Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 116 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲11 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼6 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▼1 | 12 | 24 | 24 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims178 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
STP Fashion Lab tracker page ↗ | vexyfilter this group | · 1h ago | stpfashionlab.it is the website of STP Fashion Lab, a Tuscan company that has specialized in making Made in Italy womenswear for over twenty years. It produces the FRIVOLITÉ brand, founded in 2019, which targets independent, sensitive, and playful women. |
hygear.com tracker page ↗ | lockbit5filter this group | · 4h ago | yGear specializes in providing reliable and affordable on-site and on-demand hydrogen and industrial... |
Optimum First Mortgage (Pear's acting group's promotional blog) tracker page ↗ | black nevasfilter this group | · 12h ago | No details on the leak post beyond the victim name. |
Namibian Defence Force tracker page ↗ | ransomhousefilter this group | · 13h ago | No details on the leak post beyond the victim name. |
AUDIT ENTITY: palletshop tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: 13FE12E3FD98828D / DISCOVERY DATE: 2026-09-08 |
AUDIT ENTITY: Wise IT tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: 2567E8139A6D7753 / DISCOVERY DATE: 2026-09-08 |
AUDIT ENTITY: buben tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: 3A8CF838E9FD17A1 / DISCOVERY DATE: 2026-09-08 |
AUDIT ENTITY: dg.ac.kr tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: 4FEC5C192A8A6AC3 / DISCOVERY DATE: 2026-09-08 |
AUDIT ENTITY: gownet.net tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: D4AF665C36E15B6C / DISCOVERY DATE: 2026-09-08 |
AUDIT ENTITY: krimax.org tracker page ↗ | audit teamfilter this group | · 17h ago | AUDIT ID: FFFEE8E6DD3445AD / DISCOVERY DATE: 2026-09-08 |
RDA MOTORS S.P.A. tracker page ↗ | emperadorfilter this group | · 18h ago | is an Italian company engaged in premium cars. There are many customer documents and employee data Publication scheduled: 2026-09-26 20:26:23 UTC Size: 7.3 GB Sectors: Technology, Other |
Leisure Coast Kitchens tracker page ↗ | kairosfilter this group | · 18h ago | Leisure Coast Kitchens specializes in designing and installing high-quality bespoke kitchens, laundries, and bathrooms tailored to individual styles and needs. They offer a full range of services including custom cabinetry, benchtops, and renovation solutions, ensuring a personalized approach for each project. The company is dedicated to helping homeowners create functional and beautiful spaces, believing that everyone deserves a dream kitchen. With competitive pricing and expert advice, they aim to transform homes into enjoyable and inspiring environments. |
Odyssey Charter School, Inc. tracker page ↗ | wallstreetfilter this group | · 19h ago | Odyssey Charter School, Inc. is a nonprofit organization operating tuition-free public charter schools in Florida for students from preschool through 12th grade, with a focus on academic achievement and whole-child development. |
Roshd Sanat tracker page ↗ | wallstreetfilter this group | · 19h ago | Roshd Sanat is an Iranian industrial company providing engineering, manufacturing, and technical services, with a focus on industrial and energy-sector projects. |
Reddrop Group tracker page ↗ | qilinfilter this group | · 19h ago | Grocery Retail |
In The Company of Huskies tracker page ↗ | qilinfilter this group | · 19h ago | Advertising & Marketing |
SEVENOAKS s.r.o. tracker page ↗ | emperadorfilter this group | · 20h ago | Sevenoaks, S.R.O. is an enterprise based in Czech Republic. Its main office is in Prague. The company operates in the Computer Systems Design and Related Services industry. Publication scheduled: 2026-09-26 17:48:54 UTC Size: 3.3 GB Sectors: Technology, Other |
Partners Financial Services, a.s. tracker page ↗ | inc ransomfilter this group | · 20h ago | Date: September 2026 Target: Partners Financial Services, a.s. (IČO: 27699781) Location: Prague, Czech Republic Industry: Financial Services / Banking / Insurance |
Thorndale Foundation tracker page ↗ | qilinfilter this group | · 20h ago | Non-Profit & Charitable Organizations |
aidon.com tracker page ↗ | inc ransomfilter this group | · 20h ago | Aidon Oy / Gridspertise (Enel Group) — Smart Meter Operations Platform Breach Date: September 2026 Sector: Critical Infrastructure — Energy / Smart Grid Country: Finland Parent Company: Gridspertise S.r.l. (joint venture: Enel Group + CVC Capital Partners) |
