Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 93 | 93 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 21 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims1,025 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
AUDIT ENTITY: Demidov Steel Group tracker page ↗ | audit teamfilter this group | · 22d ago | AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 |
Gill Rock Drill tracker page ↗ | akirafilter this group | · 22d ago | Gill Rock Drill Company, Inc., located in Lebanon, PA, is a family-owned manufacturer and distributor specializing in drilling equipment and tools for the drilling industry. The company offers a range of services including contract drilling, rentals, and technical support, focusing onbuilding strong customer relationships based on integrity and trust. We will upload 5gb of corporate data soon. Employee personal information (passports, DLs, w-9 complete forms), client information, financials, payment details, CCs, NDAs and so on. |
Party Rental tracker page ↗ | the gentlemenfilter this group | · 22d ago | partyrentalltd.com zoominfo.com/c/party-rental-ltd/92603384 is a legitimate, family-owned U.S. event rental company founded in 1972 — one of the largest in the country. HQ and a 300,000 sq ft warehouse are in Teterboro, NJ, with locations in New York City, Philadelphia, Washington D.C., Boston, and the Hamptons. |
TEC Container tracker page ↗ | the gentlemenfilter this group | · 22d ago | teccontainer.com TEC Container is a Spanish manufacturer of spreaders, lifting frames, and container-handling equipment, based in Algete (Madrid) since 1988. The company supplies ports and terminals worldwide, offering brands like TECSPREADER and TECGENSET (its diesel genset line for reefer containers). |
Verbux tracker page ↗ | the gentlemenfilter this group | · 22d ago | verbux.com zoominfo.com/c/verbux-soluciones-informáticas-limitada/457993216 Verbux is a Chilean IT company — Verbux Soluciones Informáticas Limitada — operating since 2001, headquartered at Juana de Arco Nº2012, Oficina 33, Providencia, Santiago, Chile (also verbux.cl). It delivers IT infrastructure, engineering, professional IT services, cloud computing, IoT and SCADA process-control solutions for industrial, mining and power-generation clients. Claims 1,000+ implemented IT solutions (from file servers to data centers with high availability), and is currently implementing ISO 9001:2015 quality certification. |
Espinos tracker page ↗ | the gentlemenfilter this group | · 22d ago | espinos.energy dnb.com/business-directory/company-profiles.espinos_sa.7081c859ec6ec62bc369252d901ee655.html Espinos S.A. is a Chilean power generation company operating under the Potencia Chile brand (Grupo Agrisol), with 17 years of experience and ~260 MW of installed capacity. It runs a diversified portfolio: thermal (Central Espinos in Los Vilos), hydroelectric (Renaico, Alto Renaico), solar (Lipangue, Pumas) and battery storage (BESS Mandarinos). Headquartered at Av. Apoquindo 4501, Las Condes, Santiago, Chile; RUT 76.925.800-0. |
Incolur tracker page ↗ | the gentlemenfilter this group | · 22d ago | incolur.cl zoominfo.com/c/incolur/372497016 Incolur Corretajes Limitada is a Chilean import & distribution company specialized in industrial supplies. It imports and distributes: machine tools and their accessories, abrasives (grinding/cutting wheels), welding equipment, measuring & precision instruments, industrial gauges and tooling for workshops and construction. De facto it works as a B2B supplier, reselling international industrial brands to the Chilean market. |
Oral and Maxillofacial Surgery tracker page ↗ | akirafilter this group | · 22d ago | Oral and maxillofacial surgeons Dr. Catrambone and Dr. August , Brockton, MA practice a full scope of oral and maxillofacial surgery with expertise ranging from corrective jaw surgery to wisdom tooth removal.We will upload 14gb of corporate data soon. Employee personal information (passports, phone contacts), client information, financials, patients and so on. |
PA-ID tracker page ↗ | akirafilter this group | · 22d ago | PA-ID GmbH specializes in mechanical construction and manufacturing, building series and customsystems, as well as electrical design and the development of tailored industrial software.We will upload 119gb of corporate data soon. Employee personal information (passports, ID's), client information, financials, NDAs and so on. |
