Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
204
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 114 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 45 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 114 | 114 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims14 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
City of Atlanta (atlantaga.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
City of Houston (houstontx.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Wesco International tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Bonava tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
UK Department for Education (education.gov.uk) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Police National Legal Database tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Microsoft tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Allstate tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
TaylorMade & Sun Day Red golf tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Frontier Airlines tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Zenith Bank Plc tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
District of Columbia Public Schools (dcps.dc.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Newcastle University (ncl.ac.uk) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Viavi Solutions tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.