Manders tracker page ↗ | akirafilter this group | · 20h ago | Manders Companies is a family-owned contractor based in the Washington Metropolitan Area, recognized for its full-service maintenance, renovation support, and painting services for multi-family, commercial, and residential properties.We will upload 70gb of corporate data soon. Employee personal information (SSN numbers, passports, DLs), financials, confidential clients files, contracts and agreements, NDAs and so on. |
Blossomland Accounting tracker page ↗ | akirafilter this group | · 20h ago | Blossomland Accounting LLC provides a range of accounting services including tax preparation and planning, payroll services, and consulting in Southwest Michigan. The company focuses on developing long-term relationships with clients, offering personalized services tailored to their unique financial needs.We will upload 12gb of corporate data soon. Employee personal information (SSN numbers, passports, DLs, death certs), financials, confidential clients files, credit card details, projects, contracts and agreements and so on. |
Bee Maid Honey tracker page ↗ | akirafilter this group | · 20h ago | Bee Maid Honey Limited is the marketing arm of the Alberta Honey Producers Cooperative Limited and the Manitoba Cooperative Honey Producers Limited. Honey produced by beekeepers in western Canada is processed and packaged at Bee Maid's Winnipeg, MB and Spruce Grove, AB plants.We will upload 46gb of corporate data soon. Employee personal information (passports numbers, DLs, death certs and other HR files), financials, confidential internal files, projects, contracts and agreements, NDA and so on. |
Zito Marketi tracker page ↗ | inc ransomfilter this group | · 20h ago | In the retail industry, there is a persistent myth that to scale nationally, a brand must inevitably shed its local soul. The prevailing logic dictates that as a chain expands, the neighborhood warmth of its origins is replaced by sterile corporate efficiency, and the familiar faces behind the counter are swapped for standardized kiosks. But in North Macedonia, a retail network that now spans dozens of towns and employs over 850 people is quietly dismantling that assumption. They are proving that the secret to dominating a national market might just be remembering exactly what it feels like to run a single corner store. |
City of Princeton tracker page ↗ | inc ransomfilter this group | · 20h ago | Date added: September 2026 Website: princetontx.us Sector: Government / Municipal Administration Location: Collin County, Texas, USA (Dallas-Fort Worth Metroplex) Employees: ~150+ Annual Budget: $30–50M |
Chicago History Museum tracker page ↗ | inc ransomfilter this group | · 20h ago | Organization: Chicago History Museum (formerly Chicago Historical Society) Location: 1601 N Clark Street, Chicago, IL 60614 Website: chicagohistory.org CEO: Michael J. Anderson, President & CEO Industry: Non-profit / Cultural Institution Breach Date: September 2026 Data Volume: 4 departments + AWS cloud infrastructure, 15+ years of records Individuals Affected: 20,000+ |
Thema Foundries tracker page ↗ | qilinfilter this group | · 21h ago | Business Services |
ARDA tracker page ↗ | arcus mediafilter this group | · 21h ago | No details on the leak post beyond the victim name. |
Nielsen Design tracker page ↗ | panzerfilter this group | · 22h ago | Helmar Nielsen dreamed of a frame that was accessible, precise, and above all, industrially reproducible, without sacrificing elegance. This was the birth of a concept that, a few years later, would forever change the perception of framing. |
Aarsleff tracker page ↗ | qilinfilter this group | · 1d ago | Construction |
Community Property Management tracker page ↗ | dragonforcefilter this group | · 1d ago | full data 200 GB+ We have been in business since 1978 as a management firm specializing in the management of common interest developments including condominiu... |
Owen Leigh Optometry tracker page ↗ | dragonforcefilter this group | · 1d ago | Full DATA 400 GB+ The brain uses the eyes to gather information about our surroundings. The brain cannot process all our view so it must first decide what to l... |
Hashimoto Jimuki tracker page ↗ | vexyfilter this group | · 1d ago | Japanese company providing office equipment, IT equipment and services, office furniture, meeting/conferencing systems, and computer support. |
