Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
184
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 155 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | akira | 9 | = | 44 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 5 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 9 | ▲5 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 2 | ▼1 | 15 | 32 | 32 | active | no public figure | |
| 18 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims17 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
MSM Unify: Global Education Platform - CA tracker page ↗ | kazufilter this group | · 10d ago | MSM Unify is a global education technology platform that helps students find and apply to international universities and programs. It connects students with 1,500+ campuses and more than 50,000 programs across destinations such as Canada, the USA, the UK, Australia, and Germany. The platform provides support with course selection, university applications, scholarships, visa assistance, education loans, accommodation, and test preparation Ransom: $400 000 | Size: 1.45 TB | Records: 2,020,129 files + 319,163 users | Expires: 2026-09-21 23:59:59 |
Statistics South Africa – Official National Data and Insights Portal tracker page ↗ | kazufilter this group | · 10d ago | the official online portal of South Africa’s national statistics agency, which collects, analyses and disseminates comprehensive data about the country’s people, economy, society and environment to support informed decision‑making by government, businesses and the public. It publishes official statistics on topics like population, employment, inflation, trade, and living conditions, offers data tools and interactive visuals, and provides access to reports, surveys and census results Price: $2,000 | Size: 154 GB | Records: 453 362 Files | Dump date: 2026 |
Gauteng City Region Academy (GCRA) tracker page ↗ | kazufilter this group | · 10d ago | government-funded program that helps students from Gauteng Province pursue full-time undergraduate or postgraduate studies at accredited universities and colleges. It covers tuition, accommodation, books, and sometimes living expenses, aiming to reduce financial barriers for talented students. Price: $2,000 | Size: 147 GB | Records: 429 473 Files | Dump date: 2026 |
HealthDaq tracker page ↗ | kazufilter this group | · 10d ago | Healthdaq is a company that helps hospitals and care providers hire staff directly, without using recruitment agencies. They provide software and services to find, manage, and onboard workers faster and more efficiently, aiming to save costs and make in-house hiring easier.... The breach include : ID cards - Passports - Driving license - Certificates of achievement - Professional Registration Certificate - English Language Certificate - Criminal Background Check - Right to work - Occupational Health Declaration - Proof of address - Vaccine Records - Travel Clearance.... Price: $7,000 | Size: 431 GB | Records: 457 188 Files | Dump date: 2026 |
Health Time tracker page ↗ | kazufilter this group | · 10d ago | HT Médica is a comprehensive imaging diagnostic center that offers advanced radiology and digital pathology services for precise and personalized diagnosis. With a multidisciplinary medical team, they provide a wide range of diagnostic tests across more than 20 centers in Spain. Their commitment to patient care is reflected in their use of the latest techniques and technologies. HT Médica aims to be a trusted partner in health prevention and well-being for their clients. Price: $4,000 | Size: XXXX | Records: 2 253 981 users | Dump date: 2026 |
Natclar (S.G. Natclar S.A.C.) tracker page ↗ | kazufilter this group | · 10d ago | Peruvian occupational health services company headquartered in Lima and founded in 1999. The company provides medical and health management services for workers, particularly in high-risk industries such as mining, construction, energy, and manufacturing. Its services include occupational medical exams, workplace health surveillance, diagnostic testing, on-site medical units, and emergency care to help companies monitor employee health and comply with safety regulations. Natclar operates clinics and medical units across Peru and uses digital health systems to support preventive healthcare and workforce health management. Price: $20,000 | Size: 1.8TB | Records: 7.6m files && 800k users && 1.7m appointments | Dump date: 2026 |
Gauteng Provincial Government tracker page ↗ | kazufilter this group | · 10d ago | Gauteng Provincial Government Breach ( www.gauteng.gov.za ) Official online portal for the government of Gauteng, a province in South Africa. The website provides residents, businesses, and visitors with access to important government information, services, and updates. It includes details about different government departments, public programs, healthcare, education, housing, and economic development initiatives. Price: $25,000 | Size: 3.8 TB | Records: 3 673 556 Files | Dump date: 2026 |
ConsultorioMovil: Telemedicine and Healthcare System tracker page ↗ | kazufilter this group | · 10d ago | digital healthcare platform designed to help doctors, clinics, and medical professionals manage their daily operations more efficiently. It provides tools for scheduling patient appointments, maintaining electronic medical records, and conducting telemedicine consultations through online video or messaging. The platform also supports clinical documentation, patient communication, and administrative tasks, helping healthcare providers reduce paperwork and improve organization. Overall, ConsultorioMovil aims to simplify medical practice management and improve the way doctors interact with and care for their patients through a single, centralized system. Price: $4 000 | Size: 1.73 TB | Records: 2 000 000+ Files | Dump date: 2026 |
