Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
183
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | = | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,805 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
FiferFox Minecraft Server tracker page ↗ | bluewhalefilter this group | · Aug 14, 2026 | Minecraft Server • 10000 • 3 This is a basic Minecraft Server. |
Satellite Developer Server tracker page ↗ | bluewhalefilter this group | · Aug 14, 2026 | Developer • 20000 • 5 A software developer at a company |
Connell Enterprises LLC tracker page ↗ | interlockfilter this group | · Aug 14, 2026 | He performs system administration for domain networks but is unable to ensure his own security. As a result, his data was compromised, and he was caught distributing pornographic content, storing over 200 terabytes of pornographic data on his network-attached storage (NAS). He administers pornographic websites and publishes content there, creates content featuring real people and sells it for money, and engages in blackmail by generating pornographic content using artificial intelligence. He finds victims and demands money from them. Various victims, including minors, as well as prominent public figures and political figures, including President Donald Trump, have been discovered in his computer files. Law enforcement is advised to pay attention to this individual as he is a sexual predator and distributor of pornography. You can view his directory structure, browser profiles, and saved HTML pages, where you can read his 4chan correspondence and much more. |
cambrialawfirm.com tracker page ↗ | inc ransomfilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
https://pacific-construction.com/ tracker page ↗ | inc ransomfilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
Turner and Townsend NEW tracker page ↗ | coinbase cartelfilter this group | · Aug 14, 2026 | Engineering - $1,6 Billion |
Serruya private equity NEW tracker page ↗ | coinbase cartelfilter this group | · Aug 14, 2026 | Finance - $20 Million |
Sweet Water Holdings NEW tracker page ↗ | coinbase cartelfilter this group | · Aug 14, 2026 | Finance - Undisclosed |
Keystops tracker page ↗ | akirafilter this group | · Aug 14, 2026 | Key Oil Company is the largest distributor of branded motor fuels for Marathon Petroleum Company and also holds contracts with major brands like ExxonMobil and ConocoPhillips. They provide awide range of products including lubricants, diesel exhaust fluid, antifreeze, and various fuel delivery solutions.We will upload 15gb corporate data soon. Employee and client personal information (NAME, PASSPORT, DL, SSN and so on), financials, payment details, contracts and agreements and so on. |
Cozad Asset Management tracker page ↗ | akirafilter this group | · Aug 14, 2026 | Cozad Asset Management, Inc. provides the highest quality professional and personalized financial services and advice to individuals, families and institutional investors throughout the country.We will upload 13gb corporate data soon. Employee personal information (passport, DLs, SSN), financials, confidential files, contracts and agreements, legal files and so on. |
Connections tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Hospitality |
Pierce Township tracker page ↗ | rhysidafilter this group | · Aug 14, 2026 | Pierce Township Pierce Township is a growing community in Ohio that blends rural charm with suburban living, covering 23.5 square miles and home to over 16,000 residents.We are pleased to present:Judicial materials - Grand Jury subpoena response incl. hospital records (Mercy Hospital), public records requests, fire investigation reportsEmployee PII - Social Security numbers (SSA-1945, W-4, Ohio Tax forms), CDL licenses, health insurance waivers, new-hire packetsLegal settlements - Logan Creek v. Pierce Township, Purdue opioid settlement, easement and lease agreementsFinancial records - budgets, tax levies, appropriation reports, invoices, paymentsInternal email archives of township officials and administration More |
[DISCLOSED]PCL Holding tracker page ↗ | ransomhousefilter this group | · Aug 14, 2026 | No details on the leak post beyond the victim name. |
tecnoabi.com tracker page ↗ | m3rxfilter this group | · Aug 14, 2026 | Tecnologías de Código Abierto S.L., trading as Tecnoabi, is a Málaga, Spain-based B2B software development firm registered in 2008 that specializes in Java, .NET, and proprietary solutions such as VirtRoom and CMMS software. Located in Málaga TechPark, the company maintains extensive expertise in after-sales management systems and is an official Google Play developer. For more details, visit the official website at tecnoabi.com. Stolen: 300 GB 63,434 Files |
Radiant tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Software |
Aletex Group tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Manufacturing |
Urban Worldwide tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Business Services |
Lercher Werkzeugbau tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Industrial Machinery & Equipment |
3f tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Membership Organizations |
PenLink tracker page ↗ | qilinfilter this group | · Aug 14, 2026 | Software |
