Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
179
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 6 | ▲2 | 33 | 109 | 109 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents109 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
PARTNERED HEALTH GROUP tracker page ↗ | inc ransomfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
sslf.local tracker page ↗ | inc ransomfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
harwal.net tracker page ↗ | inc ransomfilter this group | · Jul 29, 2026 | No details on the leak post beyond the victim name. |
Della Casa Group AG tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
https://eclmn.com/ tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
minigrip.com.mx tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
DUCON tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
greenecountyga.gov tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
foundationstofreedom.org tracker page ↗ | inc ransomfilter this group | · Jul 28, 2026 | No details on the leak post beyond the victim name. |
takethehop.com tracker page ↗ | inc ransomfilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
healthlawadvocates.org tracker page ↗ | inc ransomfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
autismuslink.ch tracker page ↗ | inc ransomfilter this group | · Jul 24, 2026 | No details on the leak post beyond the victim name. |
cabincreekhealth.com tracker page ↗ | inc ransomfilter this group | · Jul 23, 2026 | No details on the leak post beyond the victim name. |
Ali-Monde tracker page ↗ | inc ransomfilter this group | · Jul 20, 2026 | No details on the leak post beyond the victim name. |
v-silicon.com tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
FAST.COM.PH tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
D.MAG New Material Technology Co., Ltd. Taiwan Giant tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
vedan corp tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
pokka.co tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
reatile.co.za tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
V&P Nurseries tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
Kyokuto Kaihatsu Kogyo tracker page ↗ | inc ransomfilter this group | · Jul 17, 2026 | No details on the leak post beyond the victim name. |
asa-international.com tracker page ↗ | inc ransomfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
https://www.statebankofnauvoo.com/ tracker page ↗ | inc ransomfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
VantagePoint Management & Autoclear tracker page ↗ | inc ransomfilter this group | · Jul 14, 2026 | No details on the leak post beyond the victim name. |
Golden Glasko & Associates tracker page ↗ | inc ransomfilter this group | · Jul 14, 2026 | No details on the leak post beyond the victim name. |
Aesthetic Surgical Images tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
tecnocurva.com.br tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
samberger24.de tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
oakparkmi.gov tracker page ↗ | inc ransomfilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
tambasa.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
tricountyhs.org tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
acworth-ga.gov tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
carvalima.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
ezortea.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
hamilton-eye.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Colorado Rehabilitation and Occupational Medicine tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
https://www.roundshield.com/ tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
https://sza.it/ tracker page ↗ | inc ransomfilter this group | · Jun 30, 2026 | No details on the leak post beyond the victim name. |
GDN AR(Dorinka) tracker page ↗ | inc ransomfilter this group | · Jun 29, 2026 | No details on the leak post beyond the victim name. |
callhorton.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
johndufourlaw.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
theswansonlawgroup.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
Life Bridges tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
GSP Crop Science Pvt tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
horizoneye.com tracker page ↗ | inc ransomfilter this group | · Jun 24, 2026 | No details on the leak post beyond the victim name. |
belpointeasset.com \ belpointe.com tracker page ↗ | inc ransomfilter this group | · Jun 23, 2026 | No details on the leak post beyond the victim name. |
jktornel tracker page ↗ | inc ransomfilter this group | · Jun 21, 2026 | No details on the leak post beyond the victim name. |
Newspaper Media Group tracker page ↗ | inc ransomfilter this group | · Jun 20, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.