ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen30▲6155401401activeno public figure
2qilin23▲9117361361activeno public figure
3krybit13▲13479696activeno public figure
4akira12▲6448686activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
5storm4▼36445656activeno public figure
6direwolf3▼8416262activeno public figure
7coinbase cartel0=375656activeno public figure
8inc ransom9▲536112112activeno public figure
9lockbit55▼2275353activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10audit team11▲2232525activeno public figure
11safepay10=226767activeno public figure
12leakeddata0▼4203838activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15emperador5=182222activeno public figure
16kazu0▼17171717activeno public figure
17shinyhunters2▼1153232activeno public figure
18vexy4▼5151515activeno public figure
19panzer7▲5142525activeno public figure
20black nevas1▼12141414activeno public figure
21dragonforce3▲1127171activeno public figure
22chaos4▲2123434activeno public figure
23everest0▼4123434activeno public figure
24pear1=122323activeno public figure
25rhysida3▲1121414activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents1,036 records · full details

VictimGroup / typeDiscoveredDetails
myLaurel
tracker page ↗
direwolffilter this group · 10d agoNo details on the leak post beyond the victim name.
evergenbio.com
tracker page ↗
chaosfilter this group · 10d agoEvergen is a leading Contract Development and Manufacturing Organization (CDMO) specializing in biomaterial solutions for regenerative medicine. We work closely with OEM partners to deliver customized biomaterial solutions that meet specific clinical needs
McDonalds Ecuador
tracker page ↗
vexyfilter this group · 11d agoMcDonalds Ecuador is the local franchise operation of the global McDonalds brand. The company operates fast-food restaurants across Ecuador, offering products such as burgers, fries, beverages, breakfast items, and childrens meals. It operates under the McDonalds franchise model through Arcos Dorados, the largest McDonalds franchise operator in Latin America and the Caribbean.
Mega Velocity
tracker page ↗
vexyfilter this group · 11d agoNew Delhi–based private technology company incorporated in 2013. Its registered business classification is software publishing, consultancy and supply, including software development, maintenance and web-page design. Its network records also identify MEGA VELOCITY PVT LTD as an Internet/hosting network operator.
Will the Katecho,LLC be able to handle the hack and prevent a data breach in time?
tracker page ↗
leaknetfilter this group · 11d ago#DataLeak #HIPAA #CyberSecurity #DataBreach #MedicalRecords #HealthcareSecurity #2026Breach #PublicHealth
Lider Aviacao
tracker page ↗
the gentlemenfilter this group · 11d agolideraviacao.com.br zoominfo.com/c/líder-aviação/372493800 Líder Aviação is Latin America's largest business aviation company, founded in 1958 in Belo Horizonte, Brazil, as an air taxi with a single Cessna 170. Today: ~R$1.2B revenue, 1,300+ staff, 50+ aircraft, 22 own bases; 42.5% owned by US Bristow Group, run by the founder's third generation (President: Junia Hermont). A one-stop shop: charters (first booking app in Brazil), the region's largest FBO network, aircraft sales (exclusive HondaJet dealer, 1,000+ sold), a top MRO (authorized for Bell, HondaJet, Gulfstream) and offshore helicopter ops for Petrobras since 1973 (1M+ flight hours). Key edge: safety — the only Brazilian company with IS-BAO Stage 3, plus Argus Platinum and 5× Petrobras Peotram wins. First SAF flight in Brazilian business aviation (2024), now expanding into agribusiness and electric aviation. Bottom line: a 67-year-old family giant controlling South American business aviation end-to-end.
