Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
184
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲3 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims22 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
TERRACOM & MONTCAU tracker page ↗ | majinahanashifilter this group | · 16d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-09-05T08:08:00Z Package: 896 MiB / 6341 files |
TERRA*** & MON**** tracker page ↗ | majinahanashifilter this group | · 19d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-09-05T08:08:00Z Package: 896 MiB / 6341 files |
PCA Group Sdn. Bhd. tracker page ↗ | majinahanashifilter this group | · 23d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-28T22:03:00Z Package: 2.5 GiB / 1844 files |
PCA ***** tracker page ↗ | majinahanashifilter this group | · 26d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-28T22:03:00Z Package: 2.5 GiB / 1844 files |
Grand Ion Delemen Hotel tracker page ↗ | majinahanashifilter this group | · 28d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T16:34:00Z Package: 4.0 GiB / 5045 files |
The Margo Hotel tracker page ↗ | majinahanashifilter this group | · 28d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T20:49:00Z Package: 4.6 GiB / 8080 files |
Ion Delemen Hospitality tracker page ↗ | majinahanashifilter this group | · 28d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T16:34:00Z Package: 4.0 GiB / 5045 files |
CALICHE tracker page ↗ | majinahanashifilter this group | · Aug 11, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-18T03:03:00Z Package: 22.9 GiB / 39200 files |
ETICOD tracker page ↗ | majinahanashifilter this group | · Aug 9, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-16T00:30:00Z Package: 1.6 GiB / 5730 files |
UAB Biotecha tracker page ↗ | majinahanashifilter this group | · Aug 8, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-15T22:12:00Z Package: 21.2 GiB / 20888 files |
ALTAIR tracker page ↗ | majinahanashifilter this group | · Aug 8, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-15T01:01:00Z Package: 23.9 GiB / 84251 files |
Camandona SA tracker page ↗ | majinahanashifilter this group | · Aug 4, 2026 | TARGET: https://www.camandona.ch/ REVENUE: $61.7M EMPLOYEES: 200 Camandona SA is a major Swiss construction and road-building company founded in 1948 and based in the French-speaking canton of Vaud. It specializes in asphalt paving, road construction, civil engineering, building demolition, and the recycling of construction materials. HQ: Rue de Cossonay 30, 1023 Crissier, Switzerland Phone: +41 21 632 89 00 Email: [email protected] Website: https://www.camandona.ch/ Package: 12.1 GiB / 9584 files File manager: http://cc666mzpsjhn3yi6t7hqkwi5thjeh7prxg3mndpceb7xtchsbsmct3ad.onion/dl/47c27aa75b082421627fc9a7491eaabd |
Goccia S.p.A. tracker page ↗ | majinahanashifilter this group | · Aug 3, 2026 | TARGET: https://www.joygioielli.com/ https://www.gocciagioielli.com/ REVENUE: €19.2M EMPLOYEES: ~ Package: 320 MiB / 3557 files |
SCHMITZ & NITTENWILM tracker page ↗ | majinahanashifilter this group | · Aug 3, 2026 | TARGET: schmitz-nittenwilm.de REVENUE: €13,8M EMPLOYEES: ~ Package: 3.2 GiB / 886 files |
CARIBE / SUBRA tracker page ↗ | majinahanashifilter this group | · Jul 11, 2026 | TARGET: kalimancaribe.com & subra.bg. REVENUE: ~ EMPLOYEES: ~ Package: 19.7 GiB / 21311 files |
WONDR DIAMONDS & D GEM MOUNT tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: wondrdiamonds.com & gemmount.com REVENUE: $12m USD EMPLOYEES: 200+ Package: 2.5 GiB / 247 files |
CDA tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: https://centrodiagnosticocda.it/ REVENUE: ~ EMPLOYEES: ~ Package: 73.4 GiB / 135426 files |
GRUPO STARFOODS tracker page ↗ | majinahanashifilter this group | · Jul 6, 2026 | TARGET: starfoods.pt REVENUE: ~ EMPLOYEES: ~ Package: 4.1 GiB / 3420 files |
SON-VIDEO tracker page ↗ | majinahanashifilter this group | · Jul 6, 2026 | TARGET: Son-Video.com REVENUE: $54M EMPLOYEES: ~51-200 employees Package: 2.5 GiB / 10382 files |
KT RESTAURANT tracker page ↗ | majinahanashifilter this group | · Jul 2, 2026 | TARGET: ktr.co.th REVENUE: ~$55M USD EMPLOYEES: ~ Package: 777 MiB / 1853 files |
BONJOUR GROUP tracker page ↗ | majinahanashifilter this group | · Jul 2, 2026 | TARGET: bonjourgroup.net, bonjourretail.com REVENUE: $57.8 Million EMPLOYEES: 501-1,000 employees Package: 3.1 GiB / 5620 files |
PIO PIO tracker page ↗ | majinahanashifilter this group | · Jun 27, 2026 | TARGET: piopio.com.co REVENUE: $5m EMPLOYEES: 33 staff Package: 3.1 GiB / 6306 files |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.