Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims11 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Cumar Marble & Granite tracker page ↗ | dark projectfilter this group | · 1d ago | Cumar Marble & Granite, a company specializing in luxury kitchens, bathrooms, and custom projects, has been the target of a massive cyberattack. Hackers stole 489 gigabytes of data from the company’s servers, including personal information, technical drawings, and financial documents. This incident raises serious concerns regarding the theft of intellectual property and potential breaches of employee and customer privacy. |
Specchem LLC tracker page ↗ | dark projectfilter this group | · 7d ago | A cyberattack on Specchem LLC resulted in a massive data breach. As a result of the incident, approximately 500 GB of data—containing roughly 700,000 files, including confidential personal and financial information—was stolen. |
MEI Architects tracker page ↗ | dark projectfilter this group | · 9d ago | As a result of the attack, 340 GB of data (approximately 130,000 files) was stolen: including Social Security numbers, passports, green cards, invoices, HR documents, and a vast number of architectural drawings—including those from past and current projects, as well as those currently under construction. |
Alurwalls tracker page ↗ | dark projectfilter this group | · 9d ago | Alurwalls was attacked, resulting in the theft of approximately 17 GB of confidential data. The stolen information includes banking and other financial documents, client building plans, and other personal data belonging to the company and its partners. Currently, more than 16,000 files are no longer protected by Alurwalls. |
Master Manufacturing Co., Inc. tracker page ↗ | dark projectfilter this group | · 9d ago | Master Manufacturing Co specializing in custom metal stamping and production services has fallen victim to a significant cyberattack. Hackers reportedly exfiltrated 36 gigabytes of sensitive data from the company’s servers. The stolen information includes SQL databases containing personal data, as well as technical plans and schematics for custom metal parts. The breach raises serious concerns regarding intellectual property theft and potential privacy violations for employees and clients. |
Dentist in New Britain, CT tracker page ↗ | dark projectfilter this group | · 22d ago | As a result of the attack, the following were compromised: the entire customer database, consisting of just over 8,000 files, as well as a small number of records containing Social Security numbers |
Pump Engineering Company tracker page ↗ | dark projectfilter this group | · 22d ago | During the cyberattack, 120,000 files (115 GB) were stolen, including an extensive customer database, insurance documents, confidential financial documents, and a vast number of project drawings. |
Furnished Quarters tracker page ↗ | dark projectfilter this group | · 23d ago | The company "Furnished Quarters" was the victim of a successful cyberattack, as a result of which the company’s confidential data was stolen. The volume of data stolen amounts to 155 GB. The data stolen included the company’s customer details, as well as documents containing banking and financial information. Currently, around 198,000 files are no longer under the control of "Furnished Quarters". |
Design-Aire Engineering, INC tracker page ↗ | dark projectfilter this group | · 23d ago | Design-Aire Engineering, INC has suffered a cyberattack on its service systems, resulting in the theft of approximately 377GB of sensitive data. The breached information includes employees' personal data and detailed architectural plans of clients' buildings. |
Jones, Little & Co., CPAs, LLP tracker page ↗ | dark projectfilter this group | · 23d ago | At least 100 gigabytes of company data—including financial records, internal files, and employee personal information—were stolen in a cyberattack. Hackers encrypted the firm's systems after exfiltrating the documents, leaving operations paralyzed. |
The Liberty Group tracker page ↗ | dark projectfilter this group | · 23d ago | A company has suffered a major cyberattack resulting in the theft of approximately 27,000 internal files. The leaked documents include financial records, internal working materials, and personal data of employees. Attackers encrypted the company's systems following the breach, severely disrupting operations |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.