Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
202
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 113 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 9 | ▼2 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | emperador | 5 | = | 19 | 23 | 23 | active | no public figure | |
| 15 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼3 | 16 | 16 | 16 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲6 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,819 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Sun Dolphin Boats tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Business Services |
Bronken's Dist tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Business Services |
Alan F Burke tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Accounting Services |
Hum & Jacoby tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Accounting Services |
gvfsinc.com tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 20,500,000 Size: 36GB | GREEN VALLEY: SELF-LEASE SCHEME How a California agricultural distributor pays rent to companies controlled by its own co-owners --- PROLOGUE The following documents are in our possession: Financial statements: audited consolidated financial statements of Green Valley Farm Supply, Inc., Pinnacle Application, Inc., and Kennedy Farm Services, Inc. for the fiscal year ended October 31, 2025 (prepared by Van Ruler & Company LLP, dated February 5, 2026); audited consolidated financial statements for the prior fiscal year; trial balances broken down by location (Gonzales CA, Yuma AZ, Hollister CA, Watsonville CA); internal income and expense tables with monthly detail; fixed asset depreciation schedules; monthly accounting summaries for multiple years. Bank documents: account statements from Wells Fargo, Bank of America, 1st Capital Bank, Pacific Valley Bank, BMO Bank, Rabobank—covering the period 2017–2026. PPP federal support program documents: application, calculation, loan agreement. Tax documents: Schedule K-1 forms (Form 568 and Form 1065) for all members of two LLCs—106 Alpine, LLC and 159 GRR, LLC; tax workpapers; property tax returns (BOE-571-D) for 2023–2026; member income distribution summaries. Contracts and agreements: operating agreements for 106 Alpine, LLC and 159 GRR, LLC; original lease agreements for all properties—Hollister, Gonzales, 159 Gonzales River Road, Yuma, Watsonville; promissory notes for $660,000 (GVFS loan to 106 Alpine) and for $983,650, $80,525, and $22,988 (GVFS loans to employee Wiegand); stock purchase plan; loan amortization schedules. Internal documents: QuickBooks exports with rent invoices; internal construction financing spreadsheets; shareholder registers with transaction history (updated as of May 27, 2026); dividend calculations; fixed asset registers with notations on related-party transactions; captive insurance documents (Terra Captive, Pioneer Health Insurance Captive, ARU Captive). Other:… |
wtlawllp.co.uk tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 5,000,000 Size: 19GB | WT Law LLP: Internal Documents of a UK Law Firm PROLOGUE Inside: full credit reports with data from three credit bureaus—on the firm's current employees, marked by the publisher as "Store and Destroy Securely." Bank account details with full transaction histories. Real estate purchase and sale agreements with buyer, seller, and price information. A personally signed Annual Risk Review protocol in which the Managing Partner explains why the firm decided not to insure against cybercrime—and why he believes the PI policy will cover a cyberattack on client funds. An open client insurance claim—nearly two years with no payouts and no reserves. Claims against the firm. A data map: NI numbers, bank details, and sources of funds across 500 open matters. An AML audit in which not a single employee was interviewed—and the firm officially acknowledged this in its response to the regulator. In this article, you will be able to review only a portion of the data we have chosen to disclose. Everything else you will be able to download and review on your own after the full archive is published. --- Part I. Who Is WT Law LLP WT Law LLP is a UK law firm (Limited Liability Partnership), regulated by the SRA (Solicitors Regulation Authority). It specializes in conveyancing, private client matters (wills, powers of attorney, probate), as well as property and corporate disputes. Registered office: 3rd Floor, 46 Aldgate High Street, London EC3N 1AL Lexcel accreditation: continuous since 2015 (annually confirmed by Recognising Excellence Limited) CQS accreditation: active (renewed May 2026) Cyber Essentials: not held The firm handles approximately 500 open client matters . Of the 11 listed employees, only 6 fee earners are actively handling cases. All key regulatory roles (COLP, COFA, MLRO, MLCO, DPM) and the Managing Partner status are concentrated in one individual— Andrew Wong . --- Part II. Strategic Business Plan: Finances and Risks Cyber insurance:… |
