Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
203
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 110 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 25 | 27 | 27 | active | no public figure | |
| 11 | safepay | 9 | ▼2 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | emperador | 5 | = | 19 | 23 | 23 | active | no public figure | |
| 15 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼3 | 16 | 16 | 16 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲6 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,819 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Asisken tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | Asisken (asisken.com) is a medical assistance/health insurance company offering prepaid medical coverage and member support services, with a hospital network in Ecuador (and Colombia). |
Edgewood Police Department tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | The Edgewood Police Department is part of the Pierce County Sheriff’s Department, providing public safety and law enforcement services for the city, including community-focused programs like its free Community Academy |
Eureka Construction INC tracker page ↗ | titanfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Medic Rescue tracker page ↗ | the gentlemenfilter this group | · Jul 4, 2026 | https://www.medicrescue.org/ https://www.zoominfo.com/c/medic-rescue/47367866 Medic Rescue Services has been providing trusted emergency medical services to Beaver County since 1978. They offer a range of services including on-site emergency care, non-emergency transports, stretcher van trips, and wheelchair van services, all available 24/7. Their dedicated team and extensive fleet ensure swift and effective responses to medical needs. Medic Rescue aims to prioritize health and safety while fostering community trust through their reliable service |
Locati Architects tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Silvestri & Associates Insurance tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Md Lewis tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Accounting Services |
Goodwill Manasota tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Business Services |
Sitmatic tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Furniture |
Sisint tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Architecture, Engineering & Design |
TQ Financial Services tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Accounting Services |
aydeniz.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 3, 2026 | Aydeniz Group is a family-owned group of companies founded in 1975, operating in several key indu... |
AC Beverage, Inc. tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Provider in the draft beer service industry, specializing in the installation of high-quality systems and beer line |
CNW Electronics Pte Ltd tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Providing complete wire harness solutions, from design to manufacturing |
duflosa.com tracker page ↗ | krybitfilter this group | · Jul 3, 2026 | DUFLO SAS (Duflo Servicios Integrales S.A.S.) is a Colombian company specializing in integrated facility management and ... |
majuhome.com.my tracker page ↗ | krybitfilter this group | · Jul 3, 2026 | MAJUHOME Concept (Maju Home Furnishing Sdn. Bhd.) is a Malaysian leading one-stop mega furniture mall and lifestyle bran... |
KOLORKIM KIMYA tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1GB | 1 files |
Mercedes-Benz Turk tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 50GB | 1 files |
Innovano tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1GB | 1 files |
Francisco Imóveis tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1 files |
Solventa & Riskmetrica | Calificadora de Riesgos tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | upcoming | 0 files |
oakparkmi.gov tracker page ↗ | inc ransomfilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
Ferrum AG tracker page ↗ | anubisfilter this group | · Jul 3, 2026 | Data breach at one of the largest family-owned manufacturing businesses in Switzerland. |
[EVIDENCE]Prince George County tracker page ↗ | ransomhousefilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
Shamrock Holdings Inc. tracker page ↗ | the gentlemenfilter this group | · Jul 2, 2026 | https://en.wikipedia.org/wiki/Shamrock_Holdings https://www.zoominfo.com/c/shamrock-holdings-inc/102187761 https://www.zoominfo.com/c/shamrock-capital-advisors-llc/80380310 https://www.shamrock.com/ Shamrock Holdings, Inc. is an investment firm founded by Roy E. Disney in 1978, primarily serving the investment needs of the Disney Family. The company emphasizes integrity, responsibility, and transparency in its operations. In addition to its investment activities, Shamrock manages various real estate investment programs through a subsidiary. Its intended clients include members of the Roy E. Disney Family and other potential investors in real estate. Assets Under Management: The firm manages over $6.6B in assets across entertainment IP, media rights, and private equity . Included 2021-2026 Stanley Gold inbox(80778) and sent(21617) |
tambasa.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
tricountyhs.org tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
acworth-ga.gov tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
carvalima.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
ezortea.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
hamilton-eye.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
flazio.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | lazio.com — this is a company from Italy. Flazio is a website builder platform that allows use... |
holidaypalace.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | Holiday Palace Hotel in Spain. Guest information, internal documents, reports, photos, videos, an... |
