Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
183
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲3 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▼1 | 21 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims1,026 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Erdem Hospital tracker page ↗ | direwolffilter this group | · 18d ago | No details on the leak post beyond the victim name. |
Hospital Clnico Universidad de Chile tracker page ↗ | direwolffilter this group | · 18d ago | No details on the leak post beyond the victim name. |
Crystalpharmatech tracker page ↗ | qilinfilter this group | · 18d ago | Business Services |
Absolute Consultancy Services tracker page ↗ | qilinfilter this group | · 18d ago | Business Services |
Black Cat Engineering Construction Wll tracker page ↗ | qilinfilter this group | · 18d ago | Civil Engineering Construction |
Company ID : mtfszhtggfdsg tracker page ↗ | zawoofilter this group | · 18d ago | country: New Zealand | fileSize: 72009692411 | UNPUBLISHED |
Magnolia Dental tracker page ↗ | orovafilter this group | · 18d ago | Our practice is dedicated to providing exceptional dental services to Summerfield, FL, and the surrounding areas. As a patient-centered practice, we treat you like family, prioritizing your comfort and well-being above all else. |
Country Oaks Veterinary Clinic tracker page ↗ | orovafilter this group | · 18d ago | We were the first practice to become AAHA accredited in the area. Our accreditation demonstrates our commitment to the highest standards of veterinary care. |
David King Architect tracker page ↗ | orovafilter this group | · 18d ago | We are an Architectural Firm and Design and prepare plans for almost any low rise structure. We have designed Assisted Living Facilities, Offices, Warehouses, manufacturiing facilities and Car dealerships. |
Woodside Ranch tracker page ↗ | orovafilter this group | · 18d ago | Our motto is hard work and attention to detail. We are committed to giving young prospects the best possible start. We take great pride in our relentless effort to advance our methods and our facilities. |
Stoneybrook West Master Association, Inc tracker page ↗ | orovafilter this group | · 18d ago | At Stoneybrook West, we plan regularly scheduled group physical fitness and after school classes, personal fitness training, swimming classes, tennis instruction, and music lessons are just to name a few. |
Stonecrest POA tracker page ↗ | orovafilter this group | · 18d ago | Stonecrest POA, a United States-based property owners’ association. |
Hilliard's Air Conditioning & Heating Inc tracker page ↗ | orovafilter this group | · 18d ago | Our company has developed a reputation for high quality work and excellent customer service. We understand customer satisfaction and referrals are keys to a strong business and we promise to do all we can to satisfy your air conditioning and heating needs. |
Gemstone UK tracker page ↗ | orovafilter this group | · 18d ago | Gemstone UK was a company that operated for over 30 years before closing its doors. It served a diverse clientele, providing products and services related to gemstones. The company expressed gratitude to its loyal customers for their trust and support throughout the years. |
First Baptist Church of Belleview tracker page ↗ | orovafilter this group | · 18d ago | We are a medium-sized church with an average attendance of 220 on Sunday morning that is seeking to be family friendly and multi-generational. |
Ganzhou Xinye Craft Co., Ltd. tracker page ↗ | orovafilter this group | · 18d ago | Ganzhou Xinye Art and Craft Co., Ltd. is a large-scale craft gift production enterprise affiliated to Xinlin Group. The company was established in September 1997. It is a large foreign-owned enterprise with a total investment of 7.2 million US dollars. It mainly produces resin, glass, clay, ceramics, water globe and other handicrafts, all products are exported to the United States, Canada, Britain and other European and American countries. |
Smartsoft tracker page ↗ | orovafilter this group | · 18d ago | Say goodbye to cumbersome and difficult-to-maintain traditional architectures and regain control of your processes. Redefine enterprise standards with the high performance and low-code platform of .NET 8. |
DL HOLDINGS GROUP tracker page ↗ | orovafilter this group | · 18d ago | DL Holdings is a listed main board company on the Hong Kong Stock Exchange (1709.HK), focusing on investment banking services, including securities trading, financial advisory, multi-strategy investment fund management, investment research, and financial loans. |
Central Florida Civil LLC tracker page ↗ | orovafilter this group | · 18d ago | Central Florida Civil, a leading name in underground utilities and site development based in the vibrant city of Belleview, Florida. With a strong foundation built on professionalism, we are dedicated to delivering exceptional service. Demolition, Earthwork, Fire Suppression, General Construction Management. |
