Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents12 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
glasfloss.com tracker page ↗ | chaosfilter this group | · 1d ago | DATA LEAK NOTICE: GLASFLOSS (glasfloss.com) A comprehensive data breach has exposed 402 GB of confidential corporate, financial, and employee records from Glasfloss. The compromised database contains internal documentation across multiple departments: • Accounting & Finance: Contracts, ESOP rec… |
steelhausinc.com tracker page ↗ | chaosfilter this group | · 1d ago | Steelhaus boldly drives the market with innovative energy solutions; fusing practical, field proven experience, adaptable engineering, integrated manufacturing, and uncompromising safety with relentless delivery of unwavering customer service |
mankatoclinic.com tracker page ↗ | chaosfilter this group | · 5d ago | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea… |
artiflexmfg.com tracker page ↗ | chaosfilter this group | · 5d ago | ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica… |
copeplastics.com tracker page ↗ | chaosfilter this group | · 6d ago | Cope Plastics is a leading U.S. distributor and fabricator of performance plastics, serving industrial and commercial customers since 1946. From our headquarters in Alton, Illinois and through multiple branch locations, we support clients across countless sectorsheavy equipment, transportation, aero… |
evergenbio.com tracker page ↗ | chaosfilter this group | · 9d ago | Evergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs |
corematerials.com tracker page ↗ | chaosfilter this group | · 18d ago | Core Materials (corematerials.com) — Countdown to Publication Management at Core Materials has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are m… |
macallister.com tracker page ↗ | chaosfilter this group | · 18d ago | MacAllister (macallister.com) — Countdown to Publication Management at MacAllister has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving fo… |
singleton.com tracker page ↗ | chaosfilter this group | · 19d ago | Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia. |
parkderochie.com tracker page ↗ | chaosfilter this group | · 21d ago | Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo… |
mswalker.com tracker page ↗ | chaosfilter this group | · 21d ago | MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o… |
copcp.com tracker page ↗ | chaosfilter this group | · 21d ago | Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en… |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.