Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents22 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Mestechkin Law Group P.C. tracker page ↗ | booba teamfilter this group | · 2d ago | Law Practice Website: www.lawmlg.com Stolen data: 37 GB. |
Atlas Ocean Voyages tracker page ↗ | booba teamfilter this group | · 2d ago | Travel Arrangements Website: www.atlasoceanvoyages.com Stolen data: 37 GB. |
Davroc tracker page ↗ | booba teamfilter this group | · 23d ago | Furniture and Home Furnishings Manufacturing Website: www.davroc.co.uk Stolen data: 15 GB. |
Chernyy & Associates tracker page ↗ | booba teamfilter this group | · 23d ago | Law Practice Website: www.chernyy-law.com Stolen data: 67 GB. |
Country-Wide Insurance tracker page ↗ | booba teamfilter this group | · 23d ago | Insurance Website: www.cwico.com Stolen data: 92 GB. |
Federis Abogados tracker page ↗ | booba teamfilter this group | · 23d ago | Law Practice Website: www.federisabogados.com Stolen data: 61 GB. |
Index of / tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | No details on the leak post beyond the victim name. |
STAY TUNED FOR UPCOMING LEAKS tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | No details on the leak post beyond the victim name. |
Telecommunications tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Telecommunications Website: www.telewave.com Stolen data: 37 GB Telewave.io will exhibit at Booth #1146 at APCO 2026 – Association of Public Safety Communications Officials in San Antonio, Texas! They will have what to tell about. Download here http://d77tnb4bkmj3e366msrzllnwsi2t5e54e4yqh7zm7y5hlfwugnwzswad.onion/telewave.com/ |
Fonsan tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Construction Website: www.fonsan.com Stolen data: 23.4 GB |
Nfinite 9000 S.L. tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | IT Services and IT Consulting Website: nfinite9000.com Stolen data: 3 GB Piece of data below: File: canvas.png |
Upstaging tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Entertainment Providers Website: www.upstaging.com Stolen data: 10 GB Piece of data below: File: Edwards_Michael.pdf |
URA Group tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Website: uragroup.com Stolen data: 5 GB |
Jani-King tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Facilities Services Website: www.janiking.com Stolen data: 12 GB. |
Pelli Clarke Pelli Architects tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Architecture and Planning Website: www.pcparch.com Stolen data: 45 GB. |
Zynex tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | IT Services and IT Consulting Website: www.zynex.ch Stolen data: 1.4 GB |
Incredible Technologies tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Entertainment Providers Website: www.itsgames.com Stolen data: 25 GB |
Oklahoma Manufacturing Alliance tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Business Consulting and Services Website: www.okalliance.com Stolen data: 10 GB. |
Betz Industries tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Industrial Machinery Manufacturing Website: www.betzindustries.com Stolen data: 7 GB. |
About Us tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Dear Valued Partners, We represent the Booba team, specializing in data decryption services. As part of our interaction, we have successfully extracted data from your network prior to system lockdown. We guarantee that, in accordance with our agreement, you will receive a functional decryption tool and have the opportunity to test it before making payment. Note: Any independent attempts to recover files may result in their damage, rendering further assistance impossible. We suggest resolving this matter professionally and confidently finding an optimal solution. Best Regards, The Booba Team |
Frosty Acres Brands tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Food & Beverages Website: www.frostyacres.com Stolen data: 8 GB Piece of data below: File: BL_License.pdf |
Telewave, Inc. tracker page ↗ | booba teamfilter this group | · Jul 31, 2026 | Telecommunications Website: www.telewave.com Stolen data: 37 GB Telewave.io will exhibit at Booth #1146 at APCO 2026 – Association of Public Safety Communications Officials in San Antonio, Texas! They will have what to tell about. Piece of data below: File: Bob_Saffari_Social_Security_Card.pdf |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.