Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
204
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 114 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 45 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 114 | 114 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents4 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Yue Ki Industrial tracker page ↗ | morpheusfilter this group | · Jul 30, 2026 | Website: yueki.com.tw Revenue: $21 Million Yue Ki Industrial is a manufacturing company that creates high-quality industrial products for businesses. They work with metal, plastic, and other materials to build custom parts and components. Data: Human Resources (HR) & Personal Identifiable Information (PII) NDA, Client Penalties & Quality Defect Records Intellectual Property (IP) & Engineering CAD Data Supply Chain, Procurement & Manufacturing Secrets IT Infrastructure & Database Backups The volume of retrieved data is 177 GB |
Kyowa Singapore Pte Ltd tracker page ↗ | morpheusfilter this group | · Jul 22, 2026 | Website: kyowasingapore.com Revenue: $15 Million Founded in 1979 and headquartered at Benoi Road, Singapore, they primarily supply global consumer electronics, grooming, and automotive industries. Data: HR/Employee Data Client/Engineering Data Financial/Procurement Data Quality/Compliance Data Manufacturing/Process Data Administrative/Operational Data Immigration/Work Pass Data Tax/IRAS Compliance Data The volume of retrieved data is 143 GB |
Hansa Research Group Pvt. Ltd tracker page ↗ | morpheusfilter this group | · Jul 6, 2026 | Website: hansaresearch.com Revenue: $22 Million Hansa Research is a global, full-service market research and consumer insights agency. They help companies make data-driven decisions by providing market intelligence, brand strategy, customer experience (CX) analytics, and media effectiveness.Headquartered in Mumbai, India, they operate globally with offices in the USA, Singapore, the UAE, and Bangladesh. Data: Hansa Cheetah Database PAN of employees and companies IDs and Aadhaar Client Lists + Working Files and NDAs Payment and Financial Terms Company Strategy and IP |
Delegal Poindexter & Underkofler, P.A. tracker page ↗ | morpheusfilter this group | · Jun 25, 2026 | Website: protectingcareers.com Revenue: $5 Million Delegal Poindexter & Underkofler provides highly specialized legal services to employees with employment law concerns.They represent professionals, executives, and public employees in labor, employment law, and administrative issues. Data: Plaintiff Information (containing personal identifiers, employment history, and contact details to establish the client) Active Case Files (encompassing pleadings, motions, and evidence for employment lawsuits like wrongful termination) Confidentially Marked Emails (consisting of privileged attorney-client communications and sensitive strategy protected from disclosure) and other Employee PC Data |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.