Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
232
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
storm
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 32 | ▲9 | 157 | 413 | 413 | active | no public figure | |
| 2 | qilin | 18 | ▲2 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | direwolf | 5 | ▼6 | 45 | 62 | 62 | active | no public figure | |
| 5 | storm | 44 | ▲44 | 44 | 56 | 56 | active | no public figure | |
| 6 | akira | 7 | ▼1 | 38 | 82 | 82 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 3 | ▼6 | 36 | 106 | 106 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼1 | 27 | 86 | 86 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | shinyhunters | 1 | ▼2 | 24 | 34 | 34 | active | no public figure | |
| 11 | safepay | 14 | ▲8 | 22 | 72 | 72 | active | no public figure | |
| 12 | leakeddata | 0 | ▼7 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | audit team | 10 | ▲6 | 18 | 19 | 19 | active | no public figure | |
| 16 | panzer | 6 | ▲3 | 17 | 24 | 24 | active | no public figure | |
| 17 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 18 | emperador | 6 | ▲5 | 16 | 19 | 19 | active | no public figure | |
| 19 | play | 4 | ▲4 | 14 | 44 | 44 | active | no public figure | |
| 20 | vexy | 4 | ▼6 | 14 | 14 | 14 | active | no public figure | |
| 21 | black nevas | 13 | ▲13 | 13 | 13 | 13 | active | no public figure | |
| 22 | chaos | 5 | ▲4 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 27 | 27 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 15 | 15 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents72 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
marlinhvac.com tracker page ↗ | safepayfilter this group | · 43m ago | Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … |
neumerkel-gmbh.de tracker page ↗ | safepayfilter this group | · 43m ago | The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … |
triniticaring.org tracker page ↗ | safepayfilter this group | · 43m ago | The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … |
laconcepcion.com.mx tracker page ↗ | safepayfilter this group | · 43m ago | The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … |
meterex.com tracker page ↗ | safepayfilter this group | · 44m ago | The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … |
stoecklin-kuechen.ch tracker page ↗ | safepayfilter this group | · 44m ago | The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … |
ryomo.co.jp tracker page ↗ | safepayfilter this group | · 44m ago | Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … |
ara-lyss.ch tracker page ↗ | safepayfilter this group | · 44m ago | Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … |
gob.pe tracker page ↗ | safepayfilter this group | · 44m ago | It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … |
compunnel.com tracker page ↗ | safepayfilter this group | · 3d ago | The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … |
gayafores.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is headquartered in Onda, Castellón, one of Europe's most important ceramic manufacturing regions. Established in 1949, Gayafores has … |
cenmar-manila.com tracker page ↗ | safepayfilter this group | · 6d ago | The company was registered with the Philippine Securities and Exchange Commission in 1997 and received authorization to operate as a … |
gsngestion.es tracker page ↗ | safepayfilter this group | · 6d ago | The company is based in Villaviciosa de Odón, Madrid, and operates through the GSN Gestión brand. Its website states that … |
hbpro.pt tracker page ↗ | safepayfilter this group | · 6d ago | Established in 1994, the company has more than three decades of experience providing technology products, infrastructure, consulting, maintenance, and technical … |
recoverycafe.org tracker page ↗ | safepayfilter this group | · 7d ago | The organization was founded in 2003 and opened its first physical café in Seattle in 2004. Its approach is based … |
mcnishsteel.com tracker page ↗ | safepayfilter this group | · 7d ago | The company is headquartered in Edmonton, Alberta, and was founded in 1978 by William and Wallace McNish. It has developed … |
palmettoeyeinstitute.com tracker page ↗ | safepayfilter this group | · 7d ago | The practice was founded by Dr. Prat Itharat, a board-certified ophthalmologist who specializes in cataract surgery and comprehensive eye care. … |
reichenau.at tracker page ↗ | safepayfilter this group | · 7d ago | The official website, reichenau.at, serves as the municipality's central digital information and service platform for residents, businesses, and visitors. The … |
cannonpuntana.com tracker page ↗ | safepayfilter this group | · 7d ago | The company operated in Argentina and was historically connected with the manufacture and distribution of fragrances, toiletries, and personal-care products. … |
assiprime.it tracker page ↗ | safepayfilter this group | · 7d ago | The company provides insurance brokerage, risk-management, financial consulting, and related assistance services to private individuals, businesses, professionals, artisans, and commercial … |
industry.airliquide.kr tracker page ↗ | safepayfilter this group | · 20d ago | Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, … |
lagegepesca.it tracker page ↗ | safepayfilter this group | · 22d ago | Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small … |
granjarinya.com tracker page ↗ | safepayfilter this group | · Aug 14, 2026 | Headquartered in Albal, Valencia, the family-owned company traces its origins to three generations of livestock farming. What began as a … |
azn.co.jp tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1991, the company specializes in comprehensive asset management, inheritance planning, business succession consulting, real estate advisory services, and … |
southshorerecycling.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | The company specializes in metal recycling, concrete and asphalt recycling, aggregate production, and construction waste processing for commercial, industrial, and … |
cpu-ag.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1981 and headquartered in Friedberg, Bavaria, the company has more than four decades of experience developing specialized software … |
multiaqua.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1999, the company specializes in the design, engineering, and production of air-cooled water chillers, heat pump chillers, hydronic … |
pradotuylaw.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | The firm focuses on practice areas including personal injury, wrongful death, workplace harassment, business litigation, civil settlements, and environmental litigation. … |