Philippine Ports Authority
tracker page ↗
qilinfilter this group · 11d agoBusiness Services
Bauman Law Group
tracker page ↗
qilinfilter this group · 11d agoLaw Firms & Legal Services
CitizensPay
tracker page ↗
dysphor1afilter this group · 11d agoSector: Digital Wallet / Payment Platform | Country: 🇲🇲 Myanmar | Records: 30 GB | Countdown: 2d 12h 37m 53s | Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar powered by Myanmar Citizens Bank (MCB) and Capital Connect Limited. Compromised agent user information — total data size 30 GB. Price range $7,000 to $25,000. Victim domain https://ctzpay.com. | CITIZENSPAY | CitizensPay Upcoming Critical 🇲🇲 Myanmar ID_CITIZENSPAY | Detected 2026 | Target // Digital Wallet / Payment Platform Description Citizens Pay (also known as CTZPay) is a mobile digital wallet and payment platform in Myanmar powered by Myanmar Citizens Bank (MCB) and Capital Connect Limited. Compromised agent user information — total data size 30 GB. Price range $7,000 to $25,000. Victim domain https://ctzpay.com. Infection Mechanism Exposed agent user info including business license, NRC pictures (front/back), selfie, shop pictures, and phone numbers from the CTZPay agent verification pipeline. Notable Attack Full agent user info dump from Citizens Pay (CTZPay) — 30 GB including KYC documents (NRC front/back), selfies, business license, shop pictures, and phone numbers. Example Compromised Example Data Include - business_picture - nrc_picture_front - nrc_picture_back - selfie_picture - shop_picture - Ph Number Evidence Images business_license_picture.jpg nrc_picture_front.jpg nrc_picture_back.jpg selfie_picture.jpg shop_picture.jpg Download Sample Contact Us On Session Close
Jouvet SAS
tracker page ↗
qilinfilter this group · 12d agoConstruction
G&S Technologies
tracker page ↗
qilinfilter this group · 12d agoEnergy, Utilities & Waste
Nolan Consulting Group
tracker page ↗
qilinfilter this group · 12d agoBusiness Services
Colonial Hyundai
tracker page ↗
qilinfilter this group · 12d agoAutomotive Parts
The Big Table
tracker page ↗
qilinfilter this group · 12d agoHospitality
D-MAX Engineering, Inc
tracker page ↗
space bearsfilter this group · 12d agoD‑MAX Engineering, Inc. is a San Diego-based environmental consulting firm specializing in storm water services, particularly for governmental agencies. Our multidisciplinary team includes environmental scientists, engineers, chemists, and biologists. Our team is experienced with the National Pollutant Discharge Elimination System (NPDES) permit requirements in Southern California.Since 1996, when the company was founded, we have completed numerous storm water projects for 18 municipalities in San Diego, Orange, Imperial, and Riverside Counties. We have developed a reputation for practical solutions, cost-effectiveness, responsiveness, and flexibility. D-MAX is recognized across the region for our expertise in jurisdictional storm water program development and reporting, water quality monitoring, Industrial General Permit compliance assistance, development and construction services, and inspections of businesses, municipal facilities, construction sites, and treatment control BMPs.Our experience has provided us with a comprehensive understanding of complex, countywide water quality issues and the ability to effectively address them. D-MAX adapts to our clients’ needs and provides a level of quality service that sets us apart. Our diverse team of professionals, central location, and familiarity with the region allows us to provide clients with a wide variety of services at affordable rates. We are a state-certified small business enterprise (SBE).-Personal information of employees and clients -Financial documents-Сommunications drawings https://www.dmaxinc.com/
Metrea LLC/Commuter Air Technology, Inc.
tracker page ↗
aurorafilter this group · 12d agoMetrea LLC (formerly Meta Special Aerospace, LLC) and its subsidiary Commuter Air Technology, Inc. (CAT) are US defense contractors providing Contractor Owned, Contractor Operated (COCO) ISR aircraft services to US Special Operations Command. They operate modified King Air 350 surveillance aircraft in Niger, East Africa, the Philippines, and other theaters. 339 MB of Harris PRC-117G military tactical radio firmware including compiled waveform binaries for SINCGARS, HAVEQUICK II, ROVER, and 10 other ITAR-controlled waveforms (USML Category XI). Named deployment data for 14+ operators at Sable Spear sites in Niger and East Africa, with rotation schedules, SIPRNet access documentation, and divert airfield planning. Complete SOCOM contract pricing portfolios — labor rates, burn rates, TINA-certified cost data, and subcontractor pricing for SOCPAC C3PO, Sable Spear, and Sable Dagger programs. 232 employee personnel files including resumes, W-9 forms (SSN), SERE training certificates, security clearances, expense reports, and deployment records. NSWDG (SEAL Team Six), MARSOC, and 75th Rangers training exercise documentation — 37 separately funded SOCOM training deliveries under the Alpha 28 program.
