Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 156 | 401 | 401 | active | no public figure | |
| 2 | qilin | 21 | ▲7 | 115 | 359 | 359 | active | no public figure | |
| 3 | krybit | 13 | ▲12 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | ▲3 | 41 | 83 | 83 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | inc ransom | 6 | ▲2 | 39 | 109 | 109 | active | no public figure | |
| 8 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 17 | 21 | 21 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 1 | ▼2 | 14 | 31 | 31 | active | no public figure | |
| 19 | panzer | 7 | ▲4 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims178 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
AUDIT ENTITY: Ne***ox tracker page ↗ | audit teamfilter this group | · 3d ago | AUDIT ID: 42FFBFBFF9241F2E / DISCOVERY DATE: 2026-09-14 |
Alicotrans tracker page ↗ | qilinfilter this group | · 3d ago | Freight & Logistics Services |
Gilco Scaffolding tracker page ↗ | qilinfilter this group | · 3d ago | Construction |
Kimberly-Clark tracker page ↗ | shinyhuntersfilter this group | · 3d ago | This is a final warning to reach out by 16 Sep 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
CARIDRO VAL DE LOIRE tracker page ↗ | qilinfilter this group | · 3d ago | Business Services |
www.kashkha.com tracker page ↗ | krybitfilter this group | · 4d ago | Kashkha is a multinational modest fashion brand founded three decades ago in Dubai, UAE, specializing in designing, manu... |
Strad Solutions tracker page ↗ | vexyfilter this group | · 4d ago | Strad Solutions provides cloud hosting, dedicated servers, managed IT, cybersecurity, and disaster recovery services for businesses worldwide. |
Navitrans tracker page ↗ | emperadorfilter this group | · 4d ago | Navitrans is a leading Colombian distributor and service provider specializing in commercial trucks and heavy machinery, offering a comprehensive range of products and services including vehicle sales, spare parts distribution, and maintenance and repair services through a nationwide network of workshops. This post includes sensitive data about prices, financing, and other operational information. Publication scheduled: 2026-09-23 13:01:31 UTC Size: 223.2 MB Sectors: Manufacturing, Transportation |
AUDIT ENTITY: vi***in tracker page ↗ | audit teamfilter this group | · 4d ago | AUDIT ID: 5DC9129A6EA7F384 / DISCOVERY DATE: 2026-09-13 |
INCOR Group tracker page ↗ | doommageddonfilter this group | · 4d ago | upcoming | — | 0 files |
Canadian Mental Health Association tracker page ↗ | stormfilter this group | · 4d ago | Healthcare | Toronto, Ontario, Canada | The Canadian Mental Health Association provides mental health services and support. The Association offers advocacy, education, research, and services to persons experiencing mental illness throughout Canada and is headquartered in Toronto, Ontario. The company headquarters is located in 595 Montreal Road, Suite 303, Ottawa, ON K1K 4L2 Canada and 250 Dundas Street West, Suite 401, Toronto, ON, M5T 2Z5 Canada. 5K - 10K Employees | Deadline: 2026-09-20T13:21:48.000Z |
watchops.com tracker page ↗ | unsafefilter this group | · 4d ago | Revenue: $1.3 million | Views: 209 | Posted: 9/12/2026, 6:51:26 PM | Status: 4d 21h 37m 52s |
www.tiflispalace.ge tracker page ↗ | krybitfilter this group | · 4d ago | Tiflis Palace is a luxurious boutique hotel located in the heart of Tbilisi, Georgia, in the legendary place of the city... |
www.tender.mx tracker page ↗ | krybitfilter this group | · 4d ago | Tender (Carnicería Tender) is a Mexican premium butcher shop chain (carnicería) founded under the original brand Vigar... |
capricornlogistics.com tracker page ↗ | krybitfilter this group | · 4d ago | Capricorn Logistics Pvt. Ltd. is an Indian comprehensive supply chain and logistics company founded in 2001 in Mumbai, M... |
www.ibnsinatrust.com tracker page ↗ | krybitfilter this group | · 4d ago | The Ibn Sina Trust is a pioneering Bangladeshi non-profit welfare trust and major healthcare provider founded on June 30... |
lasultanahotels.com tracker page ↗ | krybitfilter this group | · 4d ago | La Sultana Hotel Group is a Moroccan luxury boutique hotel group created in the year 2000, targeting discerning traveler... |
eracm.fr tracker page ↗ | krybitfilter this group | · 4d ago | ERACM (École Régionale d'Acteurs de Cannes et Marseille) is a French non-profit association and regional drama school ... |
pss.ht tracker page ↗ | krybitfilter this group | · 4d ago | Professional Security Services S.A. (PSS) is a Haitian-owned private security services company established in 1995, head... |
www.metalware.ca tracker page ↗ | krybitfilter this group | · 4d ago | Metalware Corporation Inc. is Canada's leading industrial shelving manufacturer, founded in 1954, headquartered in Montr... |
intherpro.com tracker page ↗ | krybitfilter this group | · 4d ago | Intherpro LLC (International Thermal Insulation & Passive Fire Protection Company) is a UAE-based global leader in engin... |
