Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims28 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Bernath & Rosenberg tracker page ↗ | genesisfilter this group | · 22h ago | A full service CPA firm |
Dorfman Abrams Music, P.C tracker page ↗ | genesisfilter this group | · 22h ago | A full service CPA firm |
S******* tracker page ↗ | genesisfilter this group | · 21d ago | An International Public Company |
Hospitality Health ER (Longview) tracker page ↗ | genesisfilter this group | · 22d ago | A healthcare organization |
**E*** tracker page ↗ | genesisfilter this group | · Aug 12, 2026 | A healthcare organization |
Consolidated Medical Practices of Memphis tracker page ↗ | genesisfilter this group | · Aug 11, 2026 | A healthcare organization |
Interim HealthCare tracker page ↗ | genesisfilter this group | · Aug 11, 2026 | A healthcare organization dealing with elderly care services |
**** tracker page ↗ | genesisfilter this group | · Jul 31, 2026 | A healthcare organization |
Boyum IT Solutions (HOT!) tracker page ↗ | genesisfilter this group | · Jul 31, 2026 | A provider of IT services |
C.A. Walker Construction tracker page ↗ | genesisfilter this group | · Jul 31, 2026 | A construction management company |
Williams Accounting Professional tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A full service CPA firm |
JJP Slip Forming Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A company that operates in the Restaurants industry |
Building Envelope Systems tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A reputable construction company based in Plainville, MA |
Westlake Realty Group, Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A full-service real estate development company |
Servonix Technologies tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A provider of IT services |
Infinity Pipeline,Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A family owned, local construction company. |
Apex Agro, LLC tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A Chemical Production Company |
Mirage Endoscopy Center tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A healthcare organization |
Bri-Tech, Inc tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A technology design and integration firm |
SBI Software tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | An Enterprise Resource Planning Software Provider |
DICON tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A general contracting construction firm |
Westgate tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A construction management company |
Dunagan Associates tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | Provides services in residential real estate and insurance |
Synergy Interactive tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A provider of staffing services |
East Texas Family Medicine tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A healthcare organization |
Brooklyn Defender Services tracker page ↗ | genesisfilter this group | · Jun 30, 2026 | A legal organization dedicated to safeguard the rights of its clients |
United Personnel (a division of Masis Staffing Solutions) tracker page ↗ | genesisfilter this group | · Jun 18, 2026 | A provider of staffing services |
The Associated Builders and Contractors of Indiana/Kentucky tracker page ↗ | genesisfilter this group | · Jun 18, 2026 | A trade association |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.