Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
181
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲6 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 7 | ▲4 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 6 | = | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | ▲1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 18 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 19 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 20 | vexy | 3 | ▼8 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents17 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Odyssey Charter School, Inc. tracker page ↗ | wallstreetfilter this group | · 13h ago | Odyssey Charter School, Inc. is a nonprofit organization operating tuition-free public charter schools in Florida for students from preschool through 12th grade, with a focus on academic achievement and whole-child development. |
Roshd Sanat tracker page ↗ | wallstreetfilter this group | · 13h ago | Roshd Sanat is an Iranian industrial company providing engineering, manufacturing, and technical services, with a focus on industrial and energy-sector projects. |
NcbChurch tracker page ↗ | wallstreetfilter this group | · 6d ago | New Covenant Believers’ Church is a faith-based ministry focused on spiritual, emotional, and mental growth through God’s Word |
On Demand Occupational Medicine tracker page ↗ | wallstreetfilter this group | · 6d ago | On Demand Occupational Medicine provides occupational health, drug testing, workplace safety, and employee wellness services in Austintown, Ohio. |
Goldston Oil Corporation tracker page ↗ | wallstreetfilter this group | · 6d ago | Goldston Oil Corporation is a Houston-based oil and gas exploration and production company operating in Texas and Louisiana |
America’s Food Basket tracker page ↗ | wallstreetfilter this group | · 13d ago | America’s Food Basket is a U.S. cooperative grocery-store network. Its site, afbasket.com, provides store locations, weekly ads, online shopping, delivery, recipes, and job listings. It operates under the America’s Food Basket and Ideal Food Basket names. |
Ormond Beach Florida tracker page ↗ | wallstreetfilter this group | · 14d ago | Ormond Beach, Florida, is a scenic coastal city just north of Daytona Beach, known for its beaches, relaxed atmosphere, historic charm, and outdoor activities. |
Total Education Solutions tracker page ↗ | wallstreetfilter this group | · 15d ago | TES IDEA provides personalized educational, therapeutic, and developmental solutions that help students, families, and schools achieve better outcomes. |
Cedar County Memorial Hospital tracker page ↗ | wallstreetfilter this group | · 16d ago | Cedar County Memorial Hospital is a community hospital providing emergency, inpatient, outpatient, diagnostic, surgical, and rehabilitation services. |
Andover tracker page ↗ | wallstreetfilter this group | · 17d ago | The Town of Andover, Massachusetts, is a municipal government organization that provides public services, administration, community programs, education resources, infrastructure support, and civic information to residents and businesses in Andover. |
T.RAD North America tracker page ↗ | wallstreetfilter this group | · Aug 10, 2026 | T.RAD North America (tradna.com) is a Hopkinsville, Kentucky-based manufacturer focused on heat exchangers for thermal-management applications such as vehicle powertrains, HVAC/architectural systems, and emerging technologies like battery and fuel-cell cooling. |
Black Hills Bentonite tracker page ↗ | wallstreetfilter this group | · Aug 10, 2026 | Black Hills Bentonite LLC (bhbentonite.com) is a Wyoming-based producer of high-quality sodium bentonite, along with lignite-related products, supplying global industrial and commercial uses such as drilling fluids, environmental/civil engineering sealing, absorbents (including cat litter), and metal casting/foundry applications |
Gold Standard Automotive tracker page ↗ | wallstreetfilter this group | · Jul 5, 2026 | Gold Standard Automotive Network administers vehicle service contracts sold through dealerships, offering coverage for repairs after your factory warranty ends, with claim approvals handled through the company. |
Baraga County Memorial Hospital tracker page ↗ | wallstreetfilter this group | · Jul 5, 2026 | Baraga County Memorial Hospital is a critical access hospital serving Baraga County with emergency, surgery, imaging, rehab, and outpatient care. |
Asisken tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | Asisken (asisken.com) is a medical assistance/health insurance company offering prepaid medical coverage and member support services, with a hospital network in Ecuador (and Colombia). |
Edgewood Police Department tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | The Edgewood Police Department is part of the Pierce County Sheriff’s Department, providing public safety and law enforcement services for the city, including community-focused programs like its free Community Academy |
Omax Autos tracker page ↗ | wallstreetfilter this group | · Jun 22, 2026 | OMAX Autos Limited is a leading manufacturer of sheet metal components, specializing in the production of auto and non-auto components. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.