Hochschule Heilbronn Bildungscampus
tracker page ↗
panzerfilter this group · 12d agoAStA Hochschule Heilbronn is the general students' committee that represents student interests both within and outside the university in Heilbronn. The organization serves as a spokesperson for the student body and provides a variety of support services, including legal and tax counseling, a grievance box, and laptop rentals. Additionally, the committee organizes numerous events and manages the university sports program. It operates as a central point of contact for students facing problems and coordinates with various student parliaments and faculty representatives.
Judicial Branch of the Province of Jujuy
tracker page ↗
emperadorfilter this group · 12d agoThe official website of the Judicial Branch of Jujuy, Argentina. It provides court information, digital case management, mediation services, legal rulings, and judicial news for legal professionals and the public. Now i have your wordpress databases, login credentials to internal systems(thanks to marcos :)), as well as your email credentials Respond to us, pay the ransom.(Check your emails & check spam as well.) OR email me at : [email protected] for instructions Publication scheduled: 2026-09-19 02:16:35 UTC Size: 4.2 GB Sectors: Government, Law
Zdrowit
tracker page ↗
the gentlemenfilter this group · 12d agokarierazdrowit.pl zoominfo.com/c/zdrowit/535531700 Zdrowit S.A. is a family-owned Polish pharmacy chain with 100% Polish capital, operating since 2004 and headquartered in Bytom, Silesia, with over 1,000 employees across 40+ cities in southern and central Poland, aiming to become the largest pharmacy network in the region. The business is growing extremely fast, with 2024 net sales revenue up +83.5%, though its net profit margin fell 10.3% due to the costs of rapid expansion. The company is structured as a holding: individual pharmacies operate as separate Sp. z o.o. entities under Zdrowit S.A., which is registered under KRS 0000704305 with a share capital of 1,197,432.00 PLN. Its core workforce consists of pharmacists and pharmacy technicians hired across dozens of locations, supported by a small modern HQ team in Bytom covering data, IT, controlling and marketing. A key strength is its internship pipeline, offering a 2-year program for technicians and a 6-month program for pharmacis
Veradigm
tracker page ↗
the gentlemenfilter this group · 12d agoveradigm.com zoominfo.com/c/veradigm-llc/471134180 3.5+ million personal patient records with PII full name, address, social security number, email, address, phone number,guarantors PII ,Score Veradigm Inc. is a publicly traded American healthcare technology and data analytics company (OTC: MDRX), the former Allscripts, founded in 1986 and renamed Veradigm in January 2023, headquartered in Chicago with about 2,300–2,600 employees. Its core asset is one of the largest multi-EHR data networks in US healthcare — over 450,000 connected providers and 200M+ patient records — which it monetizes through three segments: Provider (EHR, practice management, revenue cycle: $473M in 2024), Payer (quality and risk adjustment analytics: $67.3M) and Life Sciences (real-world data and AI-driven evidence: $54M).
Wolfram Research
tracker page ↗
direwolffilter this group · 12d agoNo details on the leak post beyond the victim name.
