Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
208
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 114 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼7 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 114 | 114 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,819 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Additive Manufacturing tracker page ↗ | the gentlemenfilter this group | · Jul 31, 2026 | additivemanufacturingllc.com zoominfo.com/c/additive-manufacturing-llc/369228736 Additive Manufacturing LLC is a U.S.-based company headquartered in Las Vegas, Nevada, specializing in 3D printing, rapid prototyping, and short- to mid-run production of metal and plastic parts. Backed by over a century of combined industry experience, the company bridges digital fabrication and traditional manufacturing, offering services like CNC machining, production tooling, and assembly. By leveraging a global network of partners and on-demand digital factories, they ensure scalable, high-quality, and cost-effective solutions with reliable lead times |
Salem Saleh Babgi tracker page ↗ | the gentlemenfilter this group | · Jul 31, 2026 | babgi.com.sa zoominfo.com/c/salem-saleh-babgi-co-ltd/372739058 Babgi Group, founded in 1978 by Sheikh Salem Saleh Babgi, is a major Saudi Arabian conglomerate with over 1,900 employees and revenues exceeding $7.4 billion. The group operates primarily in the automotive sector (as an exclusive dealer for brands like Toyota, Lexus, and MG), trading, and contracting. Guided by a vision of sustainable economic growth, it focuses on delivering high-quality standards, advanced management practices, and community-driven services across the Kingdom |
Salama Medicals Distributors Private tracker page ↗ | the gentlemenfilter this group | · Jul 31, 2026 | salamapharma.co.tz zoominfo.com/c/salama-medicals-distributors-private-ltd/356160819 Salama Pharmaceuticals Limited is Tanzania’s leading importer and distributor of pharmaceuticals, medical devices, and surgical equipment. Headquartered in Dar es Salaam, the company operates a large multi-warehouse distribution network to serve healthcare facilities across the country. Dedicated to enhancing healthcare outcomes, Salama Pharma focuses on supplying quality medical products and supporting the modernization of healthcare operations in the East African region |
Krafman tracker page ↗ | the gentlemenfilter this group | · Jul 31, 2026 | krafman.se Krafman (operated by Krafguard AB) is a Swedish credit reporting and debt collection service provider licensed and supervised by the Swedish Authority for Privacy Protection (IMY). The platform offers fast, on-demand credit checks for both businesses and private individuals without registering the number of inquiries made. It also provides free basic company searches, active credit monitoring with automatic updates, and transparent pricing with no hidden subscription fees |
Audio Precision, Inc tracker page ↗ | qilinfilter this group | · Jul 31, 2026 | Manufacturing |
Boyum IT Solutions (HOT!) tracker page ↗ | genesisfilter this group | · Jul 31, 2026 | A provider of IT services |
C.A. Walker Construction tracker page ↗ | genesisfilter this group | · Jul 31, 2026 | A construction management company |
BLUEVISTALLC.COM tracker page ↗ | clopfilter this group | · Jul 31, 2026 | No details on the leak post beyond the victim name. |
RE/MAX 1st Choice tracker page ↗ | gammaxfilter this group | · Jul 30, 2026 | RE/MAX 1st Choice Florida was established in 2005 and is managed by Katy and John Martinelli, who serve as the owners and operators and hold the company's shares. The owners, having worked extensively in the real estate industry and being deeply familiar with the South Florida market, have gained significant experience in residential and commercial property sales, client relations, and brokerage management. They have also collaborated with various agents, investors, and developers as both consultants and strategists. They have operated in the real estate sector, participating in numerous transactions and executing successful marketing and sales campaigns across Broward and Palm Beach counties. |
AguAseo tracker page ↗ | gammaxfilter this group | · Jul 30, 2026 | AguAseo is a Panamanian organization dedicated to maintaining cleanliness in the province of Colón. It provides solid waste collection and cleaning of public spaces, serving the entire province through organized routes and established service schedules across all 15 corregimientos. The service focuses on efficiency and reliability, with accessible support for homes, businesses, and institutions. AguAseo operates with its own collection fleet and uses specialized equipment designed to handle different types of collection needs. With a close, service-oriented approach, AguAseo offers local customer attention and reinforces its ongoing commitment to community health and environmental care—positioning AguAseo as a dependable option for consistent waste collection and public-area cleaning. |
MAG USA Inc tracker page ↗ | securotropfilter this group | · Jul 30, 2026 | If the company does not contact us before 10/08/2026 the data will be published. |
https://straightperformance.de/ tracker page ↗ | unsafefilter this group | · Jul 30, 2026 | Revenue: 2 million | Views: 16727 | Posted: 6/28/2026, 10:31:51 PM | Status: Leaked |
Deutsche Bank tracker page ↗ | unsafefilter this group | · Jul 30, 2026 | Revenue: 30 billion | Views: 17629 | Posted: 7/4/2026, 6:15:19 PM | Status: Leaked |
CCR Solutions tracker page ↗ | unsafefilter this group | · Jul 30, 2026 | Revenue: 41 million | Views: 9012 | Posted: 7/20/2026, 2:30:10 AM | Status: Leaked |
Jiva Health tracker page ↗ | unsafefilter this group | · Jul 30, 2026 | Revenue: 9 million | Views: 6037 | Posted: 7/25/2026, 4:21:02 AM | Status: Leaked |
PARTNERED HEALTH GROUP tracker page ↗ | inc ransomfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Las Cenizas tracker page ↗ | the gentlemenfilter this group | · Jul 30, 2026 | cenizas.cl zoominfo.com/c/cenizas/430439098 Grupo Minero Las Cenizas, a prominent medium-scale mining company in Chile with over four decades of industry experience. The company specializes in the production of copper fines and cathodes. Its main mining operations and facilities are strategically located in Cabildo, Taltal, and Franke, Chile |
Sonitor Technologies tracker page ↗ | pearfilter this group | · Jul 30, 2026 | Sonitor’s platform and technologies deliver the accurate and reliable data required to optimize care delivery |