Metal Conversions tracker page ↗ | qilinfilter this group | · 22d ago | Building Materials |
California Truck Equipment tracker page ↗ | qilinfilter this group | · 22d ago | Business Services |
Northern Leasing Systems tracker page ↗ | qilinfilter this group | · 22d ago | Furniture |
ERPIS LLC tracker page ↗ | aurorafilter this group | · 22d ago | ERPIS LLC (doing business as ShipERP) — a Texas-based SAP integrator whose single product is enterprise shipping management software used by Boeing, Pfizer, NVIDIA, John Deere, Medtronic, and 83 other enterprise customers. The exposed material includes: Complete product source code — all versions (2.0–5.4) of ShipERP's ABAP source, the company's sole revenue-generating asset ($20.6M backlog) Live QuickBooks financial database (705 MB) — complete payroll (SSN, bank accounts, salaries), vendor banking details, AR/AP, and general ledger Full customer contract register — exact pricing for all 88 enterprise customers with $20.6M in deferred revenue SAP installation media (245 GB) — full HANA, S/4HANA, and kernel distributions |
MEMSIC tracker page ↗ | abyss-datafilter this group | · 22d ago | memsic.com |
ATF tracker page ↗ | qilinfilter this group | · 22d ago | Government |
WireCo tracker page ↗ | qilinfilter this group | · 22d ago | Manufacturing |
Morgan Services tracker page ↗ | ailockfilter this group | · 22d ago | No details on the leak post beyond the victim name. |
Hamilton tracker page ↗ | ailockfilter this group | · 22d ago | No details on the leak post beyond the victim name. |
FBC tracker page ↗ | deadlockfilter this group | · 22d ago | Furniture Bargaining Council in South Africa. This is the tariff council for the furniture, mattress and upholstery industry.The platform serves employers and employees in the industry in regions such as Gauteng, North West, Mpumalanga, Limpopo and the Free State to handle legal and administrative processes. |
Integrex RCM tracker page ↗ | qilinfilter this group | · 22d ago | Healthcare Services |
Air International Thermal Systems tracker page ↗ | qilinfilter this group | · 22d ago | Automotive Parts |
Global Terminal Services tracker page ↗ | deadlockfilter this group | · 22d ago | GTS legally registered as Global Terminal Hizmetleri A.Ş. It is the largest independent storage terminal for liquid fuels and oil in the entire Mediterranean region. |
AUDIT ENTITY: ma***up tracker page ↗ | audit teamfilter this group | · 22d ago | AUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26 |
industry.airliquide.kr tracker page ↗ | safepayfilter this group | · 22d ago | Air Liquide has operated in South Korea for several decades and supplies essential gases and related technologies to major industries, … |
Brazosport College tracker page ↗ | qilinfilter this group | · 22d ago | Education |
parkderochie.com tracker page ↗ | chaosfilter this group | · 23d ago | Park de Rochie (parkderochie.com) – Countdown to Publication Management at Park de Rochie has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are mo… |
mswalker.com tracker page ↗ | chaosfilter this group | · 23d ago | MS Walker (mswalker.com) – Countdown to Publication Management at MS Walker has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to engage, we are moving forward o… |
copcp.com tracker page ↗ | chaosfilter this group | · 23d ago | Central Ohio Primary Care (copcp.com) – Countdown to Publication Management at Central Ohio Primary Care has chosen to completely ignore all attempts to establish a constructive dialogue regarding their security breach. Silence will not make this situation go away. Since leadership refuses to en… |
Johnson City Honda tracker page ↗ | global secret groupfilter this group | · 23d ago | Country: Tennessee, United States | Website: johnsoncityhonda.com | Revenue: $6,5 Million | Industry: Automobile Dealers | Employees: 11-50 | Properties: 32.9 GB(34,277 Files, 8,896 Folders) |
Lockheed Architectural Solutions, Inc. tracker page ↗ | global secret groupfilter this group | · 23d ago | Country: Pascoag, RI 02859, United States | Website: lockheedsolutions.com | Revenue: $31.2 Million | Industry: Manufacturing, Construction, Building Materials | Employees: 100-200 | Properties: 1.3 TB (558,462 Files, 97,835 Folders) |
