Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents71 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
The Schuett Companies tracker page ↗ | dragonforcefilter this group | · Jul 11, 2026 | The Schuett Companies, Inc. is a family-owned business with over 50 years of experience specializing in affordable housing for seniors, individuals with disabil... |
hive360.com tracker page ↗ | dragonforcefilter this group | · Jul 7, 2026 | HIVE360 is a UK-based employment administration and employee benefits specialist. They help businesses streamline their payroll and HR operations while improvin... |
amplesurveyor.com tracker page ↗ | dragonforcefilter this group | · Jul 7, 2026 | Ample Surveyor Services Limited is a professional property and construction consultancy firm based in Hong Kong. |
medipakpharma.com tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | The Pakistani pharmaceutical company Medipak Limited (medipakpharma.com) specializes in the manufacture of infusion solutions, medical devices, and pharmaceutic... |
hwaseng tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | A Taiwanese manufacturer with forty years of experience, specializing in the high-precision production of metal fasteners, precision-machined parts, and compone... |
agroprime tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | development of specialized software (SaaS) for automating agribusiness management and monitoring field personnel |
stni.co.kr tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | Creating accurate virtual replicas involves production facilities, workshops, and equipment for modeling, testing, and optimizing technological processes. |
vipimaging tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | VIP Imaging is the largest mobile nuclear imaging company in Southern California, specializing in cardiac PET/CT and SPECT studies for cardiologists. The compan... |
Aptora tracker page ↗ | dragonforcefilter this group | · Jun 27, 2026 | Aptora is an aggressively growing software company in Lenexa, KS. The company offers award-winning software and consulting services to the service and contracti... |
bits-pilani.ac.in tracker page ↗ | dragonforcefilter this group | · Jun 22, 2026 | BITS Pilani is a premier Indian private research university and "Institution of Eminence" known for elite engineering and science programs across five campuses.... |
mihana-v.com tracker page ↗ | dragonforcefilter this group | · Jun 22, 2026 | Here is the comprehensive corporate overview of MIHANA Seisakusho Co., Ltd. based on their official company profiles, technical catalogs, and industrial registr... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.