Contact Group tracker page ↗ | cmd organizationfilter this group | · Jul 30, 2026 | Contact Group is a proudly Tasmanian company specializing in building services and multi-technology solutions. They offer award-winning services across various divisions, including electrical and communications, HVAC-R, infrastructure, fire, technology, security, plumbing, and facilities maintenance, ensuring a high-quality customer experience. Their intended clients span multiple sectors such as commercial, government, healthcare, education, and more. With over 35 years of experience, Contact Group is committed to excellence and sustainability in their operations. |
Cenizas tracker page ↗ | the gentlemenfilter this group | · Jul 30, 2026 | cenizas.cl zoominfo.com/c/cenizas/430439098 Grupo Minero Las Cenizas, a prominent medium-scale mining company in Chile with over four decades of industry experience. The company specializes in the production of copper fines and cathodes. Its main mining operations and facilities are strategically located in Cabildo, Taltal, and Franke, Chile |
Db Tarimsal Enerji tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Chemicals & Related Products |
TenSparrows tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Software |
sslf.local tracker page ↗ | inc ransomfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Byonyks tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Manufacturing |
Prenisac tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Construction |
Excel Consultores tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Business Services |
Affinity Capital tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Finance |
Warwick Fabrics tracker page ↗ | kairosfilter this group | · Jul 30, 2026 | As one of the world’s leading textile and soft furnishing wholesalers, Warwick is a family-owned company that has been committed to providing quality materials to New Zealanders since 1985. Warwick are driven to continuously meet the evolving needs of today’s global textile markets by constantly creating and updating collections with the latest trends and classic designs, pushing boundaries, and creating quality products that inspire creativity in the interior design world. We are passionate on being innovative and are committed to our promise of exceptional quality and service, now and into the future. |
Rondout Electric tracker page ↗ | cmd organizationfilter this group | · Jul 30, 2026 | Rondout Electric Inc. is a leading electrical contracting company with over 50 years of experience, specializing in a wide range of projects including health care facilities, schools, industrial complexes, and public sector projects. With a dedicated team of approximately 100 employees, they are known for their disciplined approach to ensuring projects are completed safely, on time, and within budget. The company has built long-standing relationships with clients who appreciate their commitment to integrity and customer satisfaction. Based in Highland, NY, Rondout Electric serves clients across the eastern part of New York State. |
Collge Mont Notre-Dame de Sherbrooke tracker page ↗ | cmd organizationfilter this group | · Jul 30, 2026 | Le Mont Notre-Dame is a private secondary school for girls located in Sherbrooke, specializing in international education. With over 160 years of experience, it offers a unique pedagogy that emphasizes female success and empowerment. The school provides a wide range of programs, including arts, languages, and sports, fostering creativity and engagement among its students. Its state-of-the-art facilities and commitment to student life create a warm and welcoming environment for learning |
Adpo tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Freight & Logistics Services |
servitelco tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Business Services |
Orimar tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Business Services |
Indian Motos Inmot tracker page ↗ | qilinfilter this group | · Jul 30, 2026 | Automotive Parts |
City of Atlanta (atlantaga.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
City of Houston (houstontx.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Wesco International tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
Bonava tracker page ↗ | exfilsquadfilter this group | · Jul 30, 2026 | No details on the leak post beyond the victim name. |
EPM tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 6 |
AKM Enterprises INC tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 1 posts - Jun 10 |
Formulatrix tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 6 |
Oasis Legal Group tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 6 |
Conway Analytics tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 3 posts - Jul 7 |
Greenbotz tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 7 |
NIMR Oil tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 9 |
TechCorr tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 9 |
Rodschinson Investment tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 12 |
Allied Telesis tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 17 |
Dharma Group tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 17 |
Emirates Flight Catering tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 17 |
Alzone Software tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 18 |
Rx Networks tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 21 |
Al-Futtaim Group tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 21 |
Aptara tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 22 |
Ingersoll Rand tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 22 |
Omnicell tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - Jul 22 |
Powerweave tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - 6d |
Mansfield Family Dentistry tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - 6d |
Stadler Rail tracker page ↗ | everestfilter this group | · Jul 30, 2026 | 2 posts - yesterday |
Van Eijck International Car Rescue tracker page ↗ | aurorafilter this group | · Jul 30, 2026 | Van Eijck International Car Rescue B.V. — a family-owned Dutch towing and recovery company with 225+ vehicles, 180+ employees, and 20 branch offices across the Netherlands and Spain. The exposed material includes: 227 employee home directories (156 GB) containing personal documents, tax forms (loonheffingen), salary records, photos, and financial data. 12 GB of RentRunner customer rental contracts with copies of identity documents, driving licenses, and vehicle registrations. 10 years of customer claims data (2010–2019) — 500+ individual claims with damage assessments, insurance details, and customer PII. Complete Google Workspace backup (CubeBackup) — Gmail, Drive, and Calendar for 18 user accounts and 206 groups. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.