Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
225
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 19 | ▲4 | 116 | 360 | 360 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 4 | ▼8 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 105 | 105 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 32 | 32 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 9 | ▲4 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 2 | = | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 13 | 71 | 71 | active | no public figure | |
| 22 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 23 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 24 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents13 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Community Property Management tracker page ↗ | dragonforcefilter this group | · 2h ago | full data 200 GB+ We have been in business since 1978 as a management firm specializing in the management of common interest developments including condominiu... |
Owen Leigh Optometry tracker page ↗ | dragonforcefilter this group | · 2h ago | Full DATA 400 GB+ The brain uses the eyes to gather information about our surroundings. The brain cannot process all our view so it must first decide what to l... |
Medical Department Store tracker page ↗ | dragonforcefilter this group | · 4d ago | Medical Department Store in united state |
Homewood Sales tracker page ↗ | dragonforcefilter this group | · 11d ago | Homewood Sales Corporation specializes in equipment life extension solutions, offering a wide range of products including automatic voltage regulators, control ... |
Norwood Law Firm tracker page ↗ | dragonforcefilter this group | · 11d ago | Norwood Law is a Tulsa-based legal firm that specializes in personal injury law, criminal defense, business law, and family law. Founded by attorney Joe Norwood... |
rubbermill.com tracker page ↗ | dragonforcefilter this group | · 14d ago | ═════════════════ ═════════════════ ═════════════════ RUBBERMILL, INC. DUMP: BREAKDOWN OF AN OEM MANUFACTURER LEAK ═════════════════ ═════════════════ ═══════... |
Criba tracker page ↗ | dragonforcefilter this group | · 22d ago | (release includes data on Argentina, Uruguay, and other countries, as well as financial documents and client documentation, including a vast amount of informati... |
Brookview Financial tracker page ↗ | dragonforcefilter this group | · 22d ago | (data of many thousands of customers, including credit reports, SSNs, addresses, etc.) Brookview Financial is a boutique private lender specializing in quick-cl... |
Wozair tracker page ↗ | dragonforcefilter this group | · 22d ago | Wozair specializes in the design, manufacture, and installation of heavy-duty heating, ventilating, and air conditioning (HVAC) products for various sectors inc... |
Frato tracker page ↗ | dragonforcefilter this group | · 22d ago | (release includes data for the entire group of companies across all countries of operation, financial documentation, shareholder information, personal data of e... |
Hogan Omidi P.C. tracker page ↗ | dragonforcefilter this group | · 26d ago | Hogan Omidi, P.C. is a boutique law firm specializing in family law, including divorce, child custody, and property division, with a focus on high-asset cases. ... |
R & D Machine and Engineering tracker page ↗ | dragonforcefilter this group | · 28d ago | &D Machine and Engineering, LLC specializes in CNC machining of precision metal components primarily for the aerospace, defense, and space industries. The compa... |
Vermont XCenter tracker page ↗ | dragonforcefilter this group | · 29d ago | A Vermont coloca seus clientes estrategicamente no Centro das Decisões, pois entende que o cliente deve estar no Centro das Atenções. Com isso estabelecido, a c... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.