marlinhvac.com tracker page ↗ | safepayfilter this group | · 1d ago | Founded in 1989 by Michael and Richard Pellino, the company has developed more than three decades of experience in mechanical … |
neumerkel-gmbh.de tracker page ↗ | safepayfilter this group | · 1d ago | The business traces its origins to 1963 and has operated under the Neumerkel GmbH name since 1994. Its product portfolio … |
triniticaring.org tracker page ↗ | safepayfilter this group | · 1d ago | The organization is jointly owned by Guardian Angels Senior Services of Elk River and Cassia, an Augustana/Elim affiliation. Its headquarters … |
laconcepcion.com.mx tracker page ↗ | safepayfilter this group | · 1d ago | The organization identifies itself as one of the principal private healthcare providers in the region and serves patients from Coahuila … |
meterex.com tracker page ↗ | safepayfilter this group | · 1d ago | The company is headquartered in Langenfeld, North Rhine-Westphalia, and is legally registered as Karl Kuntze (GmbH & Co.), HRA 16336 … |
stoecklin-kuechen.ch tracker page ↗ | safepayfilter this group | · 1d ago | The company is based in Aesch near Basel and has developed from a traditional carpentry business founded by Ernst Stöcklin … |
ryomo.co.jp tracker page ↗ | safepayfilter this group | · 1d ago | Established in January 1970 as a regional computer-services center, the company has developed into a publicly listed systems integrator providing … |
ara-lyss.ch tracker page ↗ | safepayfilter this group | · 1d ago | Its headquarters and main wastewater-treatment facility are located at Industriering 28 in Lyss. The organization also operates the ARA Messen … |
gob.pe tracker page ↗ | safepayfilter this group | · 1d ago | It serves as the country's primary online point of contact between public institutions and citizens, providing government information, administrative procedures, … |
Springfield Public Schools tracker page ↗ | interlockfilter this group | · 1d ago | https://www.springfieldpublicschools.com/ Springfield Public Schools in Springfield, Massachusetts, is the third-largest school district in the state, with over 23,500 students and over 4,200 full-time employees. The school budget accounts for more than two-thirds of the city's total budget, which is approximately $700 million. Yet, they fail to ensure student safety and do nothing to address this problem. As a result, their negligence has led to a major breach of student and employee data. Extensive student databases are now available, containing last name, first name, student number, enrollment status, grade level, home address, home phone number, and ethnicity. You also have access to more than 10,000 company contacts, incident databases, phone records, and medical information. This raises the question: where are the allocated funds going? Why aren't they keeping their students safe? |
Wiggins, Childs, Pantazis, Fisher, & Goldfarb LLC tracker page ↗ | insomniafilter this group | · 1d ago | Large U.S. plaintiffs firm with Alabama, D.C., and Florida offices. Since 1985, it’s been known for excellence in discrimination, consumer protection, and employment law, leading class actions that advance protections for victims. |
Honda (Peru) tracker page ↗ | panzerfilter this group | · 1d ago | Honda is a global automotive and motorcycle manufacturer founded in 1948 by Soichiro Honda and Takeo Fujisawa. The company offers a wide range of products including automobiles, motorcycles, and power products, catering to clients across various regions including Japan, North America, Europe, and Asia. Honda is committed to social responsibility and environmental conservation, reflecting its philosophy of coexistence with the products it creates. The company's leadership and innovative spirit have been key to its success and expansion in the global market. |
[DISCLOSED] California School Employees Association tracker page ↗ | ransomhousefilter this group | · 1d ago | No details on the leak post beyond the victim name. |
