Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
205
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 113 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,817 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
FMZ Tecnologia em Sistemas tracker page ↗ | novafilter this group | · Jul 18, 2026 | FMZ Tecnologia em Sistemas is a Brazilian software company that develops solutions for the book industry. Its main product, HORUS, is an ERP system designed for publishers, bookstores, and distributors. The system helps manage inventory, sales, royalties, and consignment operations. The company has over 15 years of experience and is based in São Paulo, Brazil. |
NewNet tracker page ↗ | dragonforcefilter this group | · Jul 18, 2026 | NewNet S.A. is a Colombian company specializing in managing IT risks, offering advanced and personalized data protection services. Their extensive range of serv... |
KLD Labs tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Manufacturing |
Armara tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Grocery Retail |
Heartland Catfish tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Agriculture |
Salina Supply tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Home Improvement & Hardware Retail |
St Martha Catholic Church tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Non-Profit & Charitable Organizations |
AK Preparedness tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Building Materials |
Sicc tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Building Materials |
v-silicon.com tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
FAST.COM.PH tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
D.MAG New Material Technology Co., Ltd. Taiwan Giant tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
vedan corp tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
pokka.co tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
reatile.co.za tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
V&P Nurseries tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
Droguería Martorani tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Drug Stores & Pharmacies |
Ecopetrol tracker page ↗ | the gentlemenfilter this group | · Jul 18, 2026 | $33.1 Billion www.ecopetrol.com.co ECOPETROL copetrol SA is a company organized as a public limited company, of national order, linked to the Ministry of Mines and Energy. It has operations located in the center, south, east and north of Colombia, as well as abroad. It has two refineries in Barrancabermeja and Cartagena. Through its subsidiary Cenit, specialized in hydrocarbon transportation and logistics, it owns three ports for the export and import of fuels and crude oil in Coveñas (Sucre) and Cartagena (Bolvar) with access to the Atlantic, and Tumaco (Nariño) on the Pacific. Cenit also owns most of the country's oil and multi-purpose pipelines that connect production systems with large consumption centers and maritime terminals. Ecopetrol also has a stake in the biofuels business and is present in Brazil, Mexico and the United States (Gulf of Mexico and Permian Texas). CHANGE NEGOTIATOR IMMEDIATLY. CONTACT - CONFIRM. Drop in stock - free gift. |
Powder River Heating & Air Conditioning tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Construction |
Cafar tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Insurance |
Sunway Scientific tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | sun-way.com.tw zoominfo.com/c/sunway-scientific-corp/456158414 SUNWAY Co., Ltd., a leading Taiwanese distributor and exclusive agent for international scientific and laboratory equipment brands (such as HETTICH, EYELA, JASCO, and SHASHIN KAGAKU). The company specializes in providing advanced laboratory solutions, including centrifuges, freeze dryers, spectrometers, and cell disruptors for research, biotech, and chemical industries. |
Military Sealift Command tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | sealiftcommand.com zoominfo.com/c/military-sealift-command/149045906 ITAR documentation, personal data, cargo manifests—including ESSM shipments—vessel blueprints, and both disclosed and undisclosed information. U.S. Navy's Military Sealift Command (MSC). It is the primary provider of ocean transportation and global logistics support for the U.S. military, operating approximately 125 ships daily worldwide. |
Advantage Home Health Care tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | advantagehhc.com zoominfo.com/c/advantage-home-health-care-inc/357944466 Advantage Home Health Care, a leading Indiana-owned provider of in-home care services with over 30 years of experience.The company operates multiple locations across Indiana, serving dozens of counties with post-procedure recovery and long-term home assistance. |
Acosol tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Energy, Utilities & Waste |
Centre for Newcomers tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://www.centrefornewcomers.ca/ The Newcomers Center provides immigration services aimed at supporting newcomers and creating a welcoming community. They maintain complete information about their clients in their databases, but they fail to ensure the security of this data. Due to their negligence toward their clients and employees, this data has been compromised. We offer you 380 GB of personal client data, company financial information, its current status and reporting, and human resources planning and policies. |
Paragon Store Fixtures tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://paragonstorefixtures.com/ Paragon Store Fixtures specializes in custom display cases, retail fixtures, and interior design elements for luxury stores, beauty salons, offices, restaurants, and entertainment venues. A security breach resulted in the breach of partnership agreements, resulting in the intellectual property of both the company and its clients. Internal design files were exposed, including work completed for clients in the high-end retail sector and luxury brands. Due to the company's negligence, contracts, architectural plans, and confidential design documentation became public. The identities of clients and projects have now been revealed. |
