Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
203
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 151 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 110 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 25 | 27 | 27 | active | no public figure | |
| 11 | safepay | 9 | ▼2 | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | emperador | 5 | = | 19 | 23 | 23 | active | no public figure | |
| 15 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼3 | 16 | 16 | 16 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲6 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Leak-site victims2,818 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Kunert Fashion tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Manufacturing |
C****h tracker page ↗ | payoutskingfilter this group | · Jun 29, 2026 | No details on the leak post beyond the victim name. |
Musashino University tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Education |
Lørenskog kommune tracker page ↗ | cmd organizationfilter this group | · Jun 29, 2026 | Lørenskog kommune offers a range of services including education, health care, social services, and community development. Their intended clients include residents seeking information on property tax, childcare, and various cultural and recreational activities. The municipality also engages with the public through political meetings and community involvement initiatives. Additionally, Lørenskog kommune celebrates local events and milestones, fostering a sense of community among its residents. |
Bonacio tracker page ↗ | ransomhousefilter this group | · Jun 29, 2026 | No details on the leak post beyond the victim name. |
KALIACT ANCHETA et Associs tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Law Firms & Legal Services |
Metal Sur Famin tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Industrial Machinery & Equipment |
guardianbarrierservices.com tracker page ↗ | 3amfilter this group | · Jun 29, 2026 | Guardian Barrier Services provides a wide range of products and services for events, including crowd control barriers, cable ramps, truss structures, and temporary flooring. Their experienced team supports clients from the planning stage to the ex | PUBLISHED 0% | Views: 16 |
ESMS Global Limited tracker page ↗ | anubisfilter this group | · Jun 29, 2026 | Medical information services data breach. |
Boston Orthotics & Prosthetics tracker page ↗ | anubisfilter this group | · Jun 29, 2026 | Patient data breach at yet another negligent clinic. |
Lam Soon tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Food & Beverage |
Bristol Place tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | 0 |
Gsma tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Architecture, Engineering & Design |
GDN AR(Dorinka) tracker page ↗ | inc ransomfilter this group | · Jun 29, 2026 | No details on the leak post beyond the victim name. |
medipakpharma.com tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | The Pakistani pharmaceutical company Medipak Limited (medipakpharma.com) specializes in the manufacture of infusion solutions, medical devices, and pharmaceutic... |
hwaseng tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | A Taiwanese manufacturer with forty years of experience, specializing in the high-precision production of metal fasteners, precision-machined parts, and compone... |
agroprime tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | development of specialized software (SaaS) for automating agribusiness management and monitoring field personnel |
stni.co.kr tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | Creating accurate virtual replicas involves production facilities, workshops, and equipment for modeling, testing, and optimizing technological processes. |
vipimaging tracker page ↗ | dragonforcefilter this group | · Jun 29, 2026 | VIP Imaging is the largest mobile nuclear imaging company in Southern California, specializing in cardiac PET/CT and SPECT studies for cardiologists. The compan... |
METCO Services, Metco Southeast tracker page ↗ | cmd organizationfilter this group | · Jun 29, 2026 | Metco Services is a multi-disciplined consulting firm specializing in engineering services for the water and wastewater industry. They provide study, design, and construction engineering services to publicly owned water and wastewater collection and treatment systems. With over 100 years of combined industry experience, their team focuses on efficient system utilization to optimize value. Their clientele includes municipalities in Michigan, Ohio, Pennsylvania, and Florida. |
viennaairport.com (SOLD TO 3RD PARTY) tracker page ↗ | eraleign (apt73)filter this group | · Jun 29, 2026 | SOLD TO 3RD Party! No DATA AVALIABLE! Vienna Airport (Flughafen Wien AG) is an Austrian company, ... |