City of Fort Smith Arkansas tracker page ↗ | interlockfilter this group | · 1d ago | https://www.fortsmithar.gov/ The City of Fort Smith is committed to providing high-quality, resident-focused services to foster a thriving community. This is how they try to position themselves, but in reality, they are very negligent towards their residents and organizations within the city due to their negligent attitude towards security and lack of desire to solve problems, were compromised resulting in a major leak of confidential data over 5.6 TB of data, which includes key infrastructure facilities of Fort Smith (Public Safety System: Police Station, Fire Department, Communications Center (responsible for the 911 emergency dispatch service), Water System: including numerous water and sewer treatment plants, Information Systems: computer systems and networks that support the operation of various departments of the city). As a result of a major leak of the city, you are provided with databases and documents of all their structures (Police and Crime Information: The Arkansas Crime Information Center and the FBI Criminal Justice Information Service system are available information on license plates and driver's licenses, Confidential law enforcement data, such as personally identifiable information (PII), such as Names, addresses, and phone numbers of residents.) More than 100,000 SSNs, reports and police station files with photos from the reports, as well as software used by cyberpolice to work with phone data, as well as reports and dumps of people's phones, and most importantly, their data on the water supply system and a complete database of 911 calls and incidents. |
Cumar Marble & Granite tracker page ↗ | dark projectfilter this group | · 1d ago | Cumar Marble & Granite, a company specializing in luxury kitchens, bathrooms, and custom projects, has been the target of a massive cyberattack. Hackers stole 489 gigabytes of data from the company’s servers, including personal information, technical drawings, and financial documents. This incident raises serious concerns regarding the theft of intellectual property and potential breaches of employee and customer privacy. |
Asada Sarapiqu tracker page ↗ | arcus mediafilter this group | · 1d ago | No details on the leak post beyond the victim name. |
Southern California Telephone Company tracker page ↗ | akirafilter this group | · 1d ago | Southern California Telephone Company (SCTC) is a dynamic telecom provider with over 30 years of experience, offering a comprehensive range of services for both residential and business clients. Their product lineup includes high-speed internet, mobility solutions, virtual fax services, and VoIP offerings, catering to various connectivity needs.We will upload 34gb of corporate data soon. Employee personal information (passports, w-9s and so on), customer information (phone numbers and other sensitive information), contracts and agreements, NDAs, confidential certificates and so on. |
Lazyboyz tracker page ↗ | akirafilter this group | · 1d ago | Lazy Boyz - Harley-Davidson Oslo specializes in motorcycles and workshop services, particularlyfor Harley-Davidson and Royal Enfield, with over 30 years of experience. They offer a wide range of new and used motorcycles, as well as comprehensive services including repairs, customizations, and parts supply.We will upload corporate data soon. Employee personal information, financials, contracts and agreements and so on. |
Pilot Precision tracker page ↗ | akirafilter this group | · 1d ago | Pilot Precision Products specializes in industrial broaches, cutting tools, milling, drilling, and turning for machining operations. They offer a diverse array of products including CNC indexable broaching, solid carbide drills, and various types of milling tools.We will upload 30gb of corporate data soon. Employee personal information (SSN numbers, names, addresses and so on), detailed financials, lots of projects info, contracts and agreements, customers, partners and so on. |
Montana Civil Contractors tracker page ↗ | qilinfilter this group | · 1d ago | Civil Engineering Construction |
Taurus Ibérica tracker page ↗ | qilinfilter this group | · 1d ago | Real Estate |
ADM tracker page ↗ | qilinfilter this group | · 1d ago | Food & Beverage |
Resolve Law Group tracker page ↗ | qilinfilter this group | · 1d ago | Law Firms & Legal Services |
Incrys tracker page ↗ | qilinfilter this group | · 2d ago | Business Services |
Bravo Group tracker page ↗ | qilinfilter this group | · 2d ago | Freight & Logistics Services |
veritiv tracker page ↗ | iah647filter this group | · 2d ago | size: 1.9 TiB | status: soon | hosting: 2d 14h left |
Geieg tracker page ↗ | qilinfilter this group | · 2d ago | Fitness & Dance Facilities |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.