Arich Enterprise Co., Ltd. tracker page ↗ | orovafilter this group | · 18d ago | Currently, our end customers include over 12,000 establishments, such as medical centers, regional hospitals, area hospitals, clinics, chain pharmacies, standalone pharmacies, and hyper market channels. We have created a robust pharmaceutical marketing service system and become the largest domestic company in this field. |
Bai-chi CPA Firm tracker page ↗ | orovafilter this group | · 18d ago | Bai-chi CPA Firm is a registered Taiwanese CPA practice. |
South Pacific Hotel Limited tracker page ↗ | orovafilter this group | · 18d ago | The hotel has a unique glass curtain wall and an oval building appearance. The building is 28 floors high, with 293 rooms and suites. |
ITC Properties Group Limited tracker page ↗ | orovafilter this group | · 18d ago | ITC Properties is an investment holding company and the Group is principally engaged in development of, selling of and investment in properties in Macau, Hong Kong, the People's Republic of China (the "PRC") and Canada; securities investments and provision of loan financing services. |
Neogen Corporation tracker page ↗ | shinyhuntersfilter this group | · 18d ago | This is a final warning to reach out by 1 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Company ID : htrfdrghbtnyr tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 49760098079 | UNPUBLISHED |
Company ID : vrfdeyhnbyuki tracker page ↗ | zawoofilter this group | · 18d ago | country: USA | fileSize: 90147829401 | UNPUBLISHED |
vectorsoft.de tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 17073414449 | PUBLISHED | vectorsoft is Vectorsoft AG, a German software-development company headquartered in Heusenstamm, Hesse, near Frankfurt am Main, Germany. |
winterdienst-berlin.com tracker page ↗ | zawoofilter this group | · 18d ago | country: Germany | fileSize: 35134085775 | PUBLISHED | The company is located at Boschweg 18–20, 12057 Berlin, and lists [email protected] and +49 30 684 083-6 as contact details. According to their company website, their services include:Snow and slush removal Clearing and gritting of sidewalks, roads, parking areas and public spaces Manual and machine-assisted winter maintenance Winter-service operations for businesses, private households and municipalities GPS-supported fleet and quality controls Environmentally conscious winter-service methods.Availability around the clock during winter conditions .The company says it combines around 30 years of experience with modern technology and environmentally friendly materials. |
hd-werkstaetten.de tracker page ↗ | zawoofilter this group | · 18d ago | country: Germany | fileSize: 37740752817 | PUBLISHED | hd-werkstaetten.de belongs to Heidelberger Werkstätten der Lebenshilfe Heidelberg e. V., a German social enterprise / sheltered workshop organization supporting people with disabilities through employment, vocational training, and workplace inclusion. Its main site is in Heidelberg, Baden-Württemberg, Germany. |
ng-engineering.de tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 4674304337 | PUBLISHED | NG Engineering Gruppe is a German engineering and technical-services group headquartered in Rödental, Bavaria. The group has been operating for more than 20 years and has locations in Germany, Poland and the Czech Republic. It provides engineering services throughout the product-development process and also offers personnel/recruitment services. |
berghotel-oberhof.de tracker page ↗ | zawoofilter this group | · 18d ago | country: Germany | fileSize: 4300776316 | PUBLISHED | Konsumhotel Berghotel Oberhof is a wellness and leisure hotel in Oberhof, Thuringia, Germany, located in the Thuringian Forest. It is operated by Berghotel Oberhof GmbH, with Markus Barth as managing director. |
rsk-immobilien.de tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 34483870629 | PUBLISHED | RSK Immobilien GmbH is a German real-estate project developer and property company headquartered in Weißenfels, Saxony-Anhalt. Its core activities are the development, realization, renovation and marketing of residential and commercial properties, with a strong current focus on residential projects. |
montronix.de tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 14756317234 | PUBLISHED | MONTRONIX GmbH is a German industrial technology company specializing in machine-tool monitoring, process monitoring, machine protection, and condition monitoring. The company was founded in 1990 as a spin-off of Kennametal, Inc. and focuses primarily on monitoring solutions for metal-cutting and machining operations. |
kdynium.cz tracker page ↗ | zawoofilter this group | · 18d ago | country: Kdyně, Czech Republic | fileSize: 22341828166 | PUBLISHED | KDYNIUM a. s. is a Czech precision foundry based in Kdyně, Plzeň Region, specializing in precision castings made using the lost-wax (investment casting) process. The company says its foundry has been operating since 1954, while the current joint-stock company was incorporated in 1992. |
frm.ind.br tracker page ↗ | zawoofilter this group | · 18d ago | country: Brazil | fileSize: 41747673590 | PUBLISHED | FRM - Fábrica de Rolamentos e Mancais Ltda is a Brazilian industrial manufacturer specializing in bearings, bearing housings, and industrial movement solutions. The company is based in Curitiba, Paraná, Brazil and has been operating since 1980. |