Axionlog tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Freight & Logistics Services |
NASCO tracker page ↗ | qilinfilter this group | · Jun 29, 2026 | Healthcare Services |
Driving School Software tracker page ↗ | prinz eugenfilter this group | · Jun 28, 2026 | Hundreds of driving schools impacted. 16 Million rows of SQL, 8000 FULL credit cards, and more. Full leak post + data available on the new PRINZ EUGEN site. prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion |
maglificioliliana.com UPDATE-FULL DATA DUMP FREE PART1 tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Over +10GB GB of data has been accessed and exfiltrated. This includes product designs, historical fashion lines, and technical specifications for garments. Furthermore, we have obtained customer databases from various parts of the world, financial records, commercial contracts, employee data, personal files for all staff members within the network, daily operational documents, and more. |
lorenzoni-store.com UPDATE-FULL DATA DUMP FREE PART1 tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ |
montechiaro-store.com UPDATE-FULL DATA DUMP FREE PART1 tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ |
impulso-store.com UPDATE-FULL DATA DUMP FREE PART1 tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Complete data belonging to customers and buyers has been accessed, along with designs, orders, and other assets. This includes all domains associated with the parent company: maglificioliliana.com/ |
higuchi-inc.co.jp tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | (Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the .ptb file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations. |
HIGUCHI USA, INC tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | (Dallas - HongKong - LosAngeles ) Comprehensive financial statements including Balance Sheets, Asset records, Liabilities, Capital, Accounts Receivable (A/R), and Accounts Payable (A/P) database backups from Sage 50 (formerly Peachtree Accounting software), indicated by the .ptb file extension Corporate data detailing domestic and international inventory tracking, trade checking, and business operations. |
eogb.co.uk tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Deep access to Microsoft Dynamics GP containing complete corporate accounting, invoices, vendor details, and commercial transactions.Access to internal legal documents, partnership agreements, and customer contracts (such as CBIF OSMO agreements).Exfiltration of operational spreadsheets, financial reports, and executive documents via corporate |
eshacloudqa.com tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | We have breached ESHA Research / ESHA Cloud Services and compromised their core product development databases. The exfiltrated data includes highly confidential industry secrets and formulation data Complete intellectual property containing secret product designs, manufacturing blueprints, and recipes (SupplementFormula, PureFood, FoodGroup).Deep laboratory data, nutritional testing breakdowns, and allergen classification records (SupplementIngredient, Analysis, AllergenGroup, Sensitive registries containing client profiles, user metrics, and market consumer data (Consumer, Activity). |
monoprix.tn tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | Data description: Pending update |
Official Statement: Protecting palatineschool.org Infrastructure tracker page ↗ | stormousfilter this group | · Jun 28, 2026 | During our routine network security audits, our team discovered critical structural vulnerabilities within Palatine School, which granted us full, unrestricted access to their central server (PALDC2020). We had the technical capacity to access every directory, including pupil databases ( StudentData NHS NO ) , Pupil Admin - Users -FocusIT) and staff records Personnel.We want to announce that we have locked down this operation and decided to leak absolutely nothing.This is an institution dedicated to children and special needs education. Unlike corporate thieves or ruthless threat actors, we operate with a strict code of ethics: we do not target children, schools, or healthcare facilities.Instead of destroying them, we have chosen to act as an uninvited security audit. We are using our platform to publicly invite the administration of Palatine School to contact us privately. We will provide them with the full technical details of the critical vulnerabilities we discovered and guide them on how to patch their system for free, ensuring they are protected from other ruthless cyber criminals. |
1-800-dentist tracker page ↗ | qilinfilter this group | · Jun 28, 2026 | Business Services |
