Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
184
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲3 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents11 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
hoyletanner.com tracker page ↗ | brain cipherfilter this group | · 19m ago | We have 33,500 (33.5k) files, the contents of which include: Contracts and agreements; Commercial proposals; Invoices; Customer database; HR ; W-9 tax forms; ACH/banking documents;... |
aecom.com tracker page ↗ | brain cipherfilter this group | · 19m ago | We've obtained 670 GB of data that most likely belongs to a Fortune 500 company. Stay tuned for more details — it's going to be interesting. If you think you are here by mistake,... |
xpera.ca tracker page ↗ | brain cipherfilter this group | · 1h ago | We have 20 GB of data belonging to this company. The data contains information such as employees' SINs, bank account details, salaries, addresses, dates of birth, RRSP/TFSA informa... |
ahadandco.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 405,000(405k) documents and files of your company, with a total size of over 300 GB. This data contains a significant amount of banking information, as well as the pe... |
sago.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have approximately 56,000 (56k) documents and files belonging to your company, including data on business relationships with more than 800 clients; data on research participants... |
crmeyer.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 275,000(275k) documents and files of your company, with a total size of over 330 GB. The data includes a customer database (~250 customers) — the largest ones are:... |
ccsperfusion.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have approximately 306,000 (306k) documents and files belonging to your company, with a total size of over 200 GB. 160k files containing complete employee personnel files; 75k f... |
icot.es tracker page ↗ | brain cipherfilter this group | · 16d ago | If you use this hosting service, we have some bad news for you. We'll soon be publishing more than 200 database backups that belong to you. Demo download: h4zmek6bf3lebauy7dtyxmui6... |
aeiconsultants.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 35,000(35k) documents and files of your company, with a total size of over 55 GB. The data includes: Personal Data, Real Estate Data, Internal Security/HR, Infrastruc... |
syc.es tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 57,000(57k) documents and files of your company, with a total size of over 40 GB. Contents: Personal data of thousands of candidates for top positions; Data on the fi... |
Adviesbureau De Beuckelaer BV tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 415,000(415k) documents and files of your company, with a total size of over 150 GB. Virtually all data falls under the protected category: 1) Financial data for more... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.