Avanta Maroc Ex Adecco tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | avanta.ma rocketreach.co/avanta-maroc-ex-adecco-profile_b7352c87c4297b95 Avanta Maroc, formerly known as Adecco Maroc, is a prominent human resources and recruitment agency based in Casablanca, Morocco. The company specializes in connecting job seekers with top employers by offering tailored workforce solutions and staffing services. Their platform serves as a vital hub for career opportunities, professional development, and corporate HR management across various industries in the region. |
EKEPIS tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | ekepis.gr rocketreach.co/ekepis-ethniko-kentro-pistopoiisis-domon-profile_b6d46b6ac7408ffe EKEPIS was Greece's National Centre for the Accreditation of Continuing Vocational Training, responsible for certifying adult educators and lifelong learning providers. The organization no longer exists, as its accreditation and certification duties were absorbed by EOPPEP (ΕΟΠΠΕΠ), the National Organisation for the Certification of Qualifications and Vocational Guidance. Today, anyone looking for their services must go through EOPPEP or the official Greek government portal, since the old ekepis.gr domain is no longer an official resource. |
Megalaser Industria Metalurgica LTDA tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | megalaser.com.br zoominfo.com/c/megalaser-industria-metalúrgica-ltda/1315472404 Megalaser is a Brazilian metallurgical company based in São Paulo, specializing in advanced metalworking services like laser cutting, CNC bending, and robotic welding. Founded in 2006, the manufacturer provides high-quality machined components and assemblies for diverse industries, including renewable energy, mining, automotive, and oil and gas. Their platform highlights a strong commitment to precision engineering, integrated manufacturing solutions, and sustainable industrial practices. |
Community Connections tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | comconnections.org zoominfo.com/c/community-connections-inc/350834294 Community Connections is a non-profit organization based in Ketchikan, Alaska, dedicated to providing individualized support for children, seniors, and individuals with disabilities. Founded over 40 years ago, their core mission focuses on encouraging independence, community belonging, and improving the overall quality of life for those they serve. The organization offers a wide range of specialized programs, including early childhood learning, mental health support, and comprehensive disability services. |
Acli tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | acli.it zoominfo.com/c/acli/372618594 ACLI (Christian Associations of Italian Workers) is a major Italian Catholic social promotion organization founded in 1944 to advocate for labor rights and human dignity. Operating a vast network of local clubs, the association provides essential community services, including tax assistance, employment support, and vocational training. Today, it continues to champion social solidarity, democratic participation, and active citizenship across Italy and internationally. |
Vector Two Technology tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | vtt.com.br zoominfo.com/c/vtt/372441609 VTT is a pioneering Brazilian technology company founded in 1996 that specializes in Digital Signage and Retail Media solutions. As a leading provider in Latin America, the company delivers innovative digital displays, menu boards, and interactive customer experience tools for the retail sector. Their platform also supports a robust channel partner program, helping businesses across the region modernize their visual communication and in-store marketing strategies. |
TOA tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | toa-const.co.jp zoominfo.com/c/toa-corp/425840057 TOA Corporation is a prominent Japanese general contractor specializing in marine civil engineering, land reclamation, and port infrastructure development. The company focuses on delivering high-quality, economically viable construction projects while prioritizing environmental sustainability and technological innovation. Through its corporate portal, stakeholders can access detailed information on their advanced engineering services, corporate philosophy, and investor relations. |
Tempel tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | tempel.com zoominfo.com/c/tempel/87867666 Tempel Steel Company, a division of Worthington Steel, is a leading global manufacturer of high-precision electrical steel laminations. Established in 1945, the company provides essential components for motors, generators, and transformers used across the automotive, eMobility, and energy sectors. Their platform showcases advanced precision metal stamping and overmolding services designed to improve product performance and efficiency. |
Plaza Auto Mall tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | plazaautomall.com zoominfo.com/c/plaza-auto-mall/194512238 Plaza Auto Mall is a family-owned dealership group based in Brooklyn, New York, that has been serving local drivers since 1975. They offer an extensive inventory of over 1,000 new, used, and certified pre-owned vehicles across multiple automotive brands all in one location. The platform also provides comprehensive automotive services, including financing options, vehicle maintenance, parts sales, and a dedicated body shop. |