Transcore tracker page ↗ | qilinfilter this group | · Jun 28, 2026 | Architecture, Engineering & Design |
ford.mx tracker page ↗ | krybitfilter this group | · Jun 28, 2026 | Ford Motor Company, S.A. de C.V. (Ford de Mexico) is the Mexican subsidiary of Ford Motor Company (USA), the first autom... |
Thyssenkrupp Marine Systems (TKMS) GmbH / Atlas Elektronik tracker page ↗ | the gentlemenfilter this group | · Jun 28, 2026 | https://www.zoominfo.com/c/atlas-elektronik-gmbh/22289599 https://www.zoominfo.com/c/atlas-north-america-llc/346681852 https://www.zoominfo.com/c/thyssenkrupp-marine-systems/559786010 www.atlas-elektronik.com na.atlas-elektronik.com https://www.tkmsgroup.com/atlas-elektronik/ ThyssenKrupp Marine Systems of Germany (often abbreviated TKMS) is a group and holding company of providers of naval vessels, surface ships and submarines. It was founded when large industrial conglomerate ThyssenKrupp acquired Howaldtswerke-Deutsche Werft on January 5, 2005 TKMS Group is a leading provider of integrated system solutions in maritime defense technologies, catering to the complex requirements of modern navies. The company specializes in surface vessels, submarines, and advan Atlas Elektronik, founded in 1902 and headquartered in Bremen, Germany, is a marine electronics and systems business. It is involved in the development of integrated sonar systems for submarines and heavyweight torpedoes. 1TB+ |
Fidelity Security Group tracker page ↗ | cmd organizationfilter this group | · Jun 28, 2026 | Excellence in service delivery and implementation are fundamental to our impressive track record. By keeping abreast of the latest trends and technological developments globally, and continuously evolving and innovating, the Group remains a front-runner in the security solutions market. Through a bouquet of services and related products the Group can tailor make a solution for any requirement. |
hellmold-plank.de tracker page ↗ | safepayfilter this group | · Jun 27, 2026 | Founded in 1904 by Heinrich Hellmold and Heinrich Plank, the company has evolved from a local cartage business into a … |
J&J Gaming tracker page ↗ | playfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
Kuhnline tracker page ↗ | playfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
Hologic tracker page ↗ | redactfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
FCCI Insurance Group tracker page ↗ | redactfilter this group | · Jun 27, 2026 | No details on the leak post beyond the victim name. |
acemacon.org tracker page ↗ | 3amfilter this group | · Jun 27, 2026 | The Academy for Classical Education is dedicated to fostering knowledge and critical thinking skills in children, preparing them to be independent learners for life. It offers a comprehensive educational experience that includes fine arts, athleti | PUBLISHED 0% | Views: 10 |
Ayres Carr & Sullivan, P.C. tracker page ↗ | the gentlemenfilter this group | · Jun 27, 2026 | Ayres Carr & Sullivan, P.C. is a longstanding, general civil practice and trial law firm based in Indianapolis, Indiana. Tracing its roots back to 1914, the firm serves clients across the state with a focus on civil litigation, trial practice, and specialized matters including probate, bankruptcy, and corporation law. Primary Location: 251 E. Ohio St., Suite 500, Indianapolis, IN 46204 Primary Practice Areas: Civil Litigation, Trial Practice, Personal Injury, Corporation Law, Probate, and Bankruptcy Key Attorneys: William S. Ayres, John R. Carr III, and Bret Clement https://www.linkedin.com/company/ayres-carr-&-sullivan-pc |
Aptora tracker page ↗ | dragonforcefilter this group | · Jun 27, 2026 | Aptora is an aggressively growing software company in Lenexa, KS. The company offers award-winning software and consulting services to the service and contracti... |
PIO PIO tracker page ↗ | majinahanashifilter this group | · Jun 27, 2026 | TARGET: piopio.com.co REVENUE: $5m EMPLOYEES: 33 staff Package: 3.1 GiB / 6306 files |
callhorton.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
Data Leak Update tracker page ↗ | stormousfilter this group | · Jun 26, 2026 | ** Do ML IT and vspsolutions.com.au think they are smarter than us? They are reporting the links where the data was uploaded, and they are being disabled. Therefore, and officially, we are preparing a private server on the Tor network to dump all the data of these companies and the data of others. Which will be available to everyone 24/7 along with a clear view of the extracted data, employees |
johndufourlaw.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
theswansonlawgroup.com tracker page ↗ | inc ransomfilter this group | · Jun 26, 2026 | No details on the leak post beyond the victim name. |