ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Leak-site victims · 7d
238
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen32▲9157413413activeno public figure
2qilin18▲2117359359activeno public figure
3krybit13▲11479696activeno public figure
4direwolf5▼6456262activeno public figure
5storm44▲44445656activeno public figure
6akira7▼1388282activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
7coinbase cartel0=375656activeno public figure
8inc ransom3▼636106106activeno public figure
9lockbit55▼1278686activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10shinyhunters1▼2243434activeno public figure
11safepay20▲20227272activeno public figure
12leakeddata0▼8203838activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15audit team10▲6181919activeno public figure
16emperador6▲5181919activeno public figure
17panzer6▲3172424activeno public figure
18kazu0▼17171717activeno public figure
19play4▲4144444activeno public figure
20vexy4▼6141414activeno public figure
21black nevas13▲13131313activeno public figure
22chaos5▲4123434activeno public figure
23everest0▼4123434activeno public figure
24pear1▼1122727activeno public figure
25rhysida3▲1121515activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

TypeAllRansomware leak sitesBreaches (HIBP)Window7d30d90dAllgroup: interlock ✕

Incidents5 records · full details

VictimGroup / typeDiscoveredDetails
Springfield Public Schools
tracker page ↗		 interlockfilter this group · 56m agohttps://www.springfieldpublicschools.com/ Springfield Public Schools in Springfield, Massachusetts, is the third-largest school district in the state, with over 23,500 students and over 4,200 full-time employees. The school budget accounts for more than two-thirds of the city's total budget, which is approximately $700 million. Yet, they fail to ensure student safety and do nothing to address this problem. As a result, their negligence has led to a major breach of student and employee data. Extensive student databases are now available, containing last name, first name, student number, enrollment status, grade level, home address, home phone number, and ethnicity. You also have access to more than 10,000 company contacts, incident databases, phone records, and medical information. This raises the question: where are the allocated funds going? Why aren't they keeping their students safe?
City of Fort Smith Arkansas
tracker page ↗		 interlockfilter this group · 3h agohttps://www.fortsmithar.gov/ The City of Fort Smith is committed to providing high-quality, resident-focused services to foster a thriving community. This is how they try to position themselves, but in reality, they are very negligent towards their residents and organizations within the city due to their negligent attitude towards security and lack of desire to solve problems, were compromised resulting in a major leak of confidential data over 5.6 TB of data, which includes key infrastructure facilities of Fort Smith (Public Safety System: Police Station, Fire Department, Communications Center (responsible for the 911 emergency dispatch service), Water System: including numerous water and sewer treatment plants, Information Systems: computer systems and networks that support the operation of various departments of the city). As a result of a major leak of the city, you are provided with databases and documents of all their structures (Police and Crime Information: The Arkansas Crime Information Center and the FBI Criminal Justice Information Service system are available information on license plates and driver's licenses, Confidential law enforcement data, such as personally identifiable information (PII), such as Names, addresses, and phone numbers of residents.) More than 100,000 SSNs, reports and police station files with photos from the reports, as well as software used by cyberpolice to work with phone data, as well as reports and dumps of people's phones, and most importantly, their data on the water supply system and a complete database of 911 calls and incidents.
NFM Lending
tracker page ↗		 interlockfilter this group · 8d agohttps://nfmlending.com/ NFM Lending is a national mortgage lender with over 1,000 employees that originated approximately $7.15 billion in mortgages in the past 12 months. The data breach exposed over 2.5 TB of sensitive personal customer information (names, Social Security numbers, bank accounts, credit information, loan terms, addresses, phone numbers, email addresses, borrower and loan identifiers, loan pricing, and itemized loan expense reports), as well as proprietary pricing/profit formulas, in violation of federal GLBA/FCRA, state privacy laws, and the CFPB's data breach reporting rules. You also have access to data from the Encompass database, which contains information on more than 1 million clients, as well as internal databases, an extensive database of tax forms, and employees' personal information.
Super Systems Inc
tracker page ↗		 interlockfilter this group · 15d agohttps://supersystems.com/ Super Systems, Inc. develops and manufactures products for the heating industry. However, it is extremely negligent in its own security and that of its customers, resulting in data breaches. You can view documents revealing confidential control schemes and vulnerabilities in customer systems, SSi's entire client portfolio, and confidential financial information about outstanding customer accounts, which undermines trust and damages the company's reputation. You are also provided with a list of over 500 customers with their contact information and price lists for products and services. You are also provided with SSi's intellectual property, a full suite of software for process control, data collection, analysis, and product tracking.
Southeastern Oklahoma State University
tracker page ↗		 interlockfilter this group · 27d agohttps://www.se.edu/ Southeastern Oklahoma State University is a public, four-year university located in Durant, Oklahoma. A data breach exposed student educational records (including names, contact information, Social Security numbers, grades, enrollment data, financial aid information, disciplinary records, and medical information contained in educational records). This breach violates the Family Educational Rights and Privacy Act (FERPA), the HIPAA Privacy Rule, and students' common-law privacy rights. The breach affected employee personal data and injury information, including employee name, date of birth, date of injury, as well as Social Security number, Medicare card, and child custody/consent status. More than 90,000 student names, Social Security numbers, and student identification numbers, as well as Forms 1095-C and more than 490 documents.

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.