Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims14 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
marlinhvac.com tracker page ↗ | safepayfilter this group | · 53m ago | Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … |
neumerkel-gmbh.de tracker page ↗ | safepayfilter this group | · 53m ago | The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … |
triniticaring.org tracker page ↗ | safepayfilter this group | · 53m ago | The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … |
laconcepcion.com.mx tracker page ↗ | safepayfilter this group | · 53m ago | The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … |
meterex.com tracker page ↗ | safepayfilter this group | · 53m ago | The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … |
stoecklin-kuechen.ch tracker page ↗ | safepayfilter this group | · 53m ago | The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … |
ryomo.co.jp tracker page ↗ | safepayfilter this group | · 53m ago | Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … |
ara-lyss.ch tracker page ↗ | safepayfilter this group | · 53m ago | Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … |
gob.pe tracker page ↗ | safepayfilter this group | · 53m ago | It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … |
compunnel.com tracker page ↗ | safepayfilter this group | · 3d ago | The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … |
gayafores.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is headquartered in Onda, Castellón, one of Europe's most important ceramic manufacturing regions. Established in 1949, Gayafores has … |
cenmar-manila.com tracker page ↗ | safepayfilter this group | · 6d ago | The company was registered with the Philippine Securities and Exchange Commission in 1997 and received authorization to operate as a … |
gsngestion.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is based in Villaviciosa de Odón, Madrid, and operates through the GSN Gestión brand. Its website states that … |
hbpro.pt tracker page ↗ | safepayfilter this group | · 6d ago | Established in 1994, the company has more than three decades of experience providing technology products, infrastructure, consulting, maintenance, and technical … |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.