National Kidney Registry tracker page ↗ | direwolffilter this group | · 23d ago | No details on the leak post beyond the victim name. |
Studio Legale ESE tracker page ↗ | direwolffilter this group | · 23d ago | No details on the leak post beyond the victim name. |
Tiseo Paving tracker page ↗ | global secret groupfilter this group | · 23d ago | Country: Texas, US | Website: tiseopaving.com | Revenue: $22.6 Million | Industry: Construction, Commercial & Residential Construction | Employees: 50-100 | Properties: 457 GB (83,932 Files, 10,829 Folders) |
S******* tracker page ↗ | genesisfilter this group | · 23d ago | An International Public Company |
Davis & Ferber tracker page ↗ | akirafilter this group | · 23d ago | Davis & Ferber LLP is a personal injury and malpractice law firm based in New York, specializing in various legal areas including medical malpractice, motor vehicle accidents, nursing home abuse, and family law.We will upload 60gb of corporate data soon. Detailed personal client information (passports, DLs, addresses, SSNs, death/birth certs, phones and so on for almost a thousand people), confidential files, court files, hearings, police reports, NDAs, etc. |
WINTER Ingenieure tracker page ↗ | akirafilter this group | · 23d ago | WINTER Ingenieure specializes in planning and monitoring the construction of technical buildingequipment across Germany, focusing on functionality, sustainability, and cost-effectiveness. With a team of over 140 employees located in Düsseldorf, Berlin, and Hamburg, they integrate technical components into buildings innovatively.We will upload 340gb of corporate data soon. Employee personal information (German passports, IDs, addresses, phones contacts), confidential files, projects, lots of specifications and so on. |
AGROLAND S.A. tracker page ↗ | qilinfilter this group | · 23d ago | Agriculture |
STRUCTURED SETTLEMENT CAPITAL LLC tracker page ↗ | qilinfilter this group | · 23d ago | Finance |
SC PaderTeG Cabluri Electrice tracker page ↗ | qilinfilter this group | · 23d ago | Manufacturing |
Dentist in New Britain, CT tracker page ↗ | dark projectfilter this group | · 23d ago | As a result of the attack, the following were compromised: the entire customer database, consisting of just over 8,000 files, as well as a small number of records containing Social Security numbers |
Pump Engineering Company tracker page ↗ | dark projectfilter this group | · 23d ago | During the cyberattack, 120,000 files (115 GB) were stolen, including an extensive customer database, insurance documents, confidential financial documents, and a vast number of project drawings. |
PCA Group Sdn. Bhd. tracker page ↗ | majinahanashifilter this group | · 23d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-28T22:03:00Z Package: 2.5 GiB / 1844 files |
Cosmon tracker page ↗ | beastfilter this group | · 23d ago | Cosmon develops agentic artificial intelligence software for mechanical engineering workflows, centered on its Nexus product for CAD, CAE, simulation, and PLM tasks. Its website presents the company as a software provider whose platform automates drawing creation, simulation setup, troubleshooting, design validation, and product lifecycle data tasks while integrating directly with major engineering tools. Although the offering is deeply technical and tailored to engineering environments, the core business shown is the development and delivery of proprietary engineering software rather than providing outsourced engineering services or general consulting. |
Consultores de Seguros tracker page ↗ | qilinfilter this group | · 23d ago | Insurance |
W****s tracker page ↗ | payoutskingfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
Government of Vojvodina tracker page ↗ | panzerfilter this group | · 24d ago | The Provincial Government of Vojvodina is focused on enhancing economic and academic cooperation within the region and internationally. SENVIBE project is to improve and build national educational capacities, cooperation and competences in dealing with environmental and occupational noise and vibration (No&Vib) engineering issues in accordance with ongoing EU integration strategies and the needs identified in Serbia. |
