Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
182
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 22 | ▲7 | 120 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 7 | ▲4 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 26 | 52 | 52 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 32 | 32 | active | no public figure | |
| 11 | audit team | 12 | ▲4 | 24 | 25 | 25 | active | no public figure | |
| 12 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 13 | leakeddata | 0 | ▼6 | 20 | 38 | 38 | active | no public figure | |
| 14 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 15 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 16 | emperador | 4 | = | 17 | 20 | 20 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | play | 2 | = | 14 | 44 | 44 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | vexy | 3 | ▼8 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 0 | ▼13 | 13 | 13 | 13 | active | no public figure | |
| 22 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 23 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 24 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents44 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Sys-kool tracker page ↗ | playfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
Grunthal Welding & Supplies tracker page ↗ | playfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
Red Star Oil tracker page ↗ | playfilter this group | · 7d ago | No details on the leak post beyond the victim name. |
GT Distributors tracker page ↗ | playfilter this group | · 7d ago | No details on the leak post beyond the victim name. |
MEQ tracker page ↗ | playfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Figgins Family Wine Estates tracker page ↗ | playfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
KRC Machine Tool Solutions tracker page ↗ | playfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Meteor Group tracker page ↗ | playfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Be Media tracker page ↗ | playfilter this group | · 27d ago | No details on the leak post beyond the victim name. |
Latoplast tracker page ↗ | playfilter this group | · 27d ago | No details on the leak post beyond the victim name. |
Coltrane Systems tracker page ↗ | playfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Bridgeport Capital Services tracker page ↗ | playfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Sam Pack Auto Group tracker page ↗ | playfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Woodhaven Association tracker page ↗ | playfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
MIE Solutions tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Rilpa Enterprises tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Marconi Industrial Services tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Signature Services tracker page ↗ | playfilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
GCATS Investments tracker page ↗ | playfilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
Platinum Group tracker page ↗ | playfilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
First Tek tracker page ↗ | playfilter this group | · Aug 5, 2026 | No details on the leak post beyond the victim name. |
Preferred Financial Group tracker page ↗ | playfilter this group | · Aug 5, 2026 | No details on the leak post beyond the victim name. |
The Butcher Brothers tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Sigma Plastics Group tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Cambridge Management tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Record Go Alquiler tracker page ↗ | playfilter this group | · Jul 23, 2026 | No details on the leak post beyond the victim name. |
Restaurant Depot tracker page ↗ | playfilter this group | · Jul 23, 2026 | No details on the leak post beyond the victim name. |
The DeBruler tracker page ↗ | playfilter this group | · Jul 23, 2026 | No details on the leak post beyond the victim name. |
Tax MT tracker page ↗ | playfilter this group | · Jul 22, 2026 | No details on the leak post beyond the victim name. |
Kreysler & Associates tracker page ↗ | playfilter this group | · Jul 22, 2026 | No details on the leak post beyond the victim name. |
Boston Electric and Telephone tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Wring Group tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
AG Scholtes tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Andorra Life tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Svensk Direktreklam tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Preneed Funeral Programs tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Kevin Bao Lenguyen tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
United Infrastructure tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Locati Architects tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Silvestri & Associates Insurance tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Western Construction tracker page ↗ | playfilter this group | · Jun 30, 2026 | No details on the leak post beyond the victim name. |
J&J Gaming tracker page ↗ | playfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
Kuhnline tracker page ↗ | playfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
Benchmark Industrial Supply tracker page ↗ | playfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.