Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
183
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | = | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,805 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
stuartandassociates.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
BEDC.COM.AU tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
diabetesandmetabolism.com tracker page ↗ | inc ransomfilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
DOĞAN HOLDİNG tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Media / Energy Conglomerate Volume: 3.1 GB Deadline: 2026-08-08 03:00:00 |
ANADOLU SİGORTA tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Insurance Volume: 1.2 GB Deadline: 2026-08-08 03:00:00 |
HYUNDAI tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Automotive Volume: 1.5 GB Deadline: 2026-08-08 03:00:00 |
ASELSAN tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Ankara, Turkey Sector: Defense / Electronics Volume: 4.5 GB Deadline: 2026-08-08 03:00:00 |
A101 tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Grocery / Retail Volume: 0.2 GB Deadline: 2026-08-08 03:00:00 |
ShadeTechExpo tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Tech Expo / Events Volume: 217.8 GB Deadline: 2026-07-29 00:43:00 |
Boelte LLC tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Missouri, USA Sector: Professional Services / Consulting Volume: 8.1 GB Deadline: 2026-07-29 00:43:00 |
Gold Peak Wealth Management tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Wealth Management Volume: 0.2 GB Deadline: 2026-07-29 00:43:00 |
Global Capital Consultants tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Financial Advisory Volume: 2.0 GB Deadline: 2026-07-29 00:43:00 |
Oklahoma Nursing Times tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Oklahoma, USA Sector: Media / Healthcare Publication Volume: 23.1 GB Deadline: 2026-07-29 00:43:00 |
Towne Machine Tool tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: New Hampshire, USA Sector: Manufacturing / Machine Tools Volume: 0.5 GB Deadline: 2026-07-29 00:43:00 |
Leer Corp tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: California, USA Sector: Real Estate / Development Volume: 6.8 GB Deadline: 2026-07-29 00:43:00 |
SF Bay Data Entry tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: California, USA Sector: Business Process Outsourcing Volume: 25.8 GB Deadline: 2026-07-29 00:43:00 |
DinaTec tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: California, USA Sector: Agriculture / Technology Volume: 5.4 GB Deadline: 2026-07-29 00:43:00 |
IPTV Platform tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Technology / Video Streaming Volume: 3.2 GB Deadline: 2026-07-29 00:43:00 |
Marketech tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Marketing / SEO Volume: 6.7 GB Deadline: 2026-07-29 00:43:00 |
American Hospice & Home Health Services (Ahhh Care) tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Pleasanton, California, USA Sector: Healthcare / Hospice Volume: 11.3 GB Deadline: 2026-07-29 00:43:00 |
Bright Star Partners Insurance tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Insurance / Financial Services Volume: 41.8 GB Deadline: 2026-07-29 00:43:00 |
eCare Platform tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Healthcare / Technology Volume: 14.2 GB Deadline: 2026-07-29 00:43:00 |
Dignity Phoenix tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Non-Profit / Social Services Volume: 5.4 GB Deadline: 2026-07-29 00:43:00 |
Prei Capital tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Financial / Capital Volume: 18.7 GB Deadline: 2026-07-29 00:43:00 |
FLP Law Group LLP tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Los Angeles, California, USA Sector: Legal / Bankruptcy Volume: 42.1 GB Deadline: 2026-07-29 00:43:00 |
Summit Hill Insurance tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Insurance Volume: 34.5 GB Deadline: 2026-07-29 00:43:00 |
MRO Aerospace tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Largo, Florida, USA Sector: Aerospace / Defense Volume: 87.3 GB Deadline: 2026-07-29 00:43:00 |
Schorr Law tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Los Angeles, California, USA Sector: Legal / Real Estate Volume: 27.6 GB Deadline: 2026-07-29 00:43:00 |
Simpkins Law Firm tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Missouri / Kansas, USA Sector: Legal / Family Law Volume: 31.2 GB Deadline: 2026-07-29 00:43:00 |
Leah Walker Orthodontics tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Carlsbad, California, USA Sector: Healthcare / Orthodontics Volume: 8.3 GB Deadline: 2026-07-29 00:43:00 |
