Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims22 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
marlinhvac.com tracker page ↗ | safepayfilter this group | · 49m ago | Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … |
neumerkel-gmbh.de tracker page ↗ | safepayfilter this group | · 49m ago | The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … |
triniticaring.org tracker page ↗ | safepayfilter this group | · 49m ago | The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … |
laconcepcion.com.mx tracker page ↗ | safepayfilter this group | · 49m ago | The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … |
meterex.com tracker page ↗ | safepayfilter this group | · 49m ago | The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … |
stoecklin-kuechen.ch tracker page ↗ | safepayfilter this group | · 49m ago | The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … |
ryomo.co.jp tracker page ↗ | safepayfilter this group | · 49m ago | Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … |
ara-lyss.ch tracker page ↗ | safepayfilter this group | · 49m ago | Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … |
gob.pe tracker page ↗ | safepayfilter this group | · 49m ago | It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … |
compunnel.com tracker page ↗ | safepayfilter this group | · 3d ago | The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … |
gayafores.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is headquartered in Onda, Castellón, one of Europe's most important ceramic manufacturing regions. Established in 1949, Gayafores has … |
cenmar-manila.com tracker page ↗ | safepayfilter this group | · 6d ago | The company was registered with the Philippine Securities and Exchange Commission in 1997 and received authorization to operate as a … |
gsngestion.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is based in Villaviciosa de Odón, Madrid, and operates through the GSN Gestión brand. Its website states that … |
hbpro.pt tracker page ↗ | safepayfilter this group | · 6d ago | Established in 1994, the company has more than three decades of experience providing technology products, infrastructure, consulting, maintenance, and technical … |
recoverycafe.org tracker page ↗ | safepayfilter this group | · 7d ago | The organization was founded in 2003 and opened its first physical café in Seattle in 2004. Its approach is based … |
mcnishsteel.com tracker page ↗ | safepayfilter this group | · 7d ago | The company is headquartered in Edmonton, Alberta, and was founded in 1978 by William and Wallace McNish. It has developed … |
palmettoeyeinstitute.com tracker page ↗ | safepayfilter this group | · 7d ago | The practice was founded by Dr. Prat Itharat, a board-certified ophthalmologist who specializes in cataract surgery and comprehensive eye care. … |
reichenau.at tracker page ↗ | safepayfilter this group | · 7d ago | The official website, reichenau.at, serves as the municipality's central digital information and service platform for residents, businesses, and visitors. The … |
cannonpuntana.com tracker page ↗ | safepayfilter this group | · 7d ago | The company operated in Argentina and was historically connected with the manufacture and distribution of fragrances, toiletries, and personal-care products. … |
assiprime.it tracker page ↗ | safepayfilter this group | · 7d ago | The company provides insurance brokerage, risk-management, financial consulting, and related assistance services to private individuals, businesses, professionals, artisans, and commercial … |
industry.airliquide.kr tracker page ↗ | safepayfilter this group | · 20d ago | Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, … |
lagegepesca.it tracker page ↗ | safepayfilter this group | · 22d ago | Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small … |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.