Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents6 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Navitrans tracker page ↗ | emperadorfilter this group | · 2d ago | Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. Publication scheduled: 2026-09-23 13:01:31 UTC Size: 223.2 MB Sectors: Manufacturing, Transportation |
Nexbex Solutions Private Limited tracker page ↗ | emperadorfilter this group | · 4d ago | Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB. Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc. Subdomains Type staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle admin.bookings-staging, backend.academy, admin.spike.booking, etc. We have the source code for all 200+ of their projects. 10 GB +. going up. Publication scheduled: 2026-09-22 13:15:18 UTC Size: 600 MB Sectors: Technology |
EASY JOB S.A.S. tracker page ↗ | emperadorfilter this group | · 5d ago | Colombian Company. Audit and Tax Audit with more than 5 years of experience Calle 17 sur 44 - 159 Oficina 1501 EDIFICIO CLAROSCURO, Medellín Colombia. Llámanos o escríbenos: 310 447 2013 - 313 796 9917 The archives contain personal data of employees and customers of the company, tax documents, databases and other important documents 17000 documents Publication scheduled: 2026-09-20 10:21:04 UTC Size: 2.7 GB Sectors: Finance |
Bosnia and Herzegovina Mine Action Center tracker page ↗ | emperadorfilter this group | · 6d ago | important documents Publication scheduled: 2026-09-19 12:33:49 UTC Size: 1.7 GB Sectors: Other |
BAYMER tracker page ↗ | emperadorfilter this group | · 6d ago | Important documents Publication scheduled: 2026-09-19 11:23:44 UTC Size: 1.4 GB Sectors: Other |
Universal Starch-Chem Allied Ltd tracker page ↗ | emperadorfilter this group | · 6d ago | important documents Publication scheduled: 2026-09-19 11:13:14 UTC Size: 3.5 GB Sectors: Other |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.