Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
208
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 114 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼7 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims13 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
metrabyte.cloud tracker page ↗ | eraleign (apt73)filter this group | · Jul 24, 2026 | metrabyte.cloud is the website of Metrabyte Cloud Co., Ltd., a cloud service provider from Thaila... |
dgcement.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 6, 2026 | dgcement.com — this is the website of D.G. Khan Cement Company Limited (DG Cement), a major cem... |
azarestan.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 6, 2026 | azarestan.com (Azarestan Business Development Group) is a holding company based in Iran. Azaresta... |
vicentetrapani.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 6, 2026 | vicentetrapani.com — this is the website of Vicente Trapani S.A., an agro-industrial holding co... |
westernint.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 6, 2026 | Western International Group is a large private conglomerate based in Dubai that operates in the r... |
aydeniz.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 3, 2026 | Aydeniz Group is a family-owned group of companies founded in 1975, operating in several key indu... |
flazio.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | lazio.com — this is a company from Italy. Flazio is a website builder platform that allows use... |
holidaypalace.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | Holiday Palace Hotel in Spain. Guest information, internal documents, reports, photos, videos, an... |
ritavo.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | ritavo.com is the website of Rita Võ Group, a private multidisciplinary holding company from Vie... |
viennaairport.com (SOLD TO 3RD PARTY) tracker page ↗ | eraleign (apt73)filter this group | · Jun 29, 2026 | SOLD TO 3RD Party! No DATA AVALIABLE! Vienna Airport (Flughafen Wien AG) is an Austrian company, ... |
gov.br tracker page ↗ | eraleign (apt73)filter this group | · Jun 23, 2026 | Gov.br — this is the official state digital platform and domain zone of the Brazilian Federal G... |
kliknklik.com tracker page ↗ | eraleign (apt73)filter this group | · Jun 23, 2026 | KliknKlik.com — a company from Indonesia, an online retailer and distributor of computer equipm... |
viennaairport.com tracker page ↗ | eraleign (apt73)filter this group | · Jun 23, 2026 | Vienna Airport (Flughafen Wien AG) is an Austrian company, the operator of Vienna International A... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.