Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲12 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims31 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
DiamondLease tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Perimetral Oriental de Bogotá S.A.S. tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Ozel & Ozel Laws Office tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Tuboaços da Amazônia Ltda. tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Transportes Montejo S.A.S. tracker page ↗ | nightspirefilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Easyoga tracker page ↗ | nightspirefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Truckworx tracker page ↗ | nightspirefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Victory Personal Care, Inc tracker page ↗ | nightspirefilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Vi***** Pe****** C***, Inc tracker page ↗ | nightspirefilter this group | · 29d ago | No details on the leak post beyond the victim name. |
T****w**x tracker page ↗ | nightspirefilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
eas**** tracker page ↗ | nightspirefilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
Tianji Auto Care Service Company tracker page ↗ | nightspirefilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
T***w**x tracker page ↗ | nightspirefilter this group | · Aug 7, 2026 | No details on the leak post beyond the victim name. |
The Mountain tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Kates Nussman Ellis Earle & Landolfi LLP tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Akribis Systems Pte Ltd tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Thai Seng International Co. Ltd tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
MKS Transformator tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
OPTIDEA GmbH tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Furama Bukit Bintang tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
K. Venkatesh, Co tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Wings Argo Private Limited tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
KSL Dirtworks LLC tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Diffusion de Produits Inoxydables tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
TFG Benefits, Inc. tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Auto Royal Company tracker page ↗ | nightspirefilter this group | · Jul 23, 2026 | No details on the leak post beyond the victim name. |
Cedar Crest College tracker page ↗ | nightspirefilter this group | · Jul 14, 2026 | No details on the leak post beyond the victim name. |
Webosphere tracker page ↗ | nightspirefilter this group | · Jul 13, 2026 | No details on the leak post beyond the victim name. |
PCCC Realty LLC tracker page ↗ | nightspirefilter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Grupo Riquelme tracker page ↗ | nightspirefilter this group | · Jun 25, 2026 | No details on the leak post beyond the victim name. |
Artistic Smiles tracker page ↗ | nightspirefilter this group | · Jun 21, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.