acqbuilt.com tracker page ↗ | zawoofilter this group | · 18d ago | country: Canada | fileSize: 34895272422 | PUBLISHED | company based in Edmonton, Alberta, Canada. It specializes in using factory-based construction methods to build residential homes faster, with more precision, and with reduced waste compared with traditional on-site building. |
BOTEC-CZ tracker page ↗ | zawoofilter this group | · 18d ago | country: German | fileSize: 29524637347 | PUBLISHED | boTec helps companies in process and production industries improve efficiency, manage data, and optimize business operations using software solutions, consulting, and integration services. |
n-tree.com tracker page ↗ | zawoofilter this group | · 18d ago | country: Austria | fileSize: 70788003456 | PUBLISHED | They develop software and hardware solutions mainly for visitor management and ticketing systems used by: swimming pools and wellness centers, museums and exhibitions, leisure parks, climbing gyms and fitness facilities, mountain railways and ski lifts, industrial visitor systems. Their main locations include: Bregenz, Austria (head office), Delitzsch, Germany, Heimberg, Switzerland, Riazzino, Switzerland/Italian region. |
Company ID : adscynfdkjuih tracker page ↗ | zawoofilter this group | · 18d ago | country: Germany | fileSize: 18677604120 | UNPUBLISHED |
Bandit Industries tracker page ↗ | qilinfilter this group | · 18d ago | Accounting Services |
LAPoco Architects tracker page ↗ | qilinfilter this group | · 18d ago | Architecture, Engineering & Design |
mat-holdings-inc tracker page ↗ | iah647filter this group | · 19d ago | size: 148.2 GiB | status: public | hosting: 27d 5h left |
proampac tracker page ↗ | iah647filter this group | · 19d ago | size: 745.3 GiB | status: soon | hosting: 7d 6h left |
trc-companies tracker page ↗ | iah647filter this group | · 19d ago | size: 4.2 TiB | status: soon | hosting: 9d 7h left |
swagelok tracker page ↗ | iah647filter this group | · 19d ago | size: 881.2 GiB | status: soon | hosting: 8d 5h left |
Globus Medical tracker page ↗ | falconfilter this group | · 19d ago | Medical devices · NYSE: GMED — 2.38 TB compressed, 2.96 TB uncompressed |
DistributionNOW (DNOW Inc.) tracker page ↗ | falconfilter this group | · 19d ago | Energy & industrial distribution · NYSE: DNOW — 182 GB compressed, 344 GB uncompressed |
Yoma Fleet tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Business / Vehicle Leasing | Country: 🇲🇲 Myanmar | Records: Orders, users, repayments, employees — full admin export | Yoma Fleet is a leading vehicle operating lease, rental, and financing company based in Yangon, Myanmar. The platform provides centralized administration and management for vehicle orders, employee financing, repayments, users, and employee records. Admin account access — need to contact on Telegram. | Leaked |
AYUDHYA TH Insurance tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Financial / Insurance | Country: Thailand | Records: Internal batch-control system + admin credentials | Leaked data from AYUDHYA (TH Insurance / Allianz Thailand). Internal batch-control system used within the financial/transaction batch-processing ecosystem behind the Allianz customer-facing web platform. Includes admin credentials (TBH2CASH:AAbb1234). | Leaked |
GUSTO College GLMS tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Education Sector | Country: 🇲🇲 Myanmar | Records: User account credentials | Compromised user accounts from GUSTO College's GLMS (Global Learning Management System). Exposed user credentials from the Moodle platform at gusto-education.com. | Leaked |
Job Net .COM.MM tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Business | Country: Myanmar | Records: ~500++ user accounts and cv information | Normal Hunters operation compromising Job Net .COM.MM business data, exposing corporate information, user accounts, and business operations data. | Leaked |
The University of Delhi (DU) tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Education Sector | Country: 🇮🇳 India | Records: Student records with PII, academic data, and identification documents | The University of Delhi (DU) is a major public university in New Delhi, India, founded in 1922. It is one of India's most well-known universities, offering undergraduate, postgraduate, and doctoral programs across subjects like science, arts, commerce, law, and technology. | For Sale |
Indonesian Police Database tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Government / Law Enforcement | Country: Indonesia | Records: 52,000 officer records + 4,000 facial photos | Database containing records of 52,000 Indonesian police officers including email addresses, phone numbers, first and last names, passwords, location details, and 4,000 facial photographs. | For Sale |
