Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents9 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Dublin City Schools GA tracker page ↗ | eclipsefilter this group | · 1d ago | Dublin City Schools is a charter school system dedicated to preparing students to be effective communicators, problem solvers, and lifelong learners. The district offers a range of academic programs, including advanced and gifted education, special education, and various support services. Their intended clients include students and families in Dublin, Georgia, as well as educators seeking employment opportunities within the district |
Rosello et Fils tracker page ↗ | eclipsefilter this group | · 1d ago | Rosello & Fils is a fruit and vegetable wholesaler based in Saint-Laurent-Blangy, France. With over 100 years of experience, the company operates exclusively within the Hauts-de-France region, serving professionals in the Nord, Pas-de-Calais, and Somme departments. Its client base includes commercial and collective catering, local shops, and large and medium-sized retail surfaces |
The Zhou Law Group tracker page ↗ | eclipsefilter this group | · 7d ago | The Zhou Law Group is one of the largest family law firms in California, specializing in divorce and related family law issues such as child custody, spousal support, and property division. With a team of top-rated divorce lawyers and Certified Family Law Specialists, they provide effective legal solutions to clients, including tech company founders and high asset-holders. The firm operates in the Greater Bay Area and Greater Los Angeles, offering services in multiple languages, including English and Chinese. Their reputation for professionalism and client care has earned them stellar reviews and a strong presence in the family law industry. |
TTG Asia Media tracker page ↗ | eclipsefilter this group | · 7d ago | TTG Asia is a leading travel trade business resource in the Asia-Pacific region, established in 1974. The company provides a comprehensive range of services and information related to travel, including hotels, transportation, airlines, and cruises. Its intended clients include travel professionals and businesses within the tourism industry looking for insights and resources to enhance their operations. TTG Asia also features news, trade calendars, and branded content to support the growth of the travel sector. |
Royal Plaza On Scotts tracker page ↗ | eclipsefilter this group | · 13d ago | Royal Plaza on Scotts Hotel is a five-star independent hotel located in the heart of Singapore's Orchard Road, offering spacious and modern accommodations. With a legacy of over 50 years, it has been recognized as Asia Pacific's Best Independent Hotel, providing guests with a comfortable stay and award-winning halal-certified dining at its renowned Carousel restaurant. The hotel caters to both leisure and business travelers, featuring facilities for meetings, events, and weddings. Guests can enjoy exclusive offers and loyalty rewards through the I Prefer Hotel Rewards Programme. |
ETNA Software tracker page ↗ | eclipsefilter this group | · 18d ago | ETNA Software is a company that provides white-label online trading solutions for brokers and FinTech firms, including mobile and web trading platforms. Their products are designed to help retail broker-dealers launch trading capabilities efficiently and cost-effectively. |
Simplex Engineering tracker page ↗ | eclipsefilter this group | · 20d ago | Simplex Engineering & Foundry Works Pvt. Ltd. specializes in the design, fabrication, machining, and assembly of industrial equipment and components. With over seventy years of experience, the company has successfully completed numerous turnkey projects for both private and public sector organizations. Additionally, Simplex offers refurbishment services for industrial equipment and steel procurement through its Steel Service Center. Their esteemed clientele includes some of the largest engineering companies in India. |
Crystal Pharmatech tracker page ↗ | eclipsefilter this group | · 25d ago | Crystal Pharmatech is a technology-driven contract research organization (CRO) that focuses on materials science and engineering for drug development. Established in 2010 and have R&D centers located in Suzhou (China), New Jersey, San Francisco (USA), and Toronto (Canada). Also its key differentiator is integrated and specialized services, including API solid-state research, crystallization, preformulation, formulation development and manufacturing, clinical supply. |
Moscord tracker page ↗ | eclipsefilter this group | · Aug 16, 2026 | Moscord is a digital marketplace that connects buyers and sellers in the maritime industry, offering a platform for various suppliers to aggregate and present their products. The company aims to enhance business operations for its clients by providing innovative solutions in procurement, logistics, and eCommerce. Targeting maritime and oil & gas sectors, Moscord serves a global clientele through its extensive network of ports and offices across multiple countries. With a focus on improving user experience and operational efficiency, Moscord leverages advanced technology and industry expertise to facilitate seamless transactions. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.