Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents24 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
[DISCLOSED] California School Employees Association tracker page ↗ | ransomhousefilter this group | · 4h ago | No details on the leak post beyond the victim name. |
California School Employees Association tracker page ↗ | ransomhousefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
[EVIDENCE]REXT Holdings Co., Ltd. tracker page ↗ | ransomhousefilter this group | · 13d ago | No details on the leak post beyond the victim name. |
REXT Holdings Co., Ltd. tracker page ↗ | ransomhousefilter this group | · 14d ago | No details on the leak post beyond the victim name. |
[DISCLOSED]Alya Construtora tracker page ↗ | ransomhousefilter this group | · 28d ago | No details on the leak post beyond the victim name. |
[DISCLOSED]PCL Holding tracker page ↗ | ransomhousefilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]TECHVENTURES BANK S.A. tracker page ↗ | ransomhousefilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]City of Beacon tracker page ↗ | ransomhousefilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]City of McMinnville OR tracker page ↗ | ransomhousefilter this group | · Aug 10, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]Nichirei tracker page ↗ | ransomhousefilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Alya Construtora tracker page ↗ | ransomhousefilter this group | · Aug 7, 2026 | No details on the leak post beyond the victim name. |
TECHVENTURES BANK S.A. tracker page ↗ | ransomhousefilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
City of Beacon tracker page ↗ | ransomhousefilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
lya Construtora tracker page ↗ | ransomhousefilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
City of McMinnville OR tracker page ↗ | ransomhousefilter this group | · Aug 6, 2026 | No details on the leak post beyond the victim name. |
PCL Holding tracker page ↗ | ransomhousefilter this group | · Aug 3, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]Fidelity Services Group tracker page ↗ | ransomhousefilter this group | · Aug 3, 2026 | No details on the leak post beyond the victim name. |
Nichirei tracker page ↗ | ransomhousefilter this group | · Jul 22, 2026 | No details on the leak post beyond the victim name. |
Megawork tracker page ↗ | ransomhousefilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Fidelity Services Group tracker page ↗ | ransomhousefilter this group | · Jul 15, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]Prince George County tracker page ↗ | ransomhousefilter this group | · Jul 6, 2026 | No details on the leak post beyond the victim name. |
[EVIDENCE]Prince George County tracker page ↗ | ransomhousefilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
Bonacio tracker page ↗ | ransomhousefilter this group | · Jun 29, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]Karl Chevrolet tracker page ↗ | ransomhousefilter this group | · Jun 23, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.