide high-quality, custom machinery and equipment solutions.We will upload corporate data soon. Employee personal docs (passports and other docs, photos), NDAs, projects, contracts and agreements, client information, etc.
Leo International
tracker page ↗
akirafilter this group · Jun 23, 2026Leo International, established in 1986, serves as a comprehensive source for the PVF, HVAC, andPlumbing Industry. The company specializes in manufacturing products through Forging, Casting,and Injection Molding processes.We will upload 10gb of corporate data soon. Employee personal docs (passports, SSNs, DLs, medical information, phones, photos, doc scans, addresses and so on), confidential internal files and so on.
IH Engineers
tracker page ↗
akirafilter this group · Jun 23, 2026IH Engineers, P.C. is a consulting firm with over 25 years of experience, dedicated to providing innovative and technically excellent services in design, construction, and structural evaluation. The firm operates primarily in New Jersey, New York, and Pennsylvania, serving a diverse range of clients.We will upload 65gb of corporate data soon. Employee personal docs (passports, SSNs, DLs and other HR information), confidential internal files, NDAs, projects, contracts and agreements, drawings and so on.
Ntd Apparel
tracker page ↗
akirafilter this group · Jun 22, 2026NTD Apparel specializes in creating high-quality apparel that connects with pop culture, offering a range of licensed products and in-house labels. They provide comprehensive services including market analysis, price point management, and visual merchandising to retailers.We will upload 62gb of corporate data soon. Employee personal docs (passports, SSNs, DLs, medical information, phones, addresses and so on), projects, client information, confidential agreements and so on.
Berg Lilly
tracker page ↗
akirafilter this group · Jun 18, 2026Berg Lilly PC is a trusted law firm based in Bozeman, Montana, with over 60 years of experienceproviding quality legal representation to both local and national clients. The firm specializes in various areas of law, including business entity law, civil litigation, commercial transactions, construction law, employment law, estate planning, personal injury, and real estate law.We will upload 50gb of corporate data soon. Clients personal information (passports, SSNs, DLs,addresses, phones, confidential files, medical information, financials and so on), court hearings, police reports and other legal documents.
Apptricity
tracker page ↗
akirafilter this group · Jun 18, 2026Apptricity Corporation is a global enterprise software provider for Supply Chain and Spend Management. Apptricity differs from other manufacturers by offering platform-agnostic, secure solutions that optimize inventory, asset and expense tracking processes while still being easily integrated with existing systems.We will upload 12gb of corporate data soon. Employee personal docs (passports, SSNs, DLs, w9s,and other personal information), lots of projects, source codes, NDAs, client and partner files, agreements and so on.

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.