Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼6 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims24 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Foss Inc. tracker page ↗ | pearfilter this group | · 5d ago | Leading provider of installation, maintenance services to the energy industry |
Kovo Healthtech Corp tracker page ↗ | pearfilter this group | · 13d ago | Versatile technology company leading the Charge in AI process automation initiatives to drive Impact and innovation across diverse industries |
EdgeChem Jamaica Limited tracker page ↗ | pearfilter this group | · 13d ago | Manufacture Automotive, Industrial, Decorative and Furniture Coatings, and distribute associated products |
NEXT LEVEL MEDICAL, LLC tracker page ↗ | pearfilter this group | · 21d ago | Affordable urgent care across Texas |
Island Networks tracker page ↗ | pearfilter this group | · 26d ago | Provider for Business-class Internet, Cybersecurity & Home Wi-Fi |
Mogren, Glessner & Ahrens, P.S. tracker page ↗ | pearfilter this group | · 26d ago | Services in family law |
Clifton Architectural Glass & Metal tracker page ↗ | pearfilter this group | · 27d ago | A company that installs double-pane windows |
First Commerce LLC tracker page ↗ | pearfilter this group | · 27d ago | Privately held real estate investment and development company |
Medical Arts Chemists and Surgicals tracker page ↗ | pearfilter this group | · 28d ago | Prescriptions and Home Medical Equipment |
Club One Casino tracker page ↗ | pearfilter this group | · 28d ago | A Place to Play Cards in Central California |
Practi-Cal tracker page ↗ | pearfilter this group | · 28d ago | Comprehensive platform to manage Medi-Cal billing, LEA BOP, and CRCS submissions efficiently |
Austin Plastic Surgery Institute tracker page ↗ | pearfilter this group | · 28d ago | A center staffed by highly skilled plastic surgeons |
Sonitor Technologies tracker page ↗ | pearfilter this group | · Jul 30, 2026 | Sonitor’s platform and technologies deliver the accurate and reliable data required to optimize care delivery |
Metropolitan Construction Systems tracker page ↗ | pearfilter this group | · Jul 24, 2026 | Leading commercial roofing company based in New York City |
Carient Heart & Vascular tracker page ↗ | pearfilter this group | · Jul 15, 2026 | Expert resource for heart and vascular care in Northern Virginia |
South Plains Rural Health Services, Inc. tracker page ↗ | pearfilter this group | · Jul 15, 2026 | Comprehensive and family care in West Texas |
Faro Products Inc. tracker page ↗ | pearfilter this group | · Jul 13, 2026 | Leading manufacturer in the promotional products and souvenir |
Tostrud & Temp, S.C. tracker page ↗ | pearfilter this group | · Jul 8, 2026 | Full service CPA firm serving La Crosse |
AC Beverage, Inc. tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Provider in the draft beer service industry, specializing in the installation of high-quality systems and beer line |
CNW Electronics Pte Ltd tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Providing complete wire harness solutions, from design to manufacturing |
Spector and Lenz, PC tracker page ↗ | pearfilter this group | · Jun 30, 2026 | Firm provides legal representation to clients facing disability, injury, or serious illness |
ORA Group Information tracker page ↗ | pearfilter this group | · Jun 30, 2026 | Specializing in retail and the point-of-sale experience |
Sociedad Latina tracker page ↗ | pearfilter this group | · Jun 30, 2026 | Support in education, civic engagement, workforce development, and arts and culture, specifically tailored for multilingual learners |
Optimum First Mortgage tracker page ↗ | pearfilter this group | · Jun 19, 2026 | Providing fast and reliable mortgage solutions, including home purchases and refinancing options |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.