meridian16.hr tracker page ↗ | krybitfilter this group | · 4d ago | Meridian 16 Business Park d.o.o. is a Croatian eco-industrial business zone developer and operator, established over the... |
www.eac-airports.com tracker page ↗ | krybitfilter this group | · 4d ago | Egyptian Airports Company (EAC) is an Egyptian state-owned public company incorporated in 2001, operating as a subsidiar... |
swadeshicipl.com tracker page ↗ | krybitfilter this group | · 4d ago | Swadeshi Civil Infrastructure Private Limited (SCIPL) is an Indian private limited company incorporated on March 11, 200... |
AUDIT ENTITY: TE***PB tracker page ↗ | audit teamfilter this group | · 4d ago | AUDIT ID: 993E2D59C377AFDE / DISCOVERY DATE: 2026-09-12 |
Axdia International tracker page ↗ | rhysidafilter this group | · 4d ago | Axdia International Axdia International is a German electronics company that brings together a wide range of modern small electronics and electric mobility products. More |
Shelco Filters tracker page ↗ | securotropfilter this group | · 5d ago | If the company does not contact us before 20/09/2026, the data will be published. |
DiamondLease tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Perimetral Oriental de Bogotá S.A.S. tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Ozel & Ozel Laws Office tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
compunnel.com tracker page ↗ | safepayfilter this group | · 5d ago | The company provides a combination of talent acquisition, IT consulting, digital engineering, artificial intelligence, cybersecurity, and workforce management services to … |
Imperial Healthcare Solutions tracker page ↗ | qilinfilter this group | · 5d ago | Healthcare Services |
Port of Tanjung Pelepas tracker page ↗ | direwolffilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Nexbex Solutions Private Limited tracker page ↗ | emperadorfilter this group | · 5d ago | Nexbex Solutions Private Limited is a technology consulting and software engineering firm incorporated in November 2023, headquartered in Malappuram, Kerala (India). Classified as an emerging private company, it operates with a paid-up capital of 10 million Indian rupees (₹10 Lakhs) and a compact team, generating estimated annual revenue of less than $1.2 million USD. Its core business focuses on computer programming, custom mobile application development (such as its corporate loyalty platforms Nexi Paints and Grace Petroleum), and digital solutions for retail automation, e-commerce, and smart lead management for growing small and medium-sized enterprises. We have access to all their databases with their clients' sensitive data, which include names, emails, phone numbers, addresses, etc. 600 MB. Domains: club7ms.com, rayssportsnetwork.com, hwzthat.com, etc. Subdomains Type staging, edmontoneagles, masc, psca, live, kkr, victoriapark, staging.victoriapark, spartans, blaze, ramblers, eagle admin.bookings-staging, backend.academy, admin.spike.booking, etc. We have the source code for all 200+ of their projects. 10 GB +. going up. Publication scheduled: 2026-09-22 13:15:18 UTC Size: 600 MB Sectors: Technology |
Tuboaços da Amazônia Ltda. tracker page ↗ | nightspirefilter this group | · 5d ago | No details on the leak post beyond the victim name. |
Medical Department Store tracker page ↗ | dragonforcefilter this group | · 5d ago | Medical Department Store in united state |
Foss Inc. tracker page ↗ | pearfilter this group | · 5d ago | Leading provider of installation, maintenance services to the energy industry |
Dustin Group tracker page ↗ | fulcrumsecfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
CO-OP URBAN BANK LTD tracker page ↗ | global secret groupfilter this group | · 6d ago | Country: India | Website: https://indialei.in/detailed-information/353561/335800GR1DJMM8YD7J14/the-gudivada-co-op-urban-bank-limited/ | Revenue: $50 Million | Industry: Bank, Finance | Employees: 25-50 | Properties: 41.3 GB (125,988 Files, 14,641 Folders) |
i2k2 Networks tracker page ↗ | vexyfilter this group | · 6d ago | i2k2 Networks Pvt. Ltd., established in 1999, is a leading Indian provider of cloud computing, web hosting, managed IT, data center, backup, disaster recovery, and DevOps solutions. With 25+ years of experience, 4,000+ customers, Tier III-compliant data centers, and 24/7 support, i2k2 delivers secure, scalable, and reliable IT solutions worldwide. |
M800 and CINNOX tracker page ↗ | beastfilter this group | · 6d ago | M800 helps businesses connect globally with virtual numbers, SMS, voice calls, CINNOX, and AI-powered call solutions. Reach and engage customers worldwide. |
Sys-kool tracker page ↗ | playfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
Grunthal Welding & Supplies tracker page ↗ | playfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
AUDIT ENTITY: ki***jp tracker page ↗ | audit teamfilter this group | · 6d ago | AUDIT ID: 9CB29482AF73366B / DISCOVERY DATE: 2026-09-09 |
AUDIT ENTITY: my***ru tracker page ↗ | audit teamfilter this group | · 6d ago | AUDIT ID: D91BED92A5A9223F / DISCOVERY DATE: 2026-09-09 |
