Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims27 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
hygear.com tracker page ↗ | lockbit5filter this group | · 1h ago | yGear specializes in providing reliable and affordable on-site and on-demand hydrogen and industrial... |
tpi.tw tracker page ↗ | lockbit5filter this group | · 2d ago | Managing a company is a constant process of managing change, solving problems and facing up to chall... |
comune.robeccosulnaviglio.mi.it tracker page ↗ | lockbit5filter this group | · 2d ago | Comune di Robecco sul Naviglio is a municipality in the Metropolitan City of Milan |
httoy.fi tracker page ↗ | lockbit5filter this group | · 2d ago | Tilitoimisto HTT Oy Tilitoimisto HTT Oy on Raumassa toimiva kirjanpitäjä, joka tarjoaa taloushallin... |
alphaomega-eng.com tracker page ↗ | lockbit5filter this group | · 6d ago | In 1993, Alpha Omega was established as a small engineering firm in Nazareth, Israel, by Imad Younis... |
amorsaude.com.br tracker page ↗ | lockbit5filter this group | · 7d ago | AmorSaúde is a rapidly growing network of popular clinics in Brazil that offers medical, dental, and... |
fdcputman.nl tracker page ↗ | lockbit5filter this group | · 8d ago | FDC Putman is a financial specialist offering tailored advice on mortgages, insurance, and various f... |
contreras.com.ar tracker page ↗ | lockbit5filter this group | · 8d ago | Founded in 1947 by the Contreras brothers, the company has continuously evolved and modernized, focu... |
vsbattorneys.co.za tracker page ↗ | lockbit5filter this group | · 9d ago | VSB Attorneys Inc is a well-established law firm in South Africa, specializing in corporate and comm... |
kalahealth.eu tracker page ↗ | lockbit5filter this group | · 12d ago | KALA Health is an international manufacturing and distribution company of nutraceutical health produ... |
huisartsencentrumkleiniterson.nl tracker page ↗ | lockbit5filter this group | · 12d ago | Huisartsencentrum Klein Iterson is a Healthcare Services provider operating in the primary medical c... |
pscindustries.com tracker page ↗ | lockbit5filter this group | · 12d ago | For over 60 years, PSC Industries has been the number 1 supplier of nsulation, gasketing, seals, adh... |
svfcu.org tracker page ↗ | lockbit5filter this group | · 16d ago | Susquehanna Valley Federal Credit Union is a member-owned financial institution that offers a range... |
hoaattorneys.com tracker page ↗ | lockbit5filter this group | · 16d ago | For more than 40 years, Beaumont Tashjian has provided common interest developments with the legal e... |
bartelsbv.nl tracker page ↗ | lockbit5filter this group | · 16d ago | Bartels BV is reeds 40 jaar een toonaangevend bedrijf op het gebied van metalen gevels, daken en lic... |
vkj.nl tracker page ↗ | lockbit5filter this group | · 16d ago | Van Kessel & Janssen begeleidt huisvestingsprojecten met deskundig advies en projectmanagement. Van... |
allsteelproducts.nl tracker page ↗ | lockbit5filter this group | · 16d ago | All Steel Products is a wholesale supplier specializing in hydraulic products, offering a wide range... |
bkc.org tracker page ↗ | lockbit5filter this group | · 16d ago | bkc.org and bethelclassical.org Mission Statement Bethel Classical Academy seeks to guide studen... |
apatpa.com tracker page ↗ | lockbit5filter this group | · 19d ago | American Plan Administrators offers smart self-funded healthcare solutions designed to maximize savi... |
tnmed.org tracker page ↗ | lockbit5filter this group | · 20d ago | The Tennessee Medical Association is a nonprofit organization that advocates for physicians in Tenne... |
fpmanagement.nl tracker page ↗ | lockbit5filter this group | · 20d ago | FP Management BV is a licensed trust office based in Rotterdam, Netherlands, offering a range of ser... |
takt.be tracker page ↗ | lockbit5filter this group | · 20d ago | De notaris: de onpartijdige en onafhankelijke raadgever bij uitstek Sinds jaar en dag staat een e... |
dece.cz tracker page ↗ | lockbit5filter this group | · 21d ago | DeCe COMPUTERS s.r.o. specializes in comprehensive computer and office management solutions, offerin... |
theheartcenterofmemphis.com tracker page ↗ | lockbit5filter this group | · 21d ago | The Heart Center of Memphis is a leading cardiology practice in the Mid-South, specializing in compr... |
adt.com tracker page ↗ | lockbit5filter this group | · 24d ago | ADT is a security company that offers security systems, cameras, alarms ad home automation services.... |
icnavais.com tracker page ↗ | lockbit5filter this group | · 25d ago | The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special... |
usbank.com tracker page ↗ | lockbit5filter this group | · 28d ago | U.S. Bank is a multinational financial institution that provides banking, lending, payment, and inve... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.