Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼6 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims13 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
www.kashkha.com tracker page ↗ | krybitfilter this group | · 3d ago | Kashkha is a multinational modest fashion brand founded three decades ago in Dubai, UAE, specializing in designing, manu... |
www.tiflispalace.ge tracker page ↗ | krybitfilter this group | · 4d ago | Tiflis Palace is a luxurious boutique hotel located in the heart of Tbilisi, Georgia, in the legendary place of the city... |
www.tender.mx tracker page ↗ | krybitfilter this group | · 4d ago | Tender (Carnicería Tender) is a Mexican premium butcher shop chain (carnicería) founded under the original brand Vigar... |
capricornlogistics.com tracker page ↗ | krybitfilter this group | · 4d ago | Capricorn Logistics Pvt. Ltd. is an Indian comprehensive supply chain and logistics company founded in 2001 in Mumbai, M... |
www.ibnsinatrust.com tracker page ↗ | krybitfilter this group | · 4d ago | The Ibn Sina Trust is a pioneering Bangladeshi non-profit welfare trust and major healthcare provider founded on June 30... |
lasultanahotels.com tracker page ↗ | krybitfilter this group | · 4d ago | La Sultana Hotel Group is a Moroccan luxury boutique hotel group created in the year 2000, targeting discerning traveler... |
eracm.fr tracker page ↗ | krybitfilter this group | · 4d ago | ERACM (École Régionale d'Acteurs de Cannes et Marseille) is a French non-profit association and regional drama school ... |
pss.ht tracker page ↗ | krybitfilter this group | · 4d ago | Professional Security Services S.A. (PSS) is a Haitian-owned private security services company established in 1995, head... |
www.metalware.ca tracker page ↗ | krybitfilter this group | · 4d ago | Metalware Corporation Inc. is Canada's leading industrial shelving manufacturer, founded in 1954, headquartered in Montr... |
intherpro.com tracker page ↗ | krybitfilter this group | · 4d ago | Intherpro LLC (International Thermal Insulation & Passive Fire Protection Company) is a UAE-based global leader in engin... |
meridian16.hr tracker page ↗ | krybitfilter this group | · 4d ago | Meridian 16 Business Park d.o.o. is a Croatian eco-industrial business zone developer and operator, established over the... |
www.eac-airports.com tracker page ↗ | krybitfilter this group | · 4d ago | Egyptian Airports Company (EAC) is an Egyptian state-owned public company incorporated in 2001, operating as a subsidiar... |
swadeshicipl.com tracker page ↗ | krybitfilter this group | · 4d ago | Swadeshi Civil Infrastructure Private Limited (SCIPL) is an Indian private limited company incorporated on March 11, 200... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.