Westcoast Communication Services tracker page ↗ | akirafilter this group | · Jul 17, 2026 | Westcoast Communication Services is a leading expert in low voltage and structured cabling, specializing in voice and data cabling solutions across Florida. They offer a range of services including network integration, telecommunication networks, and access control systems. We will upload 20gb of corporate data soon. Employee personal information (DL, passports, SS card scans and so on), contracts and agreements, customer info, financials, confidential agreements, etc. |
Nesco Bus Maintenance tracker page ↗ | akirafilter this group | · Jul 17, 2026 | Nesco Bus specializes in manufacturing and maintaining a wide range of buses, including school,childcare, activity, commercial, and specialty buses. With over three decades of experience, they are committed to providing exceptional customer support and ensuring the safety and comfortof their passengers.We will upload 26gb of corporate data soon. Employee personal information (DL scans and so on),contracts and agreements, customer info, payment details and other financial docs, etc. |
suppcentersa.com tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +506 40003397. SuppCenter Global Services officially positions itself as one of the leading Xcitium solution partners and providers in the Latin America region. Xcitium is the new name of COMODO’s enterprise business. Their key cybersecurity specialization is based on a threat prevention architecture that uses Xcitium Zero Trust and ZeroDwell technologies. Official partnership: SuppCenter Global acts as a managed security service provider, or MSSP. They implement, configure, and support Xcitium/Comodo security solutions for large businesses, retail companies, and the public sector. Stolen: -- |
arambol.co.uk tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +44 2079276370 , Arambol LLP is a dynamic partnership of chartered surveyors and property consultants, recognized for their commitment to quality and professionalism in property services. They cater to a diverse clientele, including large property organizations, retailers, local authorities, and small residential developers. Their service offerings encompass property consultancy, project management, cost consultancy, building surveying, and construction management. Arambol operates across various sectors such as healthcare, industrial, commercial, public sector, education, and hospitality. Stolen: 922 GB 584,228 Files |
Kyokuto Kaihatsu Kogyo tracker page ↗ | inc ransomfilter this group | · Jul 17, 2026 | No details on the leak post beyond the victim name. |
Phi tracker page ↗ | novafilter this group | · Jul 17, 2026 | PHI Studio focuses its activities on the presentation and curation of immersive works in virtual reality (VR), augmented reality (AR) and extended reality (XR). Recognized locally and internationally for its innovative production approach, technical expertise and achievements in new forms of storytelling, PHI Studio collaborates with major global industry players and has worked on many award-winning projects, with international presentations in New York, Tokyo, Venice, Frankfurt, Luxembourg and Salt Lake City, among others. As a pioneer in interactive experiences, PHI Studio pushes the boundaries of immersive projects, with a focus on enhancing the visitor experience through a keen sense of detail and the elaboration of high-quality scenography. With a reputation for close collaborations with artists, creators, directors and producers from different backgrounds, PHI Studio aspires to be a catalyst of innovation, supporting the development of present and future talent - Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
Digipro tracker page ↗ | novafilter this group | · Jul 17, 2026 | digipro.com.vn appears to be the website of DIGIPRO TECH JSC (Công ty Cổ phần Phát triển Công nghệ DIGIPRO), a Vietnamese IT company. According to its own website, the company was established in 2020 and is based in Hanoi, Vietnam - Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
Integrated Marketing Services tracker page ↗ | novafilter this group | · Jul 17, 2026 | Integrated Marketing Services is a company that operates in the Commercial Printing industry. It employs 20to49 people and has 5Mto10M of revenue. The company is headquartered in Liverpool, New York - Nova Provide tree and samples from stolen data + decrypt sample to the company when its get in touch with support department. |
eitzchaim.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Eitz Chaim Schools (Hebrew: ישיבת עץ חיים — Yeshivas Eitz Chaim) is a private Orthodox Jewish elementary sc... |
formasuniversales.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Formas Universales, S.A. is a Panamanian company founded in 1985, specializing in the production and commercialization o... |
rehabmalaysia.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Pusat Rehabilitasi PERKESO Tun Abdul Razak (PERKESO Rehabilitation Centre Malaysia) is a Malaysian government-linked reh... |
www.lagus.cz tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | LAGUS s.r.o. is a genuine Czech manufacturing company established on April 21, 1998, headquartered in Hruškové Dvory (... |
District of Columbia Housing Authority tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://www.dchousing.org/ DC Housing, the organization entrusted with the powers of the District of Columbia Housing Authority, was completely compromised due to its negligence and greed in security, and all confidential information, databases, passports, and personal data of clients were stolen. We offer you 1.6 TB of confidential information, including all data of District residents and large databases. |