naskdoorinc.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in West Chester, Pennsylvania, the company has served customers throughout southeastern Pennsylvania and northern Delaware for several decades. Although … |
new-point.it tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Signa, Florence, Italy, the company was founded in 2006 and has grown into one of Italy's established suppliers … |
simonrack.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Alfamén, Zaragoza, Spain, the company has been manufacturing metal shelving since 1964 and has become one of Europe's … |
hanan-hov.co.il tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Neve Yamin, Israel, the company provides comprehensive logistics support for construction, infrastructure, industrial, and commercial projects throughout the … |
haugbuersten.de tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Although the company in its current industrial form was founded in 1962, its family-owned brush-making tradition dates back to 1836, … |
landesmuseum.de tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Established in 1919, the museum preserves and presents more than 50,000 years of human cultural history, ranging from prehistoric artifacts … |
hst.eu tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Headquartered in Kressbronn am Bodensee, Germany, the company traces its mechanical engineering heritage back to 1950, while the original tea … |
braywoodschool.co.uk tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Founded in 1858, the school has more than 165 years of educational history and serves children from early years through … |
weier.org tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | The company specializes in representing manufacturers of plumbing, heating, water treatment, pumping, drainage, and building services equipment throughout western Germany. … |
bnpdist.com tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Headquartered in New York City, the company has been operating since 1979 and supplies restaurants, hotels, retailers, and wine merchants … |
zinorm.de tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … |
moebelmayer.de tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … |
paritaet-nrw.org tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Headquartered in Wuppertal, the organization represents approximately 3,100 legally independent member organizations operating more than 7,000 social institutions and services … |
upland.k12.ca.us tracker page ↗ | safepayfilter this group | · Jul 24, 2026 | The district provides comprehensive education from kindergarten through twelfth grade and operates 14 schools, including elementary, junior high, and high … |
gvsurgicalarts.com tracker page ↗ | safepayfilter this group | · Jul 24, 2026 | Founded in 2004 by Dr. Brian R. Chisdak, the practice has grown into one of Montana's leading surgical centers and … |
wdk.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Founded in 1950 and headquartered in Frankfurt am Main, the organization serves as the central voice of German manufacturers of … |
jaecklin-industrial.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Founded in 1935 by Julius Jäcklin, the company has developed from a regional machine repair workshop into a globally recognized … |
lbb-treuhand.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | The company specializes in tax consulting, auditing, accounting, payroll administration, financial reporting, and business advisory services for private individuals, self-employed … |
timetex.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | The company traces its origins to 1991, when the TimeTEX brand was acquired and expanded into a comprehensive supplier of … |
stroebel-gruppe.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Headquartered in Langenzenn, Bavaria, the company was founded in 1978 by Gerlinde and Gerhard Ströbel and has grown from a … |
industriesjaro.com tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Over several decades, Jaro has evolved from manufacturing telephone booths into a supplier of advanced outdoor enclosures, interactive kiosks, bus … |
cenesco.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Founded in 1998, the company provides comprehensive information technology solutions for small and medium-sized enterprises (SMEs), helping organizations modernize their … |
acsmallmaxwell.com.au tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Founded in 1916 by Ambrose Cecil Small, the firm has provided professional accounting and financial services to businesses and individuals … |
mende-grundbesitz.de tracker page ↗ | safepayfilter this group | · Jul 20, 2026 | Founded in 1994, the company specializes in the professional administration of residential, commercial, and mixed-use real estate throughout the Berlin … |
shuttlemeadowcc.com tracker page ↗ | safepayfilter this group | · Jul 13, 2026 | Founded in 1917, the club is one of the oldest and most prestigious private golf clubs in New England. It … |
hahn-airport.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Originally developed as a United States military air base, the facility began civilian operations in 1993 and has since become … |
matrixwebagency.com tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | The company specializes in providing integrated digital solutions that help businesses improve their online visibility, customer engagement, and revenue growth. … |
bmiprojects.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Originally operating under the name Bez Marine Interiors GmbH, the company built on decades of experience in the maritime industry … |
caritas-koblenz.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Headquartered in Koblenz, the association was founded in 1918 and has provided charitable and community-based services for more than a … |
knobel-bau.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Founded in 1947, the company has grown from a small sand and gravel business established after the Second World War … |
rtngmbh.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Founded in 2015, the company specializes in the construction, installation, maintenance, and rehabilitation of underground utility networks and civil engineering … |
stedwardscatholicfirstschool.co.uk tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | The school provides education for children aged 5 to 9 years and operates as a Voluntary Aided School under the … |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.