ritavo.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | ritavo.com is the website of Rita Võ Group, a private multidisciplinary holding company from Vie... |
Service IT tracker page ↗ | worldleaksfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Treet Group of Companies tracker page ↗ | worldleaksfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Quest Healthcare Solutions tracker page ↗ | anubisfilter this group | · Jul 2, 2026 | Employee data, internal files, and a few unexpected discoveries. |
Pennant Hills Golf Club tracker page ↗ | qilinfilter this group | · Jul 2, 2026 | Advertising & Marketing |
X-Copper Professional tracker page ↗ | money messagefilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Salters propane tracker page ↗ | space bearsfilter this group | · Jul 2, 2026 | Salter’s Propane is excited and proud to be joining the Salter’s Family of businesses with competitive pricing, excellent customer service, and 65 combined years of industry experience. We are ready and more than capable to service all of your propane needs.From residential to commercial and everything in between we are confident that your experience with us will be nothing short of spectacular.We have many options available to suit your needs including a variety of tank sizes, and we offer competitive lease or purchase options.-Personal information of employees and clients -Financial documents -Other files https://salterspropane.com/ |
Tofutown tracker page ↗ | payloadfilter this group | · Jul 2, 2026 | TOFUTOWN is a traditional organic manufacturer specializing in plant-based foods, founded in 1981. The company offers a diverse range of products including vegan spreads, tofu, and seitan, all made from high-quality organic ingredients. With a commitment to sustainability and natural ingredients, TOFUTOWN caters to health-conscious consumers looking for convenient and delicious plant-based meal options. |
Northeast Pediatrics & Adolescent Medicine tracker page ↗ | anubisfilter this group | · Jul 2, 2026 | Data breach exposes employees and patients of a pediatric clinic. |
Colorado Rehabilitation and Occupational Medicine tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
BN: higuchi-inc Report Error & Data Leak Warning tracker page ↗ | stormousfilter this group | · Jul 2, 2026 | www.higuchi-inc.co.jp/newsrelease/company/doc/unauthorized_access_incident.pdf // We have reviewed the report issued by HIGUCHI INC. To correct their mistake: the breach did not affect just one branch, but rather 3 different branches across various regions.Your data has not been leaked yet, as you are currently within an 8-day grace period. Before we publish any of your commercial or personal data, be aware that we possess 102 GB of Sage software backups, alongside numerous commercial documents.We await your reply to our messages. Follow the correct path to ensure nothing is leaked. We are waiting for you. |
Notice tracker page ↗ | stormousfilter this group | · Jul 2, 2026 | We will soon terminate our operations and services. All hosted data is scheduled for complete erasure within 60 days, before this blog goes offline permanently. |
awo-suedost.de tracker page ↗ | safepayfilter this group | · Jul 2, 2026 | Established in 1994, it is one of the regional branches of the Arbeiterwohlfahrt (AWO), one of Germany's six largest independent … |
dia179.com tracker page ↗ | safepayfilter this group | · Jul 2, 2026 | Founded in 2007, the firm specializes in industrial architecture, logistics facilities, research centers, production plants, and corporate office buildings. Unlike … |
eaglecrestlife.org tracker page ↗ | safepayfilter this group | · Jul 2, 2026 | Operating under Bethany Lutheran Homes, Inc., the organization has served the region since 1946 and is recognized as the largest … |
https://www.roundshield.com/ tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
BONJOUR GROUP tracker page ↗ | majinahanashifilter this group | · Jul 2, 2026 | TARGET: bonjourgroup.net, bonjourretail.com REVENUE: $57.8 Million EMPLOYEES: 501-1,000 employees Package: 3.1 GiB / 5620 files |
KT RESTAURANT tracker page ↗ | majinahanashifilter this group | · Jul 2, 2026 | TARGET: ktr.co.th REVENUE: ~$55M USD EMPLOYEES: ~ Package: 777 MiB / 1853 files |
Starpool tracker page ↗ | worldleaksfilter this group | · Jul 1, 2026 | No details on the leak post beyond the victim name. |
COMHAR tracker page ↗ | worldleaksfilter this group | · Jul 1, 2026 | No details on the leak post beyond the victim name. |
digitaldynamics.com tracker page ↗ | brain cipherfilter this group | · Jul 1, 2026 | Details later. If you think you are here by mistake, please contact us at [email protected] |
goldenstateortho.com tracker page ↗ | brain cipherfilter this group | · Jul 1, 2026 | We have about 150k documents and files of this company, with a total size of more than 150 GB. If you think you are here by mistake, please contact us at [email protected]... |
printronix.com tracker page ↗ | brain cipherfilter this group | · Jul 1, 2026 | We have about 110k documents and files of this company, with a total size of more than 100 GB. If you think you are here by mistake, please contact us at [email protected]... |
blaofood.com tracker page ↗ | krybitfilter this group | · Jul 1, 2026 | B'Laofood Joint Stock Company (formerly B'Laofood Company Limited until March 25, 2026) is a Vietnamese leading manufact... |
jaws.com.tw tracker page ↗ | krybitfilter this group | · Jul 1, 2026 | JAWS Co., Ltd. (兆旭公司) is a Taiwanese manufacturer of electronic connectors and cable assemblies, founded in May ... |
gsp.es tracker page ↗ | krybitfilter this group | · Jul 1, 2026 | Global Software Partner S.L. (GSP) is a Spanish IT consulting and software company with over 30 years of experience in e... |
www.diss.com tracker page ↗ | krybitfilter this group | · Jul 1, 2026 | DISS Analytics is the digital solutions and statistical reporting division of DISS Corporation (Digital Imaging & Soluti... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.