lagegepesca.it tracker page ↗ | safepayfilter this group | · 24d ago | Based in Lallio, near Bergamo in Lombardy, the company traces its origins to 1957, when Santo Gavazzi established a small … |
Furnished Quarters tracker page ↗ | dark projectfilter this group | · 24d ago | The company "Furnished Quarters" was the victim of a successful cyberattack, as a result of which the company’s confidential data was stolen. The volume of data stolen amounts to 155 GB. The data stolen included the company’s customer details, as well as documents containing banking and financial information. Currently, around 198,000 files are no longer under the control of "Furnished Quarters". |
Design-Aire Engineering, INC tracker page ↗ | dark projectfilter this group | · 24d ago | Design-Aire Engineering, INC has suffered a cyberattack on its service systems, resulting in the theft of approximately 377GB of sensitive data. The breached information includes employees' personal data and detailed architectural plans of clients' buildings. |
Jones, Little & Co., CPAs, LLP tracker page ↗ | dark projectfilter this group | · 24d ago | At least 100 gigabytes of company data—including financial records, internal files, and employee personal information—were stolen in a cyberattack. Hackers encrypted the firm's systems after exfiltrating the documents, leaving operations paralyzed. |
The Liberty Group tracker page ↗ | dark projectfilter this group | · 24d ago | A company has suffered a major cyberattack resulting in the theft of approximately 27,000 internal files. The leaked documents include financial records, internal working materials, and personal data of employees. Attackers encrypted the company's systems following the breach, severely disrupting operations |
Criba tracker page ↗ | dragonforcefilter this group | · 24d ago | (release includes data on Argentina, Uruguay, and other countries, as well as financial documents and client documentation, including a vast amount of informati... |
Brookview Financial tracker page ↗ | dragonforcefilter this group | · 24d ago | (data of many thousands of customers, including credit reports, SSNs, addresses, etc.) Brookview Financial is a boutique private lender specializing in quick-cl... |
Wozair tracker page ↗ | dragonforcefilter this group | · 24d ago | Wozair specializes in the design, manufacture, and installation of heavy-duty heating, ventilating, and air conditioning (HVAC) products for various sectors inc... |
Frato tracker page ↗ | dragonforcefilter this group | · 24d ago | (release includes data for the entire group of companies across all countries of operation, financial documentation, shareholder information, personal data of e... |
Davroc tracker page ↗ | booba teamfilter this group | · 24d ago | Furniture and Home Furnishings Manufacturing Website: www.davroc.co.uk Stolen data: 15 GB. |
Chernyy & Associates tracker page ↗ | booba teamfilter this group | · 24d ago | Law Practice Website: www.chernyy-law.com Stolen data: 67 GB. |
Meridian Forest Services tracker page ↗ | beastfilter this group | · 24d ago | Meridian Forest Services Limited is a progressive natural resource consulting company that offers a range of services including forest engineering, silviculture, tenure management, strategic planning, geomatics, wildlife and danger tree assessment, and project management. The company caters to a diverse clientele, including First Nations, industry stakeholders, private forest landowners, and government entities. Committed to safety, Meridian is Safe Certified through the BC Forest Safety Council, ensuring a secure work environment. Their innovative approach positions them as a leader in the natural resource sector |
Bihl tracker page ↗ | akirafilter this group | · 24d ago | Boustead International Heaters (BIH) is a leading global designer and supplier of thermal process equipment, including direct fired heaters, waste heat recovery units (WHRUs), and heat recovery steam generators (HRSGs).We will upload 392gb of corporate data soon. Huge amount of detailed personal employee information (passports, DLs, addresses, SSNs, death/birth certs, phones, contacts), confidential financials and agreements and contracts, client information, NDAs and so on. |
Coldfish Seafood tracker page ↗ | qilinfilter this group | · 24d ago | Food & Beverage |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.