Sports Endeavors
tracker page ↗
space bearsfilter this group · 12d agoSports Endeavors is a North Carolina company founded in 1984 by brothers Mike and Brendan Moylan. It owns Soccer.com, WorldSoccerShop, and 431 Sports, selling uniforms, gear, and apparel for soccer, baseball, softball, and volleyball to teams, players, and fans. The company is known for a large selection from brands such as Nike, adidas, and Puma, plus custom team uniforms. In April 2026 it was acquired by Varsity Brands / BSN SPORTS. https://www.sportsendeavors.com/
MBT Telecom
tracker page ↗
dysphor1afilter this group · 12d agoFor Sale: New | Sector: Telecommunications / ISP | Country: 🇲🇲 Myanmar | Records: 209,970 user records — full dump | Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommunications network solutions company established in Myanmar in 2013. Full database compromise exposing 209,970 user records including PII, passwords, and device information. | For Sale | MBT Telecom For Sale Critical 🇲🇲 Myanmar ID_MBT-TELECOM | Detected 2026 | Target // Telecommunications / ISP Description Myanmar Broadband Telecom Co., Ltd. (MBT) is a leading fiber internet service provider and telecommunications network solutions company established in Myanmar in 2013. Full database compromise exposing 209,970 user records including PII, passwords, and device information. Infection Mechanism Compromised MBT customer database exposing user PII, passwords, device types, and account metadata from their FTTH, DIA, and enterprise VPN services. Notable Attack Full user dump of 209,970 MBT Telecom customer records including names, phone numbers, passwords, and device information. Example Compromised Full DB Access — 209,970 User Records id,name,phone,created_at,user_status,uniq_id,address,new_pass,device_type 225425,Phyo Wai Hein,09975578724,2026-09-04T09:03:45.000000Z,Normal,937064,,25809672, 225424,Ma Zar Zar,09776411439,2026-09-04T08:54:23.000000Z,Normal,386819,,444555, 225423,Arr Li,09973900796,2026-09-04T08:48:46.000000Z,Normal,4973,,mml19894, 225422,umyintthein,0943051152,2026-09-04T08:37:52.000000Z,Normal,856710,,123456, 225421,Ma Ei Thandarbo,09773450715,2026-09-04T08:33:53.000000Z,Normal,582959,,064071, 225420,Daw Aye Kyi Kyi Myint,09952295522,2026-09-04T08:32:43.000000Z,Normal,771678,,123456, 225419,Nan Phawy,09772111156,2026-09-04T08:31:36.000000Z,Normal,352373,,123456, 225418,U Soe Lwin,09941258904,2026-09-04T08:30:57.000000Z,Normal,101282,,12345678, 225417,Aung Kyaw Htun,09402695665,2026-09-04T08:28:35.000000Z,Normal,151460,,ak025846…
Sancity Soft Touch
tracker page ↗
vexyfilter this group · 12d agoIT services company providing web design & development, software/application development, payment gateway services, digital marketing, mobile applications, software testing and cloud-related services.
kalahealth.eu
tracker page ↗
lockbit5filter this group · 12d agoKALA Health is an international manufacturing and distribution company of nutraceutical health produ...
huisartsencentrumkleiniterson.nl
tracker page ↗
lockbit5filter this group · 12d agoHuisartsencentrum Klein Iterson is a Healthcare Services provider operating in the primary medical c...
Negotiation Rules
tracker page ↗
everestfilter this group · 12d ago1 posts - 1h
Palsana Enviro (PEPL)
tracker page ↗
vexyfilter this group · 12d agoEnvironmental services company operating a Common Effluent Treatment Plant (CETP) for textile-processing industries. PEPL collects, treats and disposes of industrial wastewater and also recycles treated water for member industries. Its current stated treatment capacity is 150 MLD, with 50 MLD recycling capacity.
Annapurna Fashion
tracker page ↗
vexyfilter this group · 12d agoManufacturer, supplier and exporter/distributor of fabrics and apparel-related products, including cotton fabrics, shirting, suiting, jacquard, sherwani fabrics, uniforms, ladies' tops and readymade garments
Stransky Heiz-Mess-Regeltechnik GmbH
tracker page ↗
akirafilter this group · 12d agoDiscover Stransky—a leader in sustainable energy solutions. Trust in over 30 years of experience in heating technology and quality.We will upload 50gb of corporate data soon. Employee personal information, contacts and agreements, financials, projects, NDAs and so on.