General Santos Doctors Hospital tracker page ↗ | rhysidafilter this group | · 6d ago | General Santos Doctors Hospital 3.502.636 files, total volume ~2.44 TBPatient data (PHI) � name-tagged scans across department shares (surgical pathology, hemodialysis charts, admission records), cancer-center dossiers with PhilHealth IDs, lab quotations incl. cancer-marker tests with birth dates, PhilHealth claims monitoring, neonatal (NICU) dataStaff and professionals � accredited physicians register (cell numbers, PRC licenses, PhilHealth IDs), named payroll workbooks (incl. the affiliated diagnostic center), HR dossiers, staff passport scans, drug-test filesMoney, audit and governance � audited financial statements personally signed by chairman/treasurer/CFO with BIR stamps, balance sheet, all bank accounts across six-plus banks, internal-audit memos on (cashier discrepancies and cash shortages), SEC stockholders' minutes, payroll bank-upload batches, related-party entities on the same sharesLeadership personal data � personal cell numbers of the president, hospital administrator and board members More |
Professional Retail Services tracker page ↗ | rhysidafilter this group | · 6d ago | Professional Retail Services Owner�s documents: employee evaluations, salary rates, bonuses, job offers, family documentsCFO�s documents: client credit reports, bankruptcy records, tax documents, father�s medical records (guardianship court case)Corporate financials: owner�s personal tax return, credit application, signed checks with MICR (BNB Bank)Corporate credit cards, drug testsMedical records, employee health insuranceAnd much more More |
California School Employees Association tracker page ↗ | ransomhousefilter this group | · 6d ago | No details on the leak post beyond the victim name. |
mankatoclinic.com tracker page ↗ | chaosfilter this group | · 6d ago | The Mankato Clinic was founded Mankato, Minnesota in 1916, by five area physicians who believed that a comprehensive, multi-specialty group practice offered the best means of providing quality health care to the residents of southern Minnesota. The mission of the Mankato Clinic is to improve the hea… |
artiflexmfg.com tracker page ↗ | chaosfilter this group | · 6d ago | ArtiFlex Manufacturing LLC operates as a specialized contract manufacturer focused on delivering precision sheet metal solutions to diverse industrial sectors. The company has built its operational foundation on deep expertise in manufacturing engineering, combining technical knowledge with practica… |
jms building corporation tracker page ↗ | inc ransomfilter this group | · 6d ago | No details on the leak post beyond the victim name. |
NcbChurch tracker page ↗ | wallstreetfilter this group | · 6d ago | New Covenant Believers’ Church is a faith-based ministry focused on spiritual, emotional, and mental growth through God’s Word |
On Demand Occupational Medicine tracker page ↗ | wallstreetfilter this group | · 6d ago | On Demand Occupational Medicine provides occupational health, drug testing, workplace safety, and employee wellness services in Austintown, Ohio. |
Goldston Oil Corporation tracker page ↗ | wallstreetfilter this group | · 6d ago | Goldston Oil Corporation is a Houston-based oil and gas exploration and production company operating in Texas and Louisiana |
alphaomega-eng.com tracker page ↗ | lockbit5filter this group | · 6d ago | In 1993, Alpha Omega was established as a small engineering firm in Nazareth, Israel, by Imad Younis... |
AK Stamping tracker page ↗ | akirafilter this group | · 6d ago | AK Stamping is a leader in precision metal stamping technology, offering engineered design solutions and a complete package of manufacturing capabilities, including prototyping, tooling, andprecision stamping for various manufacturing scales.We will upload 30gb of corporate data soon. SQL and other internal files. |
Eagle Construction tracker page ↗ | akirafilter this group | · 6d ago | Eagle Construction specializes in building quality new homes across Virginia, offering a variety of communities, floor plans, and quick move-in options. Their services cater to a diverse clientele, including families and individuals looking for single-family homes, townhomes, and 55 communities.We will upload 70gb of corporate data soon. Detailed employee personal information (passports, DLs, SSNs, w-9 forms), internal confidential files, projects, clients information and so on. |
George Cameron Nash tracker page ↗ | akirafilter this group | · 6d ago | George Cameron Nash Interior Design operates showrooms in Dallas and Houston, Texas, specializing in high-end furniture and lighting. They represent a diverse range of brands, including Alexander Lamont, Chelsea Textiles, and Rubelli, offering products such as outdoor furniture, fabrics, textiles, and wall coverings.We will upload corporate data soon. Employee personal information, customer information, contracts. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.