Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 24 | ▲10 | 118 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▼1 | 21 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims1,026 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Hanwha Renewables tracker page ↗ | emperadorfilter this group | · 20d ago | The data contains really sensitive information from 4 PV projects looking for investment/financing of Hanwha. We extracted around 12GB of highly sensitive information relating to the following projects: - Bonanza Peak (3GB) - Boulder Solar III (0.7GB) - Obreron Portfolio (4.8GB) - Project Sprout (3.7GB) In the data we found highly sensitive information including: - PPAs - Financial models - Interconnection agreements - Engineering designs of the assets - Personal identifiable information - Sensitive reports, budgets, financial information Reach out to prevent the leak. Cost of litigation from counterparties for breach of confidentiality is way higher. Commercially, good luck negotiating after your practices and contracts are leak. Good luck looking for financing/investment for these assets with the data leaked. Publication scheduled: 2026-09-04 23:48:30 UTC Size: 12GB Sectors: Energy |
Infinnium tracker page ↗ | qilinfilter this group | · 20d ago | Law Firms & Legal Services |
Whitehouse tracker page ↗ | qilinfilter this group | · 20d ago | Accounting Services |
Caduceus Medical Group tracker page ↗ | anubisfilter this group | · 20d ago | Predictable but dangerous data exposed in a healthcare company breach. |
Ne...n M... tracker page ↗ | leakeddatafilter this group | · 20d ago | To be announced... |
ETNA Software tracker page ↗ | eclipsefilter this group | · 20d ago | ETNA Software is a company that provides white-label online trading solutions for brokers and FinTech firms, including mobile and web trading platforms. Their products are designed to help retail broker-dealers launch trading capabilities efficiently and cost-effectively. |
singleton.com tracker page ↗ | chaosfilter this group | · 20d ago | Founded in 1986, Singleton Reynolds is a law firm. They are headquartered in Vancouver, British Columbia. |
tnmed.org tracker page ↗ | lockbit5filter this group | · 21d ago | The Tennessee Medical Association is a nonprofit organization that advocates for physicians in Tenne... |
Kling Automaten tracker page ↗ | qilinfilter this group | · 21d ago | Gambling & Gaming |
Dotlines tracker page ↗ | qilinfilter this group | · 21d ago | Software |
Globalport Terminals tracker page ↗ | qilinfilter this group | · 21d ago | Business Services |
BENCIVIL tracker page ↗ | inc ransomfilter this group | · 21d ago | No details on the leak post beyond the victim name. |
fpmanagement.nl tracker page ↗ | lockbit5filter this group | · 21d ago | FP Management BV is a licensed trust office based in Rotterdam, Netherlands, offering a range of ser... |
Rohloff Group tracker page ↗ | inc ransomfilter this group | · 21d ago | No details on the leak post beyond the victim name. |
Cetylite tracker page ↗ | akirafilter this group | · 21d ago | Cetylite, Inc. specializes in dental and medical products aimed at enhancing patient comfort, safety, and satisfaction. Their offerings include exclusive specialty products like Cetacaine for dental practices and proprietary Rx and disinfection products for the medical field.We will upload 6gb of corporate data soon. Employee personal information (passports, DLs, SSNs,credit cards), client information, detailed financials, confidential files, NDAs and so on. |
CGP MEP tracker page ↗ | akirafilter this group | · 21d ago | CGP MEP is a Building Services Consultancy based in London and Leeds, specializing in mechanical and electrical engineering. They offer a wide range of services across various sectors including leisure, education, residential, and industrial projects.We will upload 260gb of corporate data soon. Detailed employee personal information (passports,DLs, SSNs, personal financials), client information, projects, financials, NDAs and so on. |
Seabrook Island tracker page ↗ | akirafilter this group | · 21d ago | Seabrook Island and its stunning natural beauty create the perfect setting for luxury homes enjoying oceanfront, riverfront, tidal marsh, golf course, and maritime forest views.We will upload 55gb of corporate data soon. Employee personal information (passports, DLs, SSNs, personal financials), client information, projects, financials, NDAs and so on. |
data breach in these 3 sites founded by Kelvin Mun. tracker page ↗ | meowciety403filter this group | · 21d ago | No details on the leak post beyond the victim name. |
GPS Grothkopp und Partner tracker page ↗ | qilinfilter this group | · 21d ago | Business Services |
Ruby Seven Studios tracker page ↗ | inc ransomfilter this group | · 21d ago | No details on the leak post beyond the victim name. |
Ipro.com(revealdata.com) customer DB + full database backup tracker page ↗ | emperadorfilter this group | · 21d ago | Yes, this data has been posted before by ME under a different alias, yes the individual that posted the data on cracked.st is a fraud. I am posting this just for fun. Data contains: Customer identifiers, Contact & Location, Account metadata, Internal System IDS, Client relationships. The full database backup contains everything such as transcripts, cases, though it is from 2023. Published Size: 79.5 MB Sectors: Government, Law |
Providence Investments tracker page ↗ | qilinfilter this group | · 21d ago | Finance |
LGG Advisors tracker page ↗ | qilinfilter this group | · 21d ago | Business Services |
Open Sports tracker page ↗ | qilinfilter this group | · 21d ago | Retail · Pennsylvania |