SouthernCarlson
tracker page ↗
tridentlockerfilter this group · 12d agoNo details on the leak post beyond the victim name.
Note to mr. databroker1 NEXUS DL Service
tracker page ↗
shinyhuntersfilter this group · 12d agoWe've been trying to get ahold of you. We've made you several large offers for the data you possess (DL data). We don't believe you've seen them. I think you will appreciate the numbers we have to offer you in return for the data you possess. What we are willing to offer you can be considered a payment as large as what you would get paid in a ransom. Reply to the DMs we are sending you on forum or simply contact [email protected]
AP CAPITAL PARTNERS LIMITED
tracker page ↗
qilinfilter this group · 12d agoBusiness Services
Worrell
tracker page ↗
akirafilter this group · 12d agoWorrell Corporation is a family-owned business based in Indianapolis that specializes in promotional products, marketing, and print services. They assist clients in finding impactful promotional items while offering tailored marketing strategies and webstore solutions.We will upload 45gb of corporate data soon. Employee and client information, contacts and agreements, financials, projects and so on.
EDIF S.p.A.
tracker page ↗
aurorafilter this group · 13d agoEDIF S.p.A. is an Italian wholesale distributor of electrical equipment, plumbing, and lighting systems. The exposed files include passwords for company systems, customer file transfers, certified email and warehouse devices. Copies appear in source code, setup packages and old folders. Customer and employee information is also exposed: invoices, tax numbers, addresses, phone lists, shipment details, computer-profile artifacts and records about CCTV or recorder password resets. The dataset contains internal software, databases, commercial records, legal/tax folders and a detailed 2024 financial report.
pscindustries.com
tracker page ↗
lockbit5filter this group · 13d agoFor over 60 years, PSC Industries has been the number 1 supplier of nsulation, gasketing, seals, adh...
Commission de la construction du Quebec (CCQ)
tracker page ↗
qilinfilter this group · 13d agoGovernment
Kovo Healthtech Corp
tracker page ↗
pearfilter this group · 13d agoVersatile technology company leading the Charge in AI process automation initiatives to drive Impact and innovation across diverse industries
Homewood Sales
tracker page ↗
dragonforcefilter this group · 13d agoHomewood Sales Corporation specializes in equipment life extension solutions, offering a wide range of products including automatic voltage regulators, control ...
Norwood Law Firm
tracker page ↗
dragonforcefilter this group · 13d agoNorwood Law is a Tulsa-based legal firm that specializes in personal injury law, criminal defense, business law, and family law. Founded by attorney Joe Norwood...
AUDIT ENTITY: mansurovogroup
tracker page ↗
audit teamfilter this group · 13d agoAUDIT ID: DA68891EA2CD44B6 / DISCOVERY DATE: 2026-08-26
AUDIT ENTITY: PIT.local
tracker page ↗
audit teamfilter this group · 13d agoAUDIT ID: 3382542458FC4332 / DISCOVERY DATE: 2026-08-27
Studio Oculistico Ciraci
tracker page ↗
space bearsfilter this group · 13d agoStudio Oculistico Ciraci - ophthalmology clinic based in Bari, Italy, that opened in 1989 as a center accredited with the Italian National Health Service (SSN). With more than two decades of experience, it focuses on the prevention and treatment of major eye conditions using modern diagnostic technologies. Its main areas of expertise include glaucoma, vitreoretinal diseases (especially maculopathies), correction of refractive errors (Excimer laser PRK and cataract surgery), strabismus, keratoconus, and the renewal of special driving licenses. The clinic is run by specialists Dr. Giuseppe Ciraci and Dr.ssa Lorenza Ciraci and emphasizes high-quality, safe care supported by a professional team. https://www.oculisticaciraci.it/
Schwartz, Giannini, Lantsberger & Adamson (SGLA)
tracker page ↗
space bearsfilter this group · 13d agoSchwartz, Giannini, Lantsberger & Adamson (SGLA) Accountancy Corporation is a full-service certified public accounting firm based in Stockton, California, founded in 1988. The firm provides tax planning and compliance, audits, reviews and compilations, bookkeeping, payroll, outsourced CFO support, and business consulting for individuals and companies. It has particular experience with real estate, healthcare, nonprofits, affordable housing, common-interest realty associations, and local government clients. SGLA positions itself as a hands-on local CPA practice that combines traditional accounting work with practical advice to help clients stay compliant and grow. https://www.sglacpas.com/
P... S...
