Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
8
Accounts exposed · 30d
36.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims1,026 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
marvin tracker page ↗ | iah647filter this group | · 28d ago | download size 2.2 TiB not available for download yet. |
Elbor S.p.A. tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
CTP S.r.l. tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
Alto Calore Servizi SPA tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
Tedesco & Partners STP srl tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
POEMA S.r.l. tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
TECNOLOGICA S.r.l. tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
CONDOR SPA tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
Alert tracker page ↗ | sovcalifilter this group | · 28d ago | In accordance with our serious intent and our exclusive interest in negotiating solely with the company itself, we have refrained from initiating any discussions with any other company or competitor. To demonstrate that we are in possession of the data in question, we will release an additional 35 gigabytes of material belonging to this company within the next two days.We trust that the company’s officials will reach a definitive decision at the earliest opportunity |
CCA Bank tracker page ↗ | everestfilter this group | · 28d ago | 2 posts - 1h |
NetExam tracker page ↗ | emperadorfilter this group | · 28d ago | NetExam (netexam.com) — the website of NetExam LMS+, a US-based SaaS learning management system built for external audiences rather than internal employees. It helps companies train, certify, and enable their channel partners, customers, and association members, with features like certification tracking, self-paced and instructor-led courses, e-commerce, white-labeling, Salesforce integration, and AI-powered course authoring agents. Headquartered in Dallas, with clients including AMD, AT&T, Oracle, Trellix, and Sabre. Publication scheduled: 2026-09-09 17:06:52 UTC Size: 18.1 MB Sectors: Education, Retail, Other |
BioPharma tracker page ↗ | the gentlemenfilter this group | · 28d ago | BioPharma is a global biopharmaceutical innovator founded in 2003 and headquartered in Taiwan. It specializes in developing best-in-class therapies and biologics for blood disorders, hematologic cancers, and other serious diseases. The company is fully integrated and operates internationally with a strong commercial and clinical presence in the U.S., Europe, and Japan. |
Medical Arts Chemists and Surgicals tracker page ↗ | pearfilter this group | · 28d ago | Prescriptions and Home Medical Equipment |
Club One Casino tracker page ↗ | pearfilter this group | · 28d ago | A Place to Play Cards in Central California |
Practi-Cal tracker page ↗ | pearfilter this group | · 28d ago | Comprehensive platform to manage Medi-Cal billing, LEA BOP, and CRCS submissions efficiently |
Austin Plastic Surgery Institute tracker page ↗ | pearfilter this group | · 28d ago | A center staffed by highly skilled plastic surgeons |
ELCON MEGARAD S.p.A tracker page ↗ | titanfilter this group | · 28d ago | No details on the leak post beyond the victim name. |
KAMPH tracker page ↗ | deadlockfilter this group | · 28d ago | K&A Machmouchi Pharma Holding a leading Lebanese company in the field of pharmaceutical import, storage and distribution. https://kamph.co |
UFOC tracker page ↗ | deadlockfilter this group | · 28d ago | United Fiber Optic Communication Inc. (UFOC) is an established, publicly traded telecommunications company from Taiwan. The company acts as a total solution provider for communication networks and specializes in the manufacture of fiber optic cables and the provision of integrated technological systems. https://www.ufoc.com.tw/en/company |
P**** R***** tracker page ↗ | the gentlemenfilter this group | · 28d ago | full-service event rental company established in 1972, specializing in high-quality items and equipment for special events. They serve the Northeast and Mid-Atlantic regions along the East Coast, offering an extensive selection of furniture, linens, and decor. The company is dedicated to helping clients bring their unique event visions to life with professional customer care and design support. With its main facility in Teterboro, New Jersey, and a showroom in New York City, it remains a leading provider in the event services industry. |
Questronix tracker page ↗ | qilinfilter this group | · 28d ago | Business Services |
Provite tracker page ↗ | qilinfilter this group | · 28d ago | Business Services |
Trends And Concepts tracker page ↗ | qilinfilter this group | · 28d ago | Construction |
Capgemini Engineering tracker page ↗ | everestfilter this group | · 28d ago | 2 posts - 1h |
Grupo DT tracker page ↗ | everestfilter this group | · 28d ago | 2 posts - 1h |
Kingston Technology tracker page ↗ | everestfilter this group | · 28d ago | 2 posts - 1h |
Experts Entreprendre tracker page ↗ | everestfilter this group | · 28d ago | 2 posts - 1h |
Target tracker page ↗ | xpl0itrsfilter this group | · 29d ago | General merchandise retail |
usbank.com tracker page ↗ | lockbit5filter this group | · 29d ago | U.S. Bank is a multinational financial institution that provides banking, lending, payment, and inve... |
