Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
182
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 24 | ▲10 | 118 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▼1 | 21 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims12 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
lindner-group.com tracker page ↗ | m3rxfilter this group | · 19d ago | Lindner Group is Europe's leading manufacturer and service provider specializing in interior fit-out, building envelope, and insulation technology. With over 60 years of experience, the company offers tailored project solutions and products, ranging from ceilings, floors, and partitions to clean rooms and HVAC systems. Their diverse client base includes industries requiring renovation, refurbishments, and turnkey projects, with a commitment to digitalization and sustainability. Operating in more than 40 countries with approximately 8,000 employees, Lindner Group places emphasis on innovation, quality, and customer-centric service Stolen: 4.6TB 2,638,995 Files |
tecnoabi.com tracker page ↗ | m3rxfilter this group | · Aug 14, 2026 | Tecnologías de Código Abierto S.L., trading as Tecnoabi, is a Málaga, Spain-based B2B software development firm registered in 2008 that specializes in Java, .NET, and proprietary solutions such as VirtRoom and CMMS software. Located in Málaga TechPark, the company maintains extensive expertise in after-sales management systems and is an official Google Play developer. For more details, visit the official website at tecnoabi.com. Stolen: 300 GB 63,434 Files |
hydraulic-components.net tracker page ↗ | m3rxfilter this group | · Jul 26, 2026 | +44 1142764430 , VHS Hydraulics is a prominent supplier of hydraulic components and power packs, featuring products from renowned brands like Rexroth, Walvoil, and Casappa. With over 25 years of experience, they specialize in engineering bespoke power packs for demanding applications. Based in Sheffield, they offer extensive stock and provide same-day and next-day delivery services across the UK. Their team is equipped to assist clients with both individual components and complete hydraulic system solutions tailored to specific requirements. Stolen: 215 GB 226,961 Files |
createinfor.pt tracker page ↗ | m3rxfilter this group | · Jul 26, 2026 | +351 262187684 , CreateInfor is a company that operates in the Repair Services industry. It employs 10to19 people and has 500Kto1M of revenue. The company is headquartered in Caldas da Rainha, Leiria, Portugal. Stolen: -- |
servicebypremier.com tracker page ↗ | m3rxfilter this group | · Jul 26, 2026 | +1(954) 646-0016 , This local HVAC and Refrigeration company, established in 2007, provides services across South Florida, from Florida City to Port St. Lucie. They specialize in commercial HVAC and refrigeration repairs, including maintenance for A/C and refrigeration equipment. The company prides itself on delivering honest service at reasonable prices, ensuring complete customer satisfaction. Their commitment to integrity and efficiency makes them a trusted choice for businesses in the region. Stolen: -- |
ausproof.com.au tracker page ↗ | m3rxfilter this group | · Jul 24, 2026 | +61 749784000 , AusProof is a leader in the design and manufacture of low and high voltage electrical cable couplers specifically for the mining and tunneling industries. Established in 1974, the company is committed to innovation and quality in its product offerings. AusProof serves clients globally, providing reliable solutions for electrical connectivity in challenging environments. Their extensive experience and dedication to research and development ensure that they meet the evolving needs of their customers. Stolen: 460 GB 373,495 Files |
ubfreight.com tracker page ↗ | m3rxfilter this group | · Jul 22, 2026 | UB Freight is a leading provider of worldwide freight services, specializing in air and sea freight, customs clearance, and warehousing solutions. They cater to a diverse clientele, including large companies with complex shipping needs and individuals looking to send personal items overseas. With IATA authorization and a network covering over 140 countries, UB Freight ensures competitive pricing and dependable service for all shipments. Their in-house customs clearance team and dedicated staff facilitate efficient handling of various cargo types, including dangerous goods and oversized items. Stolen: -- |
suppcentersa.com tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +506 40003397. SuppCenter Global Services officially positions itself as one of the leading Xcitium solution partners and providers in the Latin America region. Xcitium is the new name of COMODO’s enterprise business. Their key cybersecurity specialization is based on a threat prevention architecture that uses Xcitium Zero Trust and ZeroDwell technologies. Official partnership: SuppCenter Global acts as a managed security service provider, or MSSP. They implement, configure, and support Xcitium/Comodo security solutions for large businesses, retail companies, and the public sector. Stolen: -- |
arambol.co.uk tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +44 2079276370 , Arambol LLP is a dynamic partnership of chartered surveyors and property consultants, recognized for their commitment to quality and professionalism in property services. They cater to a diverse clientele, including large property organizations, retailers, local authorities, and small residential developers. Their service offerings encompass property consultancy, project management, cost consultancy, building surveying, and construction management. Arambol operates across various sectors such as healthcare, industrial, commercial, public sector, education, and hospitality. Stolen: 922 GB 584,228 Files |
eclective.ie tracker page ↗ | m3rxfilter this group | · Jul 12, 2026 | Ireland, 41a Pleasants Saint Kevins St, D08 KR99 ,Eclective is Ireland's largest hospitality group, renowned for creating dynamic and diverse hospitality and lifestyle brands. They offer a variety of venues suitable for different occasions, including intimate dining, social gatherings, and family-friendly environments. Their commitment to exceptional experiences highlights their understanding of what makes an outing enjoyable while fostering community connections. Eclective also provides tailored event spaces with modern amenities for corporate and private events. Stolen: 857 GB 1,683,762 Files |
foreconinc.com tracker page ↗ | m3rxfilter this group | · Jul 12, 2026 | +1 (716) 664-5602 , FORECON Inc. specializes in custom-crafted forest management, due diligence, appraisal, analytics, and rural brokerage services across New York, Pennsylvania, and West Virginia. Established in 1954, the company focuses on balancing the needs of people and the environment through sustainable forestry practices. Their services include technical, advisory, and valuation support for forestry projects, land management, and conservation solutions. Additionally, FORECON offers a HuntLease program that connects landowners with hunters to promote wildlife management and forest health. Stolen: 860 Gb 437,048 Files |
wrtworld.com tracker page ↗ | m3rxfilter this group | · Jul 12, 2026 | +1 (305) 884-3700 , WRT World Enterprises is a leading provider of purchasing and logistics services tailored for major retailers in Latin America. The company specializes in streamlining supply chain management through services such as shipping, storage, purchasing, and vendor management. With a focus on innovative solutions, WRT helps its clients remain competitive by offering order purchasing technology and comprehensive logistics services. Their extensive network and established relationships with suppliers enable them to negotiate favorable prices, ensuring their clients have access to the best products in the market. Stolen: 377 GB 267,891 Files |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.