The Coffee Bean tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | coffeebean.com.my zoominfo.com/c/the-coffee-bean/425047768 The Coffee Bean & Tea Leaf Malaysia is the official digital portal for the popular cafe chain, which currently operates over 150 locations across the country. The website allows customers to easily explore the full menu, access exclusive promotions, and manage their MyCBTL loyalty app rewards. It serves as a convenient central platform for ordering premium beverages, redeeming digital vouchers, and staying updated on seasonal cafe offerings. |
KFC Kosova tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | kfckosova.com zoominfo.com/c/kfc-kosova/401225793 KFC Kosova is the official regional branch of the global fast-food chain, operating multiple restaurants across Kosovo, including a prominent location at the Albi Mall in Pristina. Their website serves as a central hub for customers to find nearby branches, check out menu options, and access delivery services. Additionally, the platform acts as a primary career portal for local job seekers to apply for various corporate and restaurant positions. |
First Coast Heart Vascular Center tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | firstcoastheart.com zoominfo.com/c/first-coast-heart--vascular-center/356606344 First Coast Heart & Vascular Center is a premier cardiovascular care provider serving patients across Northeast Florida. Their website highlights a comprehensive range of services, including expert cardiology, electrophysiology, advanced imaging, and vascular surgery. The medical center focuses on delivering innovative, evidence-based treatments and minimally invasive procedures to ensure the highest standard of heart health. |
Cityside Homes tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | citysidehomes.com zoominfo.com/c/cityside-homes-llc/355153806 Cityside Homes is a new construction home builder based in Houston, Texas, specializing in developing homeowner-focused residential communities. Since 2011, the company has built over 100 distinct neighborhoods, offering modern living spaces tailored to local buyers. Their website serves as a primary resource for exploring floor plans, browsing model homes, and discovering available properties across the greater Houston area. |
Retail Business Management Systems tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | rbms.com zoominfo.com/c/retail-business-management-systems-inc/101712744 Retail Business Management Systems (RBMS) is a specialized technology provider that has delivered Point of Sale and retail management solutions for over 25 years. Focusing heavily on NCR Counterpoint software and hardware integrations, the company supports retail businesses of all sizes primarily across the New York and New Jersey regions. Their platform serves as a central hub for merchants seeking comprehensive tools to optimize store operations, inventory tracking, and overall customer experience. |
Gravity Coffee tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | gravitycoffee.com zoominfo.com/c/gravity-coffee-company-llc/373342412 Gravity Coffee is a premium coffee brand known for serving high-quality beverages in its physical cafes and through retail products. Their signature medium roast blends feature a bold, smooth flavor profile with popular notes of hazelnut and chocolate. The company operates multiple locations and focuses on providing an exceptional coffee experience for its customers |
Ollies Place Kidswear tracker page ↗ | the gentlemenfilter this group | · Aug 14, 2026 | olliesplace.com.au zoominfo.com/c/ollies-place-kidswear/359503050 Ollie's Place is an Australian retail brand specializing in high-quality, trendy, and comfortable clothing for babies and children. The company offers a unique shopping experience both online and through physical stores across Australia, featuring vibrant prints and stylish designs. They focus on providing fashionable, value-for-money pieces for kids' everyday wear and special milestones. |
Reminger tracker page ↗ | leakeddatafilter this group | · Aug 14, 2026 | Reminger Attorneys at Law is a law firm with a strong presence in Ohio, Kentucky, and Indiana, operati… |
[DISCLOSED]TECHVENTURES BANK S.A. tracker page ↗ | ransomhousefilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
Hitachi High-Tech NEW tracker page ↗ | coinbase cartelfilter this group | · Aug 13, 2026 | Industrial Automation & Materials - $4.7 Billion |
SIA Medical Centre tracker page ↗ | rhysidafilter this group | · Aug 13, 2026 | SIA Medical Centre SIA Medical was established in 1993 and was founded by Dr Martin Sia in Melbourne's northwest. 9 clinics - Box Hill, Burwood, Croydon, Essendon, Footscray, Moonee Ponds, Montrose, Mulgrave and Berwick.We are pleased to present:~20,000 patient medical records - names, dates of birth, Medicare numbers, clinical notes, insurance and work-cover files, full patient dossiersStaff identity documents - passports, driver's licenses, police checks, tax file declarations of doctors and employeesPlaintext credentials - logins and passwords for clinical systems (Synapse imaging, PRODA, terminal server, doctor accounts)HR records - signed employment contracts, staff incident reports, immunisation registersLegal & financial - subpoenas, complaints, Bupa contracts, bank details (BSB/ABN), provider payment forms More |