Netim Company tracker page ↗ | dysphor1afilter this group | · 19d ago | Sector: Business / Domain Registrar | Country: 🇫🇷 France | Records: Source code, IPs, payment databases, customer PII — full infrastructure | Netim is a French domain name registrar and web hosting provider. Full compromise of internal systems — source code, infrastructure IPs, payment processing databases, customer PII, and internal business data. | For Sale |
Glassdoor tracker page ↗ | the gentlemenfilter this group | · 19d ago | glassdoor.com is a U.S. job platform (founded 2007) where employees anonymously review companies — culture, salaries, management. It's owned by Recruit Holdings/Indeed (acquired for $1.2B in 2018; legally merged into Indeed on July 1, 2026). It hosts millions of reviews for ~600,000 companies, plus salary data and job listings. Free for job seekers, monetized via employer branding tools; it also publishes the annual "Best Places to Work" awards. |
G R Infraprojects tracker page ↗ | the gentlemenfilter this group | · 19d ago | grinfra.com zoominfo.com/c/g-r-infraprojects-ltd/353612422 We have taken NDA files, HR data, user data, employee data, technical drawings, models, bank statements, tax and legal documents, confidential files, photographs of work, screenshots, passport scans, VIP client data, and much more the total volume of data exceeds 531 GB. Grinfra G R Infraprojects Ltd is an Indian integrated infrastructure EPC company founded in 1995, headquartered in Udaipur and Gurugram. It builds roads, highways, bridges, metros, railways, tunnels, ropeways and power transmission lines across 23+ Indian states, with a 10,000-strong workforce and an order book of roughly ₹19,000+ crore ($2.3 bn). Projects are delivered under EPC, BOT, HAM and BOOT models, backed by in-house manufacturing (bitumen, paints, metal crash barriers) and ~7,500 equipment units. Listed on BSE/NSE since July 2021 (ticker GRINFRA), rated CRISIL AA / CARE AA+ (stable). |
Northwest Trophy tracker page ↗ | the gentlemenfilter this group | · 19d ago | nwtrophy.com rocketreach.co/northwest-trophy-inc-profile_b59c90e0f9bc4cf5 Northwest Trophy & Awards Inc is a fourth-generation, family-owned awards business operating since 1938, with a showroom in Woodinville, WA (Seattle area). It offers personalized awards and gifts: trophies, medals, plaques, crystal and art-glass awards, acrylics, clocks, drinkware and ceremonial items. All engraving and printing (laser, rotary, full-color) is done in-house, serving sports teams, schools and businesses. It sells both through its showroom and an online Shopify store with standard 5–7 day production; a Seattle location was closed in 2023, leaving Woodinville (and previously Bellevue) to serve customers. |
General Gruppo tracker page ↗ | the gentlemenfilter this group | · 19d ago | generalgruppo.it rocketreach.co/general-gruppo-profile_b68428f5c6158b62 General Gruppo / General s.r.l. is a family-owned Italian retail chain founded in 1975 by Pietro Paolo Tognetti and Silvana Bonugli, headquartered in Querceta (Seravezza, Lucca, Tuscany). Historically known as IperSoap — one of Italy's first home-care and personal-hygiene retail formats — it reached ~250 stores in 2019 and €150 million in revenue (2018). In 2020 it began rebranding into the unified PiùMe banner (merging IperSoap, Smoll and Shuki), and it also owns the historic Bacci Profumerie perfumeries (Forte dei Marmi) and the piume.it online shop. The founders' sons run the business — Saverio (CEO) and Francesco; the group includes General s.r.l. and General Nord s.r.l. |
Ixa Systems tracker page ↗ | the gentlemenfilter this group | · 19d ago | ixasystems.ch rocketreach.co/ixa-systems-sa-profile_b40f7faaffd19ede Ixa Systems SA is a Swiss security systems company founded in 2007, headquartered in Crissier (canton Vaud, near Lausanne). A small family-run firm of ~9–10 staff with revenue of about CHF 3.5 million, it designs and integrates surveillance solutions: video surveillance (IP/CCTV), anti-intrusion systems, intercom, access control, perimeter detection, technical building supervision (GTC) and evacuation PA systems. Since 1 April 2022 it has been majority-owned by the D.E.S Systèmes de sécurité SA group, with Marc Barraud as director. Its clients include police, banks, museums, schools, hospitals, prisons and railways, and it offers 24/7 maintenance contracts. |
Tecno Accion tracker page ↗ | the gentlemenfilter this group | · 19d ago | tecnoaccion.com.ar Tecno Accion S.A. is an Argentine IT company (founded 1988) that acts as a technology partner for lotteries — "Modernizing lotteries in a digital world" — with offices in Buenos Aires (Av. Rivadavia 620) and Bariloche. It develops its own hardware and software for lottery automation: 8,000+ terminals in operation, 4+ million daily wagers, serving 12 jurisdictions (half of Argentina's provinces); in Salta province it is the exclusive operator of the lottery license (900+ points of sale). It also delivered horse-racing bet capture for the Hipódromo Argentino de Palermo and completed projects in Peru, Panama, Brazil and Nigeria. Staff of ~80–135; certified under ISO 9001, ISO 27001 and WLA SCS:2020; historically linked to Greece's Intralot and the Capital Markets group. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.