Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
182
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 155 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | akira | 9 | = | 44 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 5 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 9 | ▲5 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 2 | ▼1 | 15 | 32 | 32 | active | no public figure | |
| 18 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents112 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
www.appliancefactory.com tracker page ↗ | inc ransomfilter this group | · just now | No details on the leak post beyond the victim name. |
www.diarco.com.ar tracker page ↗ | inc ransomfilter this group | · just now | No details on the leak post beyond the victim name. |
Silicon Integrated Systems tracker page ↗ | inc ransomfilter this group | · just now | No details on the leak post beyond the victim name. |
Partners Financial Services, a.s. tracker page ↗ | inc ransomfilter this group | · 23h ago | Date: September 2026 Target: Partners Financial Services, a.s. (IČO: 27699781) Location: Prague, Czech Republic Industry: Financial Services / Banking / Insurance |
aidon.com tracker page ↗ | inc ransomfilter this group | · 23h ago | Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach Date: September 2026 Sector: Critical Infrastructure — Energy / Smart Grid Country: Finland Parent Company: Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) |
Zito Marketi tracker page ↗ | inc ransomfilter this group | · 23h ago | In the retail industry, there is a persistent myth that to scale nationally, a brand must inevitably shed its local soul. The prevailing logic dictates that as a chain expands, the neighborhood warmth of its origins is replaced by sterile corporate efficiency, and the familiar faces behind the counter are swapped for standardized kiosks. But in North Macedonia, a retail network that now spans dozens of towns and employs over 850 people is quietly dismantling that assumption. They are proving that the secret to dominating a national market might just be remembering exactly what it feels like to run a single corner store. |
City of Princeton tracker page ↗ | inc ransomfilter this group | · 23h ago | Date added: September 2026 Website: princetontx.us Sector: Government / Municipal Administration Location: Collin County, Texas, USA (Dallas-Fort Worth Metroplex) Employees: ~150+ Annual Budget: $30–50M |
Chicago History Museum tracker page ↗ | inc ransomfilter this group | · 23h ago | Organization: Chicago History Museum (formerly Chicago Historical Society) Location: 1601 N Clark Street, Chicago, IL 60614 Website: chicagohistory.org CEO: Michael J. Anderson, President & CEO Industry: Non-profit / Cultural Institution Breach Date: September 2026 Data Volume: 4 departments + AWS cloud infrastructure, 15+ years of records Individuals Affected: 20,000+ |
jms building corporation tracker page ↗ | inc ransomfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
cullottalaw.com tracker page ↗ | inc ransomfilter this group | · 7d ago | No details on the leak post beyond the victim name. |
https://mediengruppethiel.de/ tracker page ↗ | inc ransomfilter this group | · 7d ago | No details on the leak post beyond the victim name. |
Wellness Partners network(combined revenue) tracker page ↗ | inc ransomfilter this group | · 9d ago | No details on the leak post beyond the victim name. |
myglobal.com tracker page ↗ | inc ransomfilter this group | · 13d ago | No details on the leak post beyond the victim name. |
Asfaltos y Pavimentos S.A. (Asfalpasa) tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Westfield Public School District tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Trucka tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Policlinico Triestino tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Multiver Ltée tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Metales Panamericanos tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
specialtytextile.com tracker page ↗ | inc ransomfilter this group | · 15d ago | No details on the leak post beyond the victim name. |
FFKR Architects tracker page ↗ | inc ransomfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
New Century Ophthalmology Group tracker page ↗ | inc ransomfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
zummocorp.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
www.lichtvision.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
www.renorefractories.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
cimbsecurities.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
wittmann tracker page ↗ | inc ransomfilter this group | · 19d ago | No details on the leak post beyond the victim name. |
Oilquip Inc tracker page ↗ | inc ransomfilter this group | · 19d ago | No details on the leak post beyond the victim name. |
BENCIVIL tracker page ↗ | inc ransomfilter this group | · 20d ago | No details on the leak post beyond the victim name. |
Rohloff Group tracker page ↗ | inc ransomfilter this group | · 21d ago | No details on the leak post beyond the victim name. |
Ruby Seven Studios tracker page ↗ | inc ransomfilter this group | · 21d ago | No details on the leak post beyond the victim name. |
el-group tracker page ↗ | inc ransomfilter this group | · 25d ago | No details on the leak post beyond the victim name. |
BANGKOKCABLE tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
UNIPLASTICS.COM tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
CDGARVINLAW tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
EXEL tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
SD Associates Sdn Bhd tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Third Coast Bancshares tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Foresee Pharmaceuticals tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
SpearFin Ltd tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
ssf-int.com ssf-ing.de tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
nyklawfirm.com nyk.ae tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Lansing Urgent Care tracker page ↗ | inc ransomfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Otter Tail County, Minnesota tracker page ↗ | inc ransomfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
cambrialawfirm.com tracker page ↗ | inc ransomfilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
https://pacific-construction.com/ tracker page ↗ | inc ransomfilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
clgroup tracker page ↗ | inc ransomfilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
gamaus.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
stuartandassociates.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
BEDC.COM.AU tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
diabetesandmetabolism.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
Louisville Bar Association tracker page ↗ | inc ransomfilter this group | · Aug 8, 2026 | No details on the leak post beyond the victim name. |
ATMS tracker page ↗ | inc ransomfilter this group | · Aug 7, 2026 | No details on the leak post beyond the victim name. |
vprj.org tracker page ↗ | inc ransomfilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
lantisnet.com tracker page ↗ | inc ransomfilter this group | · Aug 5, 2026 | No details on the leak post beyond the victim name. |
Loyalist College tracker page ↗ | inc ransomfilter this group | · Aug 5, 2026 | No details on the leak post beyond the victim name. |
TRULITE GLASS & ALUMINUM SOLUTIONS tracker page ↗ | inc ransomfilter this group | · Aug 5, 2026 | Trulite Glass & Aluminum Solutions is one of the largest independent glass and aluminum fabricators in North America. Headquartered in Alpharetta, Georgia, the company operates 42 manufacturing and distribution facilities across the United States and Canada, employing approximately 1,700 people. Trulite is a portfolio company of Truelink Capital, a Los Angeles–based private equity firm that acquired the company from Sun Capital Partners in 2022. Annual Revenue: $693,500,000 (FY2025 audited) Total Assets: $651,000,000 Total Debt: $355,700,000 |
clintonhealthaccess.org tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
pushidrosal.id tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
lccgroup.com tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.