Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
182
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 155 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | akira | 9 | = | 44 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 5 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 9 | ▲5 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 2 | ▼1 | 15 | 32 | 32 | active | no public figure | |
| 18 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents6 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
D-MAX Engineering, Inc tracker page ↗ | space bearsfilter this group | · 12d ago | D‑MAX Engineering, Inc. is a San Diego-based environmental consulting firm specializing in storm water services, particularly for governmental agencies. Our multidisciplinary team includes environmental scientists, engineers, chemists, and biologists. Our team is experienced with the National Pollutant Discharge Elimination System (NPDES) permit requirements in Southern California.Since 1996, when the company was founded, we have completed numerous storm water projects for 18 municipalities in San Diego, Orange, Imperial, and Riverside Counties. We have developed a reputation for practical solutions, cost-effectiveness, responsiveness, and flexibility. D-MAX is recognized across the region for our expertise in jurisdictional storm water program development and reporting, water quality monitoring, Industrial General Permit compliance assistance, development and construction services, and inspections of businesses, municipal facilities, construction sites, and treatment control BMPs.Our experience has provided us with a comprehensive understanding of complex, countywide water quality issues and the ability to effectively address them. D-MAX adapts to our clients’ needs and provides a level of quality service that sets us apart. Our diverse team of professionals, central location, and familiarity with the region allows us to provide clients with a wide variety of services at affordable rates. We are a state-certified small business enterprise (SBE).-Personal information of employees and clients -Financial documents-Сommunications drawings https://www.dmaxinc.com/ |
Sports Endeavors tracker page ↗ | space bearsfilter this group | · 12d ago | Sports Endeavors is a North Carolina company founded in 1984 by brothers Mike and Brendan Moylan. It owns Soccer.com, WorldSoccerShop, and 431 Sports, selling uniforms, gear, and apparel for soccer, baseball, softball, and volleyball to teams, players, and fans. The company is known for a large selection from brands such as Nike, adidas, and Puma, plus custom team uniforms. In April 2026 it was acquired by Varsity Brands / BSN SPORTS. https://www.sportsendeavors.com/ |
Studio Oculistico Ciraci tracker page ↗ | space bearsfilter this group | · 13d ago | Studio Oculistico Ciraci - ophthalmology clinic based in Bari, Italy, that opened in 1989 as a center accredited with the Italian National Health Service (SSN). With more than two decades of experience, it focuses on the prevention and treatment of major eye conditions using modern diagnostic technologies. Its main areas of expertise include glaucoma, vitreoretinal diseases (especially maculopathies), correction of refractive errors (Excimer laser PRK and cataract surgery), strabismus, keratoconus, and the renewal of special driving licenses. The clinic is run by specialists Dr. Giuseppe Ciraci and Dr.ssa Lorenza Ciraci and emphasizes high-quality, safe care supported by a professional team. https://www.oculisticaciraci.it/ |
Schwartz, Giannini, Lantsberger & Adamson (SGLA) tracker page ↗ | space bearsfilter this group | · 13d ago | Schwartz, Giannini, Lantsberger & Adamson (SGLA) Accountancy Corporation is a full-service certified public accounting firm based in Stockton, California, founded in 1988. The firm provides tax planning and compliance, audits, reviews and compilations, bookkeeping, payroll, outsourced CFO support, and business consulting for individuals and companies. It has particular experience with real estate, healthcare, nonprofits, affordable housing, common-interest realty associations, and local government clients. SGLA positions itself as a hands-on local CPA practice that combines traditional accounting work with practical advice to help clients stay compliant and grow. https://www.sglacpas.com/ |
holzmarkt chemnitz tracker page ↗ | space bearsfilter this group | · 26d ago | Holzmarkt Chemnitz is a specialized retail store for building materials and wood products, operating two branches in Chemnitz (Fichtestraße and Kalkstraße). They serve as a competent partner for both professional builders and private customers.-Personal information of employees and clients -Financial documents-SQL DB https://holzmarkt-chemnitz.de/ |
Freelom tracker page ↗ | space bearsfilter this group | · 26d ago | Freelom.net s.r.o. is a Czech internet service provider and IT company based in Lomnice nad Popelkou, which has been operating since 2009 . The company's primary focus is providing wireless internet access via its own network, with services available 24 hours a day, 7 days a week.The company is led by two managing directors, Jiří Plichta and Petr Malý. A priority for Freelom.net is the speed, reliability, and quality of its services , and it aims to resolve technical issues within a maximum of 24 hours-SQL Data (All client personal data) https://freelom.cz/ |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.