Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
8
Accounts exposed · 30d
36.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,800 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Bihl tracker page ↗ | akirafilter this group | · 24d ago | Boustead International Heaters (BIH) is a leading global designer and supplier of thermal process equipment, including direct fired heaters, waste heat recovery units (WHRUs), and heat recovery steam generators (HRSGs).We will upload 392gb of corporate data soon. Huge amount of detailed personal employee information (passports, DLs, addresses, SSNs, death/birth certs, phones, contacts), confidential financials and agreements and contracts, client information, NDAs and so on. |
Coldfish Seafood tracker page ↗ | qilinfilter this group | · 24d ago | Food & Beverage |
Country-Wide Insurance tracker page ↗ | booba teamfilter this group | · 24d ago | Insurance Website: www.cwico.com Stolen data: 92 GB. |
www.ptesm.com tracker page ↗ | blackwaterfilter this group | · 24d ago | Sinarmas Cepsa Pte. Ltd. is a joint venture between Cepsa and Sinar Mas Group, specializing in the production and marketing of oleochemicals, particularly fatty alcohols and their derivatives |
ManagementPro tracker page ↗ | arcus mediafilter this group | · 24d ago | No details on the leak post beyond the victim name. |
Mark’Techno tracker page ↗ | arcus mediafilter this group | · 24d ago | No details on the leak post beyond the victim name. |
A&E + SMA Design tracker page ↗ | qilinfilter this group | · 24d ago | Architecture, Engineering & Design |
Federis Abogados tracker page ↗ | booba teamfilter this group | · 24d ago | Law Practice Website: www.federisabogados.com Stolen data: 61 GB. |
GTA 6: Nudist Town (Strong Nudity) tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Map Sneak Peek 1 tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Map Sneak Peek 2 tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Basketball Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Full Map tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Taser Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Hypercar Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Plane Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Junkie Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
Strip Club tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Gas tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Plane (Night) tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
resi.com tracker page ↗ | krybitfilter this group | · 24d ago | Resi is a UK-based online architectural and home renovation platform founded in 2017 by Alexandra Depledge and Jules Col... |
Westwing Group SE NEW tracker page ↗ | coinbase cartelfilter this group | · 25d ago | Furniture - $465.5 Million |
CyrusOne, LLC. tracker page ↗ | shinyhuntersfilter this group | · 25d ago | Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders - More than 182,000 rows of Customer data Extracted from the "Contacts" Salesforce Object. - Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) - Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs - Extensive physical key inventory logs, verification photos, and contractor Green Badge audits - Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics - Full CERM (Critical Environment Reliability Management) process library - Physical and information security policy suite plus governance materials - Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages - Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms)This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Hospitality Health ER (Longview) tracker page ↗ | genesisfilter this group | · 25d ago | A healthcare organization |
S.E.M.P. s.r.l. tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
adt.com tracker page ↗ | lockbit5filter this group | · 25d ago | ADT is a security company that offers security systems, cameras, alarms ad home automation services.... |
Studio BOLDRIN PAOLO tracker page ↗ | qilinfilter this group | · 25d ago | Real Estate |
Euroflora srl tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
Tecnici Associati STP tracker page ↗ | qilinfilter this group | · 25d ago | Architecture, Engineering & Design |
Aurore Development S.p.A. tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
Clear Align tracker page ↗ | qilinfilter this group | · 25d ago | Manufacturing |
Difor tracker page ↗ | qilinfilter this group | · 25d ago | Automotive Parts |
Black Cat Engineering & Construction WLL tracker page ↗ | qilinfilter this group | · 25d ago | Civil Engineering Construction |
compendiumusa.net tracker page ↗ | l groupfilter this group | · 25d ago | No details on the leak post beyond the victim name. |
FRUCASTRO SL tracker page ↗ | emperadorfilter this group | · 25d ago | Recent databases, important documents Publication scheduled: 2026-09-06 11:40:43 UTC Size: 540.1 MB Sectors: Manufacturing |
ReliaQuest, LLC tracker page ↗ | shinyhuntersfilter this group | · 25d ago | This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for informational purposes only. We do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this post. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favour by us. |
el-group tracker page ↗ | inc ransomfilter this group | · 26d ago | No details on the leak post beyond the victim name. |
Vietnam Electricity(EVNHANOI) tracker page ↗ | emperadorfilter this group | · 26d ago | Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 Size: 300GB Sectors: Government, Energy |
NovoCure Limited tracker page ↗ | shinyhuntersfilter this group | · 26d ago | This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
BOK Financial tracker page ↗ | shinyhuntersfilter this group | · 26d ago | This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Integrated Health Systems NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Business Services - $9.3 Million |
RXPE Group NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Electronics - $319 Million |
Tower Insurance NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Insurance - $283.7 Million |
Flecha Bus NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Transportation, Freight & Logistics Services - $366.3 Million |
OTEIS Conseil & Ingénierie NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Architecture, Engineering & Design - $69.8 Million |
Longhorn Investments NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Finance - $15.5 Million |
Kessler Creative NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Advertising Networks - $17.1 Million |
Klasko Immigration Law Partners NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Law Firms & Legal Services - $19.7 Million |
Patel NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Accounting For Legal Practices - $5 Million |
Abacus Advisors NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Accounting For Legal Practices - $5 Million |
LifeBank Microfinance Foundation NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Finance - $5 Million |
PT Perusahaan Jamu Air Mancur NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Pharmaceuticals & Healthcare - $100 Million |
PT. Bank Perekonomian Rakyat Bintan NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Banking & Financial Services - $5 Million |
icnavais.com tracker page ↗ | lockbit5filter this group | · 26d ago | The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special... |
Test tracker page ↗ | emperadorfilter this group | · 26d ago | test test test Size: 9.8 GB Sectors: Other |
Island Networks tracker page ↗ | pearfilter this group | · 26d ago | Provider for Business-class Internet, Cybersecurity & Home Wi-Fi |
Mogren, Glessner & Ahrens, P.S. tracker page ↗ | pearfilter this group | · 26d ago | Services in family law |
holzmarkt chemnitz tracker page ↗ | space bearsfilter this group | · 26d ago | Holzmarkt Chemnitz is a specialized retail store for building materials and wood products, operating two branches in Chemnitz (Fichtestraße and Kalkstraße). They serve as a competent partner for both professional builders and private customers.-Personal information of employees and clients -Financial documents-SQL DB https://holzmarkt-chemnitz.de/ |
Freelom tracker page ↗ | space bearsfilter this group | · 26d ago | Freelom.net s.r.o. is a Czech internet service provider and IT company based in Lomnice nad Popelkou, which has been operating since 2009 . The company's primary focus is providing wireless internet access via its own network, with services available 24 hours a day, 7 days a week.The company is led by two managing directors, Jiří Plichta and Petr Malý. A priority for Freelom.net is the speed, reliability, and quality of its services , and it aims to resolve technical issues within a maximum of 24 hours-SQL Data (All client personal data) https://freelom.cz/ |
CRI Electric tracker page ↗ | rhysidafilter this group | · 26d ago | CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts** (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms** (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.