Meducar: Telemedicine and Patient Management System tracker page ↗ | kazufilter this group | · 10d ago | Meducar is a Latin American healthtech platform that provides software for doctors and clinics to manage medical appointments, electronic health records, and patient communication in one system. It helps healthcare professionals organize their daily practice by offering tools such as online scheduling, clinical history management, electronic prescriptions, and telemedicine services. Price: $3 000 | Size: XXX | Records: 3 197 677 users pii | Dump date: 2026 |
Centro Médico Especializado OSI: Healthcare Solutions tracker page ↗ | kazufilter this group | · 10d ago | Centro Médico Especializado OSI is a healthcare provider based in Peru that specializes in physical medicine, rehabilitation, physiotherapy, chiropractic care, and alternative medicine treatments. Founded in 1999 and headquartered in Lima, OSI has grown into one of the country's largest rehabilitation and physiotherapy networks, operating multiple clinics across the Lima metropolitan area. wellness network in Peru, focused on helping patients recover mobility, reduce pain, and improve their quality of life through specialized medical and therapeutic care Price: $1200 | Size: XXX | Records: 159 824 users && 504 413 files | Dump date: 2026 |
Dr Akbar Niazi Teaching Hospital tracker page ↗ | kazufilter this group | · 10d ago | Dr. Akbar Niazi Teaching Hospital (ANTH) is a 500-bed tertiary care teaching hospital located in Islamabad, Pakistan. The hospital provides a wide range of healthcare services, including emergency care, surgery, cardiology, orthopedics, pediatrics, gynecology, oncology, diagnostic laboratory services, and specialized outpatient clinics. As a teaching hospital, ANTH is affiliated with medical education and training programs, supporting the development of future healthcare professionals Price: $1200 | Size: 149 GB | Records: 729 336 Files | Dump date: 2026 |
PawlyClinic: Digital Veterinary Care Platform tracker page ↗ | kazufilter this group | · 10d ago | PawlyClinic is a digital veterinary care platform that connects pet owners with licensed veterinarians through online consultations, appointment booking, and in-clinic referrals. It provides a convenient way for users to access veterinary advice, manage pet health records, and receive treatment without always needing to visit a clinic physically. Price: $150 | Size: XXX | Records: 28 641 users pii | Dump date: 2026 |
Canada Yocale: Appointment Management System tracker page ↗ | kazufilter this group | · 10d ago | Yocale is a cloud-based business management platform that helps appointment-based businesses streamline their daily operations. Founded in Canada, the platform is used by healthcare providers, beauty salons, wellness centers, and other service businesses to manage appointments, client records, payments, and communications in one centralized system. Price: $5 000 | Size: 51.02 GB | Records: 6 055 490 appointments data | Dump date: 2026 |
Brazil Mobilemed: Cloud PACS Platform tracker page ↗ | kazufilter this group | · 10d ago | Mobilemed is a Brazil-based health technology company that provides a cloud-based PACS (Picture Archiving and Communication System) for radiologists, hospitals, and diagnostic imaging centers. Its platform enables healthcare professionals to securely store, access, manage, and share medical images and diagnostic reports from anywhere, supporting teleradiology and improving workflow efficiency. Price: $50 000 | Size: 23.5 TB | Records: 52 243 863 files | Dump date: 2026 |
Instituto Ferrero de Neurología y Sueño tracker page ↗ | kazufilter this group | · 10d ago | Instituto Ferrero de Neurología y Sueño (IFN) is a specialized medical center in Argentina that focuses on the diagnosis and treatment of neurological and sleep disorders. It provides services such as neurology consultations, sleep studies, diagnostic testing, and personalized treatment plans. Using advanced medical technology and a team of specialists, IFN helps patients receive comprehensive care for conditions affecting the brain, nervous system, and sleep health. Price: $1 000 | Size: 636 GB | Records: 474 826 files && 103 315 Users | Dump date: 2026 |
PappyJoe: Healthcare Management System tracker page ↗ | kazufilter this group | · 10d ago | PappyJoe is an India-based healthcare technology company that provides a cloud-based practice management platform for clinics, hospitals, and healthcare professionals. The platform helps manage appointments, electronic medical records (EMR), billing, prescriptions, patient communication, and administrative tasks in one system. Price: $3 000 | Size: 413 GB | Records: 6 873 180 patients pii + 531 673 files | Dump date: 2026 |
Spirit Cultural Exchange - US tracker page ↗ | kazufilter this group | · 10d ago | Spirit Cultural Exchange is a U.S.-based organization that provides international cultural exchange and J-1 visa programs for students, young professionals, teachers, and international participants. Its programs include Summer Work and Travel, internships, professional training, and teaching opportunities in the United States Ransom: $100 000 | Size: 170 GB | Records: 136,817 files | Expires: 2026-09-20 23:59:59 |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.