bergdemo.com tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 42,000,000 Size: 543GB | Berg / Crushing Corporation of America: Demolition on Federal Money --- PROLOGUE In our possession are internal documents of Berg Demo Holdings LLC , dated 2025–2026. Consolidated financial statements for 2026 — P&L, balance sheet, WIP, ratio analysis. Distribution list: owners, CFO, representatives of Canadian investor Alaris Equity Partners, two independent board members. Related party register — Berg Related Party Spreadsheet : monthly payments to four affiliated entities from January 2025 through May 2026. Daily cash sheets for April 2026. Bank transfer confirmations: $1M, $1.5M, $2.71M — within the group over two months. A log of 264 contract change entries (PCO Log): individual change order amounts reach $1,808,074. More than 50 executed subcontracts and agreements — subcontractor agreements, equipment rental contracts, and general contractor agreements from 2024–2025. Among them: a direct government contract with the Maryland Stadium Authority under the Project C.O.R.E. program, heavy equipment rental from Carter Site Services for Key Bridge debris work, master subcontracts with four asbestos subcontractors, an executed subcontract for the Homestead Wakefield school — the very one for which Berg is now litigating in Harford County. Internal personnel evaluations: peer reviews of management on the KPA platform. The President evaluates subordinates, subordinates evaluate the President, the COO evaluates his direct reports. Documents include written comments and self-assessments with personal signatures. Insurance documents for 2026–2027: fleet, Workers' Compensation, General Liability, D&O. A lawsuit filed in the Circuit Court of Harford County from April 2026. Monthly covenant compliance certificates, signed by CFO Scott Luman and sent to Alaris. In this article, you will only be able to review a portion of the data we have chosen to disclose. The rest you will be able to download and study independently after the full… |
Pinturas Prisa tracker page ↗ | ailockfilter this group | · Jul 9, 2026 | No details on the leak post beyond the victim name. |
Peligro Sports tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Retail · Pennsylvania |
Creative Smiles Pediatric Dentistry tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
AMHWA Biopharm Co., Ltd. tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
SF Smile Doctor tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | SF Smile Doctor |
Bishop Arts Dental PLLC tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Top Notch Dentistry of Dallas tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Benjamin H. Wang DDS Inc. tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
tws-tac.net tracker page ↗ | 3amfilter this group | · Jul 8, 2026 | While ownership has changed over the years, the company has remained locally owned for over 65 years and family-owned for almost 40 years. The company is proud of the company's history and look forward to the future as the company continue to serv | PUBLISHED 1% | Views: 39 |
S.J. Louis tracker page ↗ | qilinfilter this group | · Jul 8, 2026 | Civil Engineering Construction |
shelby.com.mx tracker page ↗ | krybitfilter this group | · Jul 8, 2026 | Shelby Manufacturing de México, S.A. de C.V. is a Mexican maquiladora company specializing in the manufacturing of sewi... |
xuerong.com tracker page ↗ | krybitfilter this group | · Jul 8, 2026 | Shanghai Xuerong Biotechnology Co., Ltd. (上海雪榕生物科技股份有限公司), formerly known as Shanghai Gaoron... |
Wade's Dairy tracker page ↗ | akirafilter this group | · Jul 8, 2026 | A family-owned business for over a century, Wade's Dairy has been a staple in the Connecticut community.We will upload corporate data soon. Detailed employee personal information (name, DOB, SSN, DL,height, weight, race, sex, eyes and hair color, tattoo information, emails, phones and so on),projects files, financials, customers, contracts and agreements and so on. |
PCCC Realty LLC tracker page ↗ | nightspirefilter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Tostrud & Temp, S.C. tracker page ↗ | pearfilter this group | · Jul 8, 2026 | Full service CPA firm serving La Crosse |
corepharma.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu… |
opportune.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi… |
Biessse tracker page ↗ | space bearsfilter this group | · Jul 8, 2026 | The BiesSse group, which has been operating on the global market for over 40 years, specializes in the production and conversion of highly performing technical adhesive tapes. The BiesSse Tape production plant covers a surface area of over 11,000 sq.mt. and is equipped with modern and advanced installations, in line with lean manufacturing practices. The BiesSse group operates worldwide through its subsidiaries in Austria, Brazil, China and Mexico, availing itself of a professional and strongly committed local workforce. The direct presence on the ground makes it possible to quickly and efficiently respond to customers’ demands and to ensure on-going assistance and support.-Personal information of employees and clients -Financial documents-SQL DB https://www.biessseworld.com/ |
<h2 id="about">ABOUT</h2>