Grand Ion Delemen Hotel tracker page ↗ | majinahanashifilter this group | · 29d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T16:34:00Z Package: 4.0 GiB / 5045 files |
The Margo Hotel tracker page ↗ | majinahanashifilter this group | · 29d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T20:49:00Z Package: 4.6 GiB / 8080 files |
Semana tracker page ↗ | qilinfilter this group | · 29d ago | Advertising & Marketing |
Mihuru tracker page ↗ | xpl0itrsfilter this group | · 29d ago | Consumer travel financing |
Ion Delemen Hospitality tracker page ↗ | majinahanashifilter this group | · 29d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-26T16:34:00Z Package: 4.0 GiB / 5045 files |
sunsea.co.th tracker page ↗ | krybitfilter this group | · 29d ago | Sunsea Plastics P.S. Co., Ltd. is a Thai family-owned company established in 1988, headquartered in Bang Na, Bangkok, Th... |
Crowe NEW tracker page ↗ | coinbase cartelfilter this group | · 29d ago | Accounting For Legal Practices - $1.3 Billion |
Advanced Engineering Consultants NEW tracker page ↗ | coinbase cartelfilter this group | · 29d ago | Architecture, Engineering & Design - $14.8 Million |
Ericksen Krentel tracker page ↗ | akirafilter this group | · 29d ago | Ericksen Krentel CPAs and Consultants is a New Orleans-based CPA firm offering a wide range of services including tax, accounting, audit, advisory, and consulting for both businesses and individuals. Their expertise spans various industries such as construction, healthcare, hospitality, maritime, and nonprofit sectors.We will upload 30gb of corporate data soon. Detailed client and employee personal information (passports, DLs, SSNs, addresses and other information), detailed financials, confidential documents, contracts and agreements, NDAs and so on. |
Southeastern Oklahoma State University tracker page ↗ | interlockfilter this group | · 29d ago | https://www.se.edu/ Southeastern Oklahoma State University is a public, four-year university located in Durant, Oklahoma. A data breach exposed student educational records (including names, contact information, Social Security numbers, grades, enrollment data, financial aid information, disciplinary records, and medical information contained in educational records). This breach violates the Family Educational Rights and Privacy Act (FERPA), the HIPAA Privacy Rule, and students' common-law privacy rights. The breach affected employee personal data and injury information, including employee name, date of birth, date of injury, as well as Social Security number, Medicare card, and child custody/consent status. More than 90,000 student names, Social Security numbers, and student identification numbers, as well as Forms 1095-C and more than 490 documents. |
Aurora Health Management tracker page ↗ | insomniafilter this group | · 29d ago | Aurora Health Management, LLC operates a skilled nursing and rehab center in Frederick, MD. With nearly 25 years in long-term care, it improves troubled facilities through comprehensive management, programs, and Medicare/Medicaid standards. |
*********** tracker page ↗ | insomniafilter this group | · 29d ago | A private firm offering fluid system solutions for the oil, gas, chemical, and semiconductor sectors. It employs 3,600+ people across 10 factories, three tech centers, and about 100 sales and service locations in 50 different countries. |
BOMOHSA tracker page ↗ | gunrafilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Medochemie tracker page ↗ | qilinfilter this group | · 29d ago | Manufacturing |
Smart Energies tracker page ↗ | qilinfilter this group | · 29d ago | Electricity, Oil & Gas |
WIS LOGISTICS tracker page ↗ | qilinfilter this group | · 29d ago | Freight & Logistics Services |
InVentry tracker page ↗ | qilinfilter this group | · 29d ago | Software |
Philippe Hottinguer Finance tracker page ↗ | qilinfilter this group | · 29d ago | Finance |
Thrifty Building Supply tracker page ↗ | qilinfilter this group | · 29d ago | Home Improvement & Hardware Retail |
Estech tracker page ↗ | qilinfilter this group | · 29d ago | Business Services |
Constructora Jimenez tracker page ↗ | qilinfilter this group | · 29d ago | Construction |
Movitecnica tracker page ↗ | qilinfilter this group | · 29d ago | Industrial Machinery & Equipment |
www.mestojilemnice.cz tracker page ↗ | krybitfilter this group | · 29d ago | Město Jilemnice (City of Jilemnice) is the official website of the municipality of Jilemnice, a historic town located i... |
automotoresrosedal.com.ar tracker page ↗ | krybitfilter this group | · 29d ago | Rosedal Automotores S.R.L. is an Argentine company incorporated on February 18, 2004, headquartered in the Las Cañitas ... |
sipresitalia.it tracker page ↗ | krybitfilter this group | · 29d ago | S.I.P.R.E.S. SRL (Società Italiana Progetti Ricerche e Sviluppo — Italian Research and Development Projects Company) ... |
www.hsi.info tracker page ↗ | krybitfilter this group | · 29d ago | hsi personaldienste hart & schenk GmbH is a German staffing and temporary employment services company founded in Februar... |
BANGKOKCABLE tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
UNIPLASTICS.COM tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
CDGARVINLAW tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
EXEL tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Integraduanas tracker page ↗ | qilinfilter this group | · 29d ago | Freight & Logistics Services |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.