Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
181
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 7 | ▲4 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 6 | = | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | ▲1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 18 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 19 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 20 | vexy | 3 | ▼8 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims41 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Little Otter tracker page ↗ | direwolffilter this group | · 2d ago | No details on the leak post beyond the victim name. |
Hazel Health tracker page ↗ | direwolffilter this group | · 2d ago | No details on the leak post beyond the victim name. |
Port of Tanjung Pelepas tracker page ↗ | direwolffilter this group | · 5d ago | No details on the leak post beyond the victim name. |
RelyComply AML Platform tracker page ↗ | direwolffilter this group | · 7d ago | No details on the leak post beyond the victim name. |
Sales Boomerang tracker page ↗ | direwolffilter this group | · 8d ago | No details on the leak post beyond the victim name. |
EMS1R tracker page ↗ | direwolffilter this group | · 8d ago | No details on the leak post beyond the victim name. |
TrainMe tracker page ↗ | direwolffilter this group | · 9d ago | No details on the leak post beyond the victim name. |
Precision Vehicle Logistics tracker page ↗ | direwolffilter this group | · 9d ago | No details on the leak post beyond the victim name. |
Lightcast tracker page ↗ | direwolffilter this group | · 9d ago | No details on the leak post beyond the victim name. |
Semper Laser tracker page ↗ | direwolffilter this group | · 9d ago | No details on the leak post beyond the victim name. |
eAssist Dental Solutions tracker page ↗ | direwolffilter this group | · 10d ago | No details on the leak post beyond the victim name. |
Mission Pet Health tracker page ↗ | direwolffilter this group | · 10d ago | No details on the leak post beyond the victim name. |
myLaurel tracker page ↗ | direwolffilter this group | · 10d ago | No details on the leak post beyond the victim name. |
Wolfram Research tracker page ↗ | direwolffilter this group | · 12d ago | No details on the leak post beyond the victim name. |
Cartrack Holdings tracker page ↗ | direwolffilter this group | · 14d ago | No details on the leak post beyond the victim name. |
PTT Oil and Retail Business tracker page ↗ | direwolffilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Honeycomb Programs Inc tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
PT Intraco Penta Tbk tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Oportunidados tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
THQ Nordic tracker page ↗ | direwolffilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Erdem Hospital tracker page ↗ | direwolffilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Hospital Clnico Universidad de Chile tracker page ↗ | direwolffilter this group | · 17d ago | No details on the leak post beyond the victim name. |
National Kidney Registry tracker page ↗ | direwolffilter this group | · 22d ago | No details on the leak post beyond the victim name. |
Studio Legale ESE tracker page ↗ | direwolffilter this group | · 22d ago | No details on the leak post beyond the victim name. |
NorthStar tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Aztec Software tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
The Revel Collective tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
ProSim Aviation Research tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Authenticate Information Systems tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Diaco Global tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
iSON XPERIENCES tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Deer Creek-Mackinaw CUSD tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Allstar Industries tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
HP Carriers tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
MCT Group of Companies tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Reviso Cloud Accounting Limited tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Studee tracker page ↗ | direwolffilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Photon Health, Inc. tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
InfoFlo CRM tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
PayUp tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Lifesum tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.