Boston Electric and Telephone tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Wring Group tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
AG Scholtes tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Andorra Life tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Svensk Direktreklam tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
asa-international.com tracker page ↗ | inc ransomfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
radiax.com tracker page ↗ | chaosfilter this group | · Jul 16, 2026 | NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com. To prove the authenticity of our access, we have published an initial 5% of the total exfiltrated data. This is merely a sample. W… |
Megawork tracker page ↗ | ransomhousefilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Converting Equipment International tracker page ↗ | interlockfilter this group | · Jul 16, 2026 | https://www.slitandrewind.com/ CEI's mission is to produce high-quality equipment for the manufacturing industry through innovation, collaboration, and integrity. However, the company has a history of neglecting its own security, putting its customers and employees at risk. This negligence has resulted in the leakage of confidential information and personal data. We provide confidential information regarding equipment development, contracts, and customer relationships. We also have information about their subsidiaries and their entire financial structure. |
Plumley Engineering tracker page ↗ | akirafilter this group | · Jul 16, 2026 | Plumley Engineering is a firm specializing in civil, environmental, and geotechnical engineering services. They prioritize client service and quality, focusing on problem-solving and design with a common-sense approach.We will upload 11gb of corporate data soon. Client and employee personal information, projects information, contracts and agreements, confidential files, NDAs and so on. |
https://www.statebankofnauvoo.com/ tracker page ↗ | inc ransomfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Kee Wah Bakery tracker page ↗ | dragonforcefilter this group | · Jul 16, 2026 | Kee Wah Bakery specializes in traditional and innovative baked goods, offering a wide range of products including mooncakes, festive treats, and gift items. The... |
Petrini Valores tracker page ↗ | dragonforcefilter this group | · Jul 16, 2026 | Petrini Valores S.A. specializes in personalized wealth management and financial planning, offering tailored financial solutions for individuals, families, and ... |
Sinai Grand Casino tracker page ↗ | dragonforcefilter this group | · Jul 16, 2026 | Sinai Grand Casino is the premier casino in the Middle East, offering a luxurious gaming experience with a variety of games including roulette, blackjack, and p... |
sanaa tracker page ↗ | black xfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Terry P Moosmann CPA PC tracker page ↗ | the gentlemenfilter this group | · Jul 16, 2026 | Terry P. Moosmann CPA PC is a local accounting and tax preparation firm based in Washington, Missouri. Owned by Terry Moosmann, the company provides professional financial, accounting, and tax services tailored to individuals and small businesses in the surrounding communities. The firm is recognized for its personalized approach and long-standing presence in the local business community |
Mesto Celakovice tracker page ↗ | the gentlemenfilter this group | · Jul 16, 2026 | celakovice.cz zoominfo.com/c/město-čelákovice/426355970 town in the Central Bohemian Region of the Czech Republic, situated on the Elbe River approximately 27 kilometers from Prague. With a population of around 12,000 residents, it serves as a local administrative and cultural hub. The official website functions as the primary municipal portal, offering citizens and visitors essential information, administrative services, news, and contact details for the local government |
Kaneko tracker page ↗ | the gentlemenfilter this group | · Jul 16, 2026 | kaneko-corp.co.jp zoominfo.com/c/kaneko/540044079 Japanese software company based in Itoigawa, Niigata, specializing in construction project management solutions. For over three decades, the company has developed the CDPM series, a widely recognized software for creating and managing complex construction schedules. Recently, the company has been actively driving digital transformation in the construction industry through its advanced CDPM-X64 platform, which introduces innovative features like native JSON support and comprehensive schedule analysis tools |
Byggelit Sverige tracker page ↗ | the gentlemenfilter this group | · Jul 16, 2026 | byggelit.se zoominfo.com/c/byggelit-sverige-ab/6046017 Swedish manufacturing company based in Lit that has been producing particleboard since 1962. They specialize in sustainable, customized particleboard component solutions, using advanced CNC technology to cut, drill, and mill panels to exact customer specifications. This approach minimizes on-site labor and waste while promoting a circular economy by recycling production scraps into new boards |
Southport Outdoor Living tracker page ↗ | dragonforcefilter this group | · Jul 16, 2026 | Southport Outdoor Living is a Canadian company established in 2008, specializing in outdoor patio furniture. They offer a wide range of products including loung... |
Metro Design Cente tracker page ↗ | dragonforcefilter this group | · Jul 16, 2026 | Metro Design Center offers a variety of design ideas through its room settings, creating an experience reminiscent of Architectural Digest. The center is conven... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.