AUDIT ENTITY: PI***al tracker page ↗ | audit teamfilter this group | · 21d ago | AUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27 |
DAB Investments tracker page ↗ | qilinfilter this group | · 21d ago | Construction |
Displaydata tracker page ↗ | qilinfilter this group | · 21d ago | Electronics |
SCA Logistik & Fulfillment GmbH tracker page ↗ | aurorafilter this group | · 21d ago | SCA is a Bavarian logistics and e-commerce fulfillment provider. The exposed materials includes: Spans customer orders Shipments and returns Employee and applicant files Management, tax and banking records Warehouse automation Source code Customer contracts. |
takt.be tracker page ↗ | lockbit5filter this group | · 21d ago | De notaris: de onpartijdige en onafhankelijke raadgever bij uitstek Sinds jaar en dag staat een e... |
dece.cz tracker page ↗ | lockbit5filter this group | · 21d ago | DeCe COMPUTERS s.r.o. specializes in comprehensive computer and office management solutions, offerin... |
Capitol Mechanics tracker page ↗ | emperadorfilter this group | · 21d ago | Capitol Mechanics , fresh databases, important docs Publication scheduled: 2026-09-10 08:37:25 UTC Size: 120.9 MB Sectors: Finance, Transportation |
JP Molyneux Studio tracker page ↗ | deadlockfilter this group | · 21d ago | JP Molyneux Studio Ltd showcases the exclusive work of internationally renowned interior designer Juan Pablo Molyneux. |
NEXT LEVEL MEDICAL, LLC tracker page ↗ | pearfilter this group | · 21d ago | Affordable urgent care across Texas |
Q... E... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
N... M... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
S... P... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
K... M... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
H... K... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
H... L... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
C... O... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
A... tracker page ↗ | leakeddatafilter this group | · 21d ago | To be announced... |
theheartcenterofmemphis.com tracker page ↗ | lockbit5filter this group | · 21d ago | The Heart Center of Memphis is a leading cardiology practice in the Mid-South, specializing in compr... |
Sanatorio Modelo de Caseros tracker page ↗ | qilinfilter this group | · 22d ago | 0 |
KenEp Resources tracker page ↗ | qilinfilter this group | · 22d ago | Architecture, Engineering & Design |
Crowe tracker page ↗ | coinbase cartelfilter this group | · 22d ago | Accounting For Legal Practices - $1.3 Billion |
Advanced Engineering Consultants tracker page ↗ | coinbase cartelfilter this group | · 22d ago | Architecture, Engineering & Design - $14.8 Million |
sysconth.com tracker page ↗ | krybitfilter this group | · 22d ago | Syscon (Thailand) Co., Ltd. is a Thai company headquartered in Bang Khen District, Bangkok, Thailand, specializing in th... |
jindallifescience.com tracker page ↗ | krybitfilter this group | · 22d ago | Jindal Life Science Private Limited is an Indian full-service Contract Research Organization (CRO) established in 2023, ... |
mimafoods.net tracker page ↗ | krybitfilter this group | · 22d ago | Mima Foods is an Egyptian top producer and global exporter of IQF (Individually Quick Frozen) frozen vegetables and food... |
vascara.com tracker page ↗ | krybitfilter this group | · 22d ago | Vascara (Global Fashion One Member Company Limited) is a Vietnamese premium fashion brand specializing in stylish women'... |
www.neooftalmo.com.br tracker page ↗ | krybitfilter this group | · 22d ago | NEO — Núcleo de Excelência em Oftalmologia Ltda is a leading Brazilian ophthalmology hospital founded on May 13, 200... |
lemonfarm.com tracker page ↗ | krybitfilter this group | · 22d ago | Lemon Farm Co., Ltd. is a leading Thai organic supermarket chain and online platform for organic and healthy food produc... |
finodayacapital.com tracker page ↗ | krybitfilter this group | · 22d ago | Finodaya Capital Private Limited is an Indian tech-enabled Non-Banking Financial Company (NBFC) incorporated on Septembe... |
wmiemporium.com tracker page ↗ | krybitfilter this group | · 22d ago | WMI Emporium Co., Ltd. is a Thai manufacturer and distributor of metal sheet products established in 2002 as a joint ven... |
cgcgabon.com tracker page ↗ | krybitfilter this group | · 22d ago | Le Conseil Gabonais des Chargeurs (CGC) is a Gabonese public administrative institution (établissement public à caract... |
karkinos.in tracker page ↗ | krybitfilter this group | · 22d ago | Karkinos Healthcare Private Limited is an Indian comprehensive cancer care platform and healthcare technology company fo... |
ferretornillos.gt tracker page ↗ | krybitfilter this group | · 22d ago | Ferretornillos, S.A. is a Guatemalan company incorporated on March 14, 2016, specializing in the wholesale distribution ... |
www.sankovn.com tracker page ↗ | krybitfilter this group | · 22d ago | Sanko Fastem (Vietnam) Co., Ltd. is a Vietnamese subsidiary of Sanko Fastem (Thailand) under the Sanko Techno Group (Jap... |
Simplex Engineering tracker page ↗ | eclipsefilter this group | · 22d ago | Simplex Engineering & Foundry Works Pvt. Ltd. specializes in the design, fabrication, machining, and assembly of industrial equipment and components. With over seventy years of experience, the company has successfully completed numerous turnkey projects for both private and public sector organizations. Additionally, Simplex offers refurbishment services for industrial equipment and steel procurement through its Steel Service Center. Their esteemed clientele includes some of the largest engineering companies in India. |
AUDIT ENTITY: Demidov Steel Group tracker page ↗ | audit teamfilter this group | · 22d ago | AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.