ZEBRA.COM tracker page ↗ | clopfilter this group | · Aug 13, 2026 | Data exfiltrated included the following: Database, Project - files, CAD - files Total size: 8Tb Revenue: $5,600,000,000 |
D & J Beverage Service tracker page ↗ | qilinfilter this group | · Aug 13, 2026 | Grocery Retail |
Zara Investment Holding tracker page ↗ | payloadfilter this group | · Aug 13, 2026 | Zara Investment Holding (zaraholding.com) is a leading Jordanian investment group established in 1994. The company specializes in the tourism and hospitality sector, serving as the largest owner of five-star hotels and luxury resorts in key destinations across the country, including Amman, Petra, and the Dead Sea. Playing a vital role in Jordan's economy, the holding provides approximately 30% of the nation's total five-star hotel capacity. |
GB Group S.A tracker page ↗ | dragonforcefilter this group | · Aug 13, 2026 | GB Group is one of Haiti’s largest private industrial and trading conglomerates. Headquartered in Port-au-Prince, it operates across nine core industries includ... |
CF Supply tracker page ↗ | akirafilter this group | · Aug 13, 2026 | CF Supply is a Texas-based company that offers a wide range of construction products including drywall, metal framing, insulation, and door hardware. They provide services such as free estimates and 24-hour online account access, ensuring convenience for their clients.We will upload corporate data soon. Client information (projects, personal information and so on), contracts and agreements and so on. |
DAISEN tracker page ↗ | ailockfilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
Yaomasa tracker page ↗ | ailockfilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
IPS tracker page ↗ | the gentlemenfilter this group | · Aug 13, 2026 | ipssrl.com zoominfo.com/c/ips-srl/372710487 I.P.S. Srl is an Italian company founded in 2005 that specializes in the recovery and recycling of inert waste from construction and demolition activities. They provide environmental services, supply recycled aggregates, and manufacture "Wastile," a 100% ecological and infinitely recyclable thermoplastic tile. The company has received national awards for its rapid revenue growth and high financial reliability in the environmental sector. |
Gfeller Treuhand und Verwaltungs tracker page ↗ | the gentlemenfilter this group | · Aug 13, 2026 | gfeller-treuhand.ch zoominfo.com/c/gfeller-treuhand-und-verwaltungs-ag/372661395 Gfeller Treuhand und Verwaltungs AG is a Swiss real estate and fiduciary company based in Dübendorf, operating since 1980. They specialize in comprehensive property management, real estate sales, and leasing services. The firm provides professional administrative support, utilizing modern IT solutions to efficiently handle property maintenance and tenant relations. |
clgroup tracker page ↗ | inc ransomfilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
eas**** tracker page ↗ | nightspirefilter this group | · Aug 13, 2026 | No details on the leak post beyond the victim name. |
Riker Danzig Scherer Hyland & Perretti tracker page ↗ | leakeddatafilter this group | · Aug 13, 2026 | Founded in 1882, Riker Danzig Scherer Hyland & Perretti is a law firm with practice areas such as Alte… |
Xpress Tech tracker page ↗ | panzerfilter this group | · Aug 12, 2026 | Xpress Tech is a leading B2B iGaming aggregation platform established in 2015 under Softquo Holding. It provides a comprehensive one-stop technical solution connecting operators with over 120 gaming providers and a portfolio of more than 30,000 games via a single Remote API integration. The platform also features integrated payment solutions and back-office data management |
Hightech Signs tracker page ↗ | kairosfilter this group | · Aug 12, 2026 | Hightech Signs, Inc. is a full-service sign shop located in Charlottesville, Virginia, specializing in custom sign production and creative consultation. They offer a wide range of products including engraving services, banners, vehicle graphics, and window lettering. Their services cater to clients in Central Virginia, providing fast turnaround and excellent customer service. Hightech Signs aims to meet the diverse signage needs of businesses and organizations in the region. |
gamaus.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
Riker Danzig LLP tracker page ↗ | leakeddatafilter this group | · Aug 12, 2026 | To be announced... |
Tianji Auto Care Service Company tracker page ↗ | nightspirefilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
Safeware tracker page ↗ | the gentlemenfilter this group | · Aug 12, 2026 | safewareinc.com Safeware Inc. is a national leader providing safety and security solutions for first responders, schools, and government agencies. For over 40 years, they have supplied advanced protective equipment and public preparedness training across the United States. The company simplifies government purchasing by offering specialized gear through competitive cooperative contract pricing. |
United Association Local Union 345 tracker page ↗ | qilinfilter this group | · Aug 12, 2026 | Membership Organizations |
D...s tracker page ↗ | leakeddatafilter this group | · Aug 12, 2026 | To be announced... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.