Elko Dental Specialists tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Elko, Nevada, USA Sector: Healthcare / Dental Volume: 7.8 GB Deadline: 2026-07-29 00:43:00 |
ProSmile Family Dental Care tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Modesto, California, USA Sector: Healthcare / Dental Volume: 9.6 GB Deadline: 2026-07-29 00:43:00 |
Qube Aviation Catering tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Aviation / Catering Volume: 22.5 GB Deadline: 2026-07-29 00:43:00 |
Performance Data Solutions tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Motorsport / Data Acquisition Volume: 12.8 GB Deadline: 2026-07-29 00:43:00 |
Host & Protect (RedBlink) tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Web Hosting / Security Volume: 156.2 GB Deadline: 2026-07-29 00:43:00 |
RnnR Cloud tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Technology / Cloud Services Volume: 68.9 GB Deadline: 2026-07-29 00:43:00 |
CodeConductor.ai tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: , USA Sector: Technology / AI / SaaS Volume: 52.4 GB Deadline: 2026-07-29 00:43:00 |
Encore Enterprises, Inc. tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Dallas, Texas, USA Sector: Commercial Real Estate Volume: 700.0 GB Deadline: 2026-08-09 02:47:00 |
TOGG tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Gebze, Turkey Sector: Automotive Volume: 1.1 GB Deadline: 2026-08-08 03:00:00 |
KUVEYT TURK tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Banking Volume: 0.8 GB Deadline: 2026-08-08 03:00:00 |
FINANSBANK tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Banking Volume: 2.3 GB Deadline: 2026-08-08 03:00:00 |
ANADOLUBANK tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Banking Volume: 0.4 GB Deadline: 2026-08-08 03:00:00 |
THY tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Aviation Volume: 4.2 GB Deadline: 2026-08-08 03:00:00 |
JOHNSON & JOHNSON tracker page ↗ | crpx0filter this group | · Aug 12, 2026 | Status: Leaked Location: Istanbul, Turkey Sector: Healthcare / Pharmaceutical Volume: 1.9 GB Deadline: 2026-08-08 03:00:00 |
[DISCLOSED]City of Beacon tracker page ↗ | ransomhousefilter this group | · Aug 12, 2026 | No details on the leak post beyond the victim name. |
NETPOWER.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Projects, Cad-files, Backup files Windchil Total size: 230Gb Revenue: $370,900,000 |
SHELL.COM (August 2026) tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Engineering drawings, photos of the facilities, scans of facility testing reports, project plans Total size: 89Gb Revenue: $2,673,000,000,000 |
GE.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Software backups, system files, projects Total size: 391Gb Revenue: $113,000,000,000 |
FISERV.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Projects, Cad-files, files Windchil, Soft Total size: 874Gb Revenue: $21,200,000,000 |
PHILIPS.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: PDF drawings, diagrams, blueprints Total size: 13.5Gb Revenue: $20,700,000,000 |
ALDOGROUP.COM (ALDOSHOES.COM) tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: TSV files, soft, Projects, Cad-files Total size: 424Gb Revenue: $14,800,000,000 |
IRCO.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Cad-files, PDF drawings, diagrams, product presentations, specifications, manuals and instructions Total size: 5564Gb Revenue: $7,800,000,000 |
TOASTTAB.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: project, backup database, logs Total size: 215Gb Revenue: $6,400,000,000 |
LARGAN.COM.TW tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Project, Soft Total size: 56Gb Revenue: $1,700,000,000 |
STARKEY.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project Total size: 3030Gb Revenue: $939,200,000 |
PARTECH.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project, Cad-files, Backups Total size: 24Gb Revenue: $475,700,000 |
MAMMUT.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: .png files, files Windchil Total size: 136Gb Revenue: $281,000,000 |
CORNELIUS.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project, PDF, TXT, DOC - files Total size: 3684Gb Revenue: $269,800,000 |
MAMASANDPAPAS.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1,18Gb Revenue: $131,000,000 |
TRISTAR.COM tracker page ↗ | clopfilter this group | · Aug 12, 2026 | Data exfiltrated included the following: Database, Project - files Total size: 1579,9Gb Revenue: $1,000,000,000 |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.