tracker page ↗
leakeddatafilter this group · 13d agoTo be announced...
A...en
tracker page ↗
leakeddatafilter this group · 13d agoTo be announced...
myglobal.com
tracker page ↗
inc ransomfilter this group · 13d agoNo details on the leak post beyond the victim name.
Se...
tracker page ↗
leakeddatafilter this group · 13d agoTo be announced...
Katten Muchin Rosenman
tracker page ↗
leakeddatafilter this group · 13d agoTo be announced...
America’s Food Basket
tracker page ↗
wallstreetfilter this group · 13d agoAmerica’s Food Basket is a U.S. cooperative grocery-store network. Its site, afbasket.com, provides store locations, weekly ads, online shopping, delivery, recipes, and job listings. It operates under the America’s Food Basket and Ideal Food Basket names.
Maglin, Miskiv & Associates
tracker page ↗
insomniafilter this group · 13d agoMaglin Miskiv & Associates in Parsippany, NJ offers personalized accounting, tax planning, bookkeeping, payroll, financial consulting, tax prep, and audit support for individuals and businesses.
Dinas Komunikasi dan Informatika
tracker page ↗
panzerfilter this group · 14d agoThe Central Java Province Communication and Informatics Service was formed based on Central Java Provincial Regulation Number 9 of 2016 concerning the Formation and Composition of Central Java Province Regional Apparatuses and Central Java Governor Regulation Number 70 of 2016 concerning the Organization and Work Procedure of the Central Java Province Communication and Informatics Office. As for the duties of the Central Java Province Communication and Informatics Office, it is to assist the Governor in carrying out government affairs in the communications and informatics sector, the coding sector, and the statistics sector which are the authority of the Regions and the assistance tasks assigned to the Regions.
ligacancerguate.org
tracker page ↗
krybitfilter this group · 14d agoINCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S. is Guatemala's premier private cancer treatmen...
McDonald's Ecuador
tracker page ↗
vexyfilter this group · 14d agoMcDonald's Ecuador is the local franchise operation of the global McDonald's brand. The company operates fast-food restaurants across Ecuador, offering products such as burgers, fries, beverages, breakfast items, and children's meals. It operates under the McDonald's franchise model through Arcos Dorados, the largest McDonald's franchise operator in Latin America and the Caribbean.
EdgeChem Jamaica Limited
tracker page ↗
pearfilter this group · 14d agoManufacture Automotive, Industrial, Decorative and Furniture Coatings, and distribute associated products
incan.org.gt
tracker page ↗
krybitfilter this group · 14d agoINCAN — Instituto de Cancerología y Hospital Dr. Bernardo del Valle S. is Guatemala's premier private cancer treatmen...
Engefitas
tracker page ↗
vexyfilter this group · 14d agoEngefitas is a Brazilian company that produces various adhesive tapes and adhesives for industries like packaging, automotive, construction, electronic, and manufacturing sectors.
Complete Packaging Solutions
tracker page ↗
qilinfilter this group · 14d agoBusiness Services
Greenberg Traurig
tracker page ↗
leakeddatafilter this group · 14d agoTo be announced...
Tanner
tracker page ↗
qilinfilter this group · 14d agoFinance

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.