Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents28 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Better Accounting Solutions tracker page ↗ | anubisfilter this group | · 19h ago | Wall Street accountants data breach. |
Gellibrand Support Services tracker page ↗ | anubisfilter this group | · 6d ago | A data breach at a company full of smiling patients. |
Marlborough Partners tracker page ↗ | anubisfilter this group | · 13d ago | Major data breach at a capital solutions advisory firm. |
Caduceus Medical Group tracker page ↗ | anubisfilter this group | · 18d ago | Predictable but dangerous data exposed in a healthcare company breach. |
Interim HealthCare [Head office] tracker page ↗ | anubisfilter this group | · 25d ago | Data breach at a major healthcare franchise headquarters. |
Scholle IPN / SIG tracker page ↗ | anubisfilter this group | · 28d ago | Data breach at a global leader in packaging manufacturing. |
Interim HealthCare tracker page ↗ | anubisfilter this group | · Aug 15, 2026 | Home Healthcare Agency & Medical Staffing. |
Cleaver-Brooks tracker page ↗ | anubisfilter this group | · Aug 11, 2026 | Major data breach at a leading industrial manufacturer. |
Winn-Dixie tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Inside a multibillion-dollar retail giant. |
BLACKBURN'S tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Major home healthcare provider data breach. |
Cameron Regional Medical Center tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Patient and employee data breach at a healthcare provider. |
Prelys Courtage tracker page ↗ | anubisfilter this group | · Jul 28, 2026 | Client data breach at a major mortgage brokerage franchise. |
Coca-Cola / Fairlife tracker page ↗ | anubisfilter this group | · Jul 27, 2026 | Major data breach at company owned by Coca Cola. |
Eagle Crest Communities tracker page ↗ | anubisfilter this group | · Jul 23, 2026 | Patient and employee data breach at elderly care service. |
Bath Fitter tracker page ↗ | anubisfilter this group | · Jul 20, 2026 | Employee data breach at a major manufacturing company. |
Fairlife / Coca-Cola tracker page ↗ | anubisfilter this group | · Jul 20, 2026 | www.fairlife.com |
Boston Orthotics, Inc. tracker page ↗ | anubisfilter this group | · Jul 13, 2026 | Patient data breach at yet another negligent clinic. |
Casper Orthopedics tracker page ↗ | anubisfilter this group | · Jul 13, 2026 | Orthopedic clinic patients' data and medical records exposed. |
Surtifamiliar tracker page ↗ | anubisfilter this group | · Jul 13, 2026 | Passports of supermarket chain employees. |
Community Advocates tracker page ↗ | anubisfilter this group | · Jul 13, 2026 | Law firm clients' personal data exposed. |
Ferrum AG tracker page ↗ | anubisfilter this group | · Jul 3, 2026 | Data breach at one of the largest family-owned manufacturing businesses in Switzerland. |
Quest Healthcare Solutions tracker page ↗ | anubisfilter this group | · Jul 2, 2026 | Employee data, internal files, and a few unexpected discoveries. |
Northeast Pediatrics & Adolescent Medicine tracker page ↗ | anubisfilter this group | · Jul 2, 2026 | Data breach exposes employees and patients of a pediatric clinic. |
ESMS Global Limited tracker page ↗ | anubisfilter this group | · Jun 29, 2026 | Medical information services data breach. |
Boston Orthotics & Prosthetics tracker page ↗ | anubisfilter this group | · Jun 29, 2026 | Patient data breach at yet another negligent clinic. |
Nachlass Nord tracker page ↗ | anubisfilter this group | · Jun 25, 2026 | Inheritance lawyers expose IDs, estate records, and client data. |
Quest Health Solutions tracker page ↗ | anubisfilter this group | · Jun 25, 2026 | Employee data, internal files, and a few unexpected discoveries. |
KTR Real Estate Advisors tracker page ↗ | anubisfilter this group | · Jun 19, 2026 | Real estate client database exposed. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.