<p>Nissin Foods Do Brasil Ltda is a company that operates in the tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | Nissin Foods Do Brasil Ltda is a company that operates in the Food & Beverages industry. It employs 251-500 people and has $100M-$250M of revenue |
<h2 id="about">ABOUT</h2>
<p>The RKW Group is an independent private company headquartered tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | The RKW Group is an independent private company headquartered in Mannheim, Germany, and is one of the world's leading manufacturers of excellent film solutions. RKW is the market leader in the areas of hygiene and agricultural films, films for the beverage industry and packaging for powdery goods. Moreover, the company also supplies films and nonwovens for medical applications, for the chemical and processing industries as well as for the construction sector. The RKW Group's sustainable plastic-based films enable its customers to improve the daily life of consumers worldwide. |
<h2 id="about">ABOUT</h2>
<ul>
<li></li>
</ul>
<h2 id="target">TARGET</h2>
<p>ni*usa.com</ tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | ni*usa.com |
<h2 id="about">ABOUT</h2>
<p>SCHERDELWiesauplast ist ein international tätiger Hersteller tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | SCHERDELWiesauplast ist ein international tätiger Hersteller für Baugruppen und Komponenten aus Kunststoff. Der Hauptsitz des Unternehmens ist in Wiesau, weitere Niederlassungen befinden sich in den USA, sowie ein eigenes Produktionswerk in Mexiko. Seit mehr als 50 Jahren steht der Name Wiesauplast für Erfahrung, Kompetenz und Innovation in Sachen Kunststofftechnik, eines der ersten Produkte war die Blinkerleuchte für den legendären VW Käfer. SCHERDELWiesauplast fertigt in Deutschland und Mexiko eine Vielzahl technischer Komponenten und Systeme, welche sicherheitsrelevante Funktionen With over 35 years of experience since our inception, GRANT & WEBER has established a reputation as a leading authority in all revenue solutions & receivables management services for healthcare, Credit Union & Financial, as well as, Insurance industries. Our services are delivered nationwide and including: Consulting, Insurance Billing & Follow-Up, Self Pay Billing & Customer Service Follow-Up, Self Pay Collections, Third Party Liability Recovery, Workers’ Compensation Recovery, Pre-Charge Off Account Management, Third Party Late Stage Collection Services, and Arbitration. |
<h2 id="about">ABOUT</h2>
<p>The Beacon Insurance Company Limited is ranked as the fourth tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | The Beacon Insurance Company Limited is ranked as the fourth largest insurer in Trinidad and Tobago. Our roots go back to 1972 when Mr Aziz Hadeed founded The Caribbean Insurance Company, passing the proverbial baton to his son, Gerald Hadeed, who sits at the helm today. The company was rebranded as The Beacon Insurance Company in 1996. The early years of the company were characterised by direct personal relationships between Aziz and his clients, rather than through Brokers and after 45 years of cumulative growth, Beacon is now a regional player with Branch Offices and an Agency network that spans Trinidad & Tobago, Barbados, Grenada, St Lucia, St Vincent & The Grenadines, St Kitts & Nevis, and Dominica. Beacon therefore enjoys a reputation as an emerging giant in the regional insurance industry. |
CDA tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: https://centrodiagnosticocda.it/ REVENUE: ~ EMPLOYEES: ~ Package: 73.4 GiB / 135426 files |
WONDR DIAMONDS & D GEM MOUNT tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: wondrdiamonds.com & gemmount.com REVENUE: $12m USD EMPLOYEES: 200+ Package: 2.5 GiB / 247 files |
Aesthetic Surgical Images tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Lechner Massivhaus GmbH tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | Building Materials |
COP® Vertriebs-GmbH Zentrale tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | Business Services |
Next Clinics tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | 0 |
Preneed Funeral Programs tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Kevin Bao Lenguyen tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
United Infrastructure tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
YMCA of Western North Carolina tracker page ↗ | interlockfilter this group | · Jul 7, 2026 | https://www.ymcawnc.org/ The YMCA of Western North Carolina operates seven fitness centers, a summer camp, dozens of food trucks, youth sports programs, and many other initiatives. They are also the state's largest provider of licensed school-age childcare. However, they don't ensure security and aren't responsible for it, and you can gain access to confidential client information (complete sets of documents, even fingerprints), contracts, and incidents (of which they have many!), as well as to employee personal data and financial documents. |
hiddeenn tracker page ↗ | the gentlemenfilter this group | · Jul 7, 2026 | hidddenn |
seprec.gob.bo tracker page ↗ | krybitfilter this group | · Jul 7, 2026 | SEPREC (Servicio Plurinacional de Registro de Comercio / Plurinational Commercial Registry Service) is a Bolivian decent... |
Chisholm Persson & Ball tracker page ↗ | akirafilter this group | · Jul 7, 2026 | Chisholm, Persson & Ball, PC is a law firm located in Laconia, NH, specializing in various legal services including Estate Planning, Probate Administration, Family Law, Business Law, and Civil Litigation. The firm has been recognized for its excellence, winning multiple awards in the Lakes Region for Best Law Firm and other categories.We will upload 45gb of corporate data soon. Client and employee personal information (client passports, visas, DLs, SSNs and so on), confidential client docs, financial, contracts and agreements, court files, police reports and other legal files. |
RISE Architecture tracker page ↗ | akirafilter this group | · Jul 7, 2026 | RISE Architecture is a full-service architectural firm based in New York and New Jersey that specializes in dynamic design solutions for complex real estate projects across residential, commercial, mixed-use, industrial, and institutional sectors.We will upload 57gb of corporate data soon. Employee personal information, a bit of client files, projects files, financials, contracts and agreements and so on. |
Accelirate tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | Business Services |
Mount Royal University tracker page ↗ | cmd organizationfilter this group | · Jul 7, 2026 | The university was established in 1910. Mount Royal University is a public university in Calgary, Canada. Its programs include bachelor of arts, bachelor of communication, bachelor of health & physical education, bachelor of interior design, bachelor of nursing, and bachelor of science. More than 10TB of data!!! |
Excalibur Rentals tracker page ↗ | akirafilter this group | · Jul 7, 2026 | Excalibur Rentals is dedicated to providing reliable rental equipment services, ensuring that clients can complete their jobs safely, on time, and within budget. They offer a range of equipment including boom lifts, telehandlers, and light towers.We will upload 45gb of corporate data soon. Employee personal information (name, addresses, SSNs and so on), contracts and agreements, a bit of financials, customers info, etc. |
Edge Solutions | Stone Ridge Payments tracker page ↗ | akirafilter this group | · Jul 7, 2026 | Edge Solutions is dedicated to leveraging technology to create a better world. With a focus on integrity, they offer top-notch services to help clients achieve their business objectives. Their team is committed to future-proofing businesses through innovative solutions.We will upload 67gb of corporate data soon. Employee personal information (400 passports and DL scans, SSNs, w9 forms and so on), financials, contracts and agreements, confidential documents, lots of NDAs, etc. |
PB Fiduciaire SA 🇨🇭 tracker page ↗ | bravoxfilter this group | · Jul 7, 2026 | Accounting, taxation, auditing, financial consulting for businesses. |
Studio Sardano tracker page ↗ | ailockfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
hive360.com tracker page ↗ | dragonforcefilter this group | · Jul 7, 2026 | HIVE360 is a UK-based employment administration and employee benefits specialist. They help businesses streamline their payroll and HR operations while improvin... |
amplesurveyor.com tracker page ↗ | dragonforcefilter this group | · Jul 7, 2026 | Ample Surveyor Services Limited is a professional property and construction consultancy firm based in Hong Kong. |
Richmont Graduate University tracker page ↗ | ailockfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Fitcrunch tracker page ↗ | space bearsfilter this group | · Jul 7, 2026 | FITCRUNCH® makes getting protein more enjoyable than ever before. Satisfy your cravings with a variety of delicious chef-inspired products from co-founder and owner Robert Irvine.Find the perfect fit with our baked protein bars, wafer bars, protein powder, and more-Personal information of employees and clients -Financial documents -Other files https://fitcrunch.com/ |
tecnocurva.com.br tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
samberger24.de tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
hahn-airport.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Originally developed as a United States military air base, the facility began civilian operations in 1993 and has since become … |
matrixwebagency.com tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | The company specializes in providing integrated digital solutions that help businesses improve their online visibility, customer engagement, and revenue growth. … |
bmiprojects.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Originally operating under the name Bez Marine Interiors GmbH, the company built on decades of experience in the maritime industry … |
caritas-koblenz.de tracker page ↗ | safepayfilter this group | · Jul 6, 2026 | Headquartered in Koblenz, the association was founded in 1918 and has provided charitable and community-based services for more than a … |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.