Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
181
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 7 | ▲4 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 6 | = | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | ▲1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 18 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 19 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 20 | vexy | 3 | ▼8 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims9 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC tracker page ↗ | insomniafilter this group | · 1d ago | Large U.S. plaintiffs firm with Alabama, D.C., and Florida offices. Since 1985, it’s been known for excellence in discrimination, consumer protection, and employment law, leading class actions that advance protections for victims. |
Metropolitan Community Health Services tracker page ↗ | insomniafilter this group | · 2d ago | Agape Health Services, a CCBHC/FQHC run by Metropolitan Community Health Services, offers sliding-scale primary, preventive, dental, pharmacy, and behavioral health care, plus mobile, law-enforcement, training, and reentry services. |
Massey, Stotser & Nichols tracker page ↗ | insomniafilter this group | · 2d ago | Massey, Stotser & Nichols is a Birmingham, AL law firm offering real estate, family law, and civil/corporate litigation. They serve Fortune 500, businesses, and individuals, delivering personalized solutions with big-firm capability. |
NorthShore Health Centers tracker page ↗ | insomniafilter this group | · 9d ago | NorthShore Health Centers offers comprehensive care in Indiana, including behavioral health, dental, pediatrics, and women’s health. It runs multiple health centers and mobile units across Porter, Lake, La Porte, and Jasper counties. |
Maglin, Miskiv & Associates tracker page ↗ | insomniafilter this group | · 13d ago | Maglin Miskiv & Associates in Parsippany, NJ offers personalized accounting, tax planning, bookkeeping, payroll, financial consulting, tax prep, and audit support for individuals and businesses. |
N*************** tracker page ↗ | insomniafilter this group | · 14d ago | Medical center with 9 locations offers coordinated care for patients and families, including dentistry, digital X-rays, ultrasound, bone density scans, mammograms, lab testing, and mental health counseling in a comfortable setting. |
Metro Tulsa Foot tracker page ↗ | insomniafilter this group | · 16d ago | A comprehensive foot and ankle treatment center with five locations in the Tulsa Metro area. They offer a range of services including treatment for common foot pains, deformities, and injuries, and provide same-day appointments for urgent needs. |
Aurora Health Management tracker page ↗ | insomniafilter this group | · 28d ago | Aurora Health Management, LLC operates a skilled nursing and rehab center in Frederick, MD. With nearly 25 years in long-term care, it improves troubled facilities through comprehensive management, programs, and Medicare/Medicaid standards. |
*********** tracker page ↗ | insomniafilter this group | · 28d ago | A private firm offering fluid system solutions for the oil, gas, chemical, and semiconductor sectors. It employs 3,600+ people across 10 factories, three tech centers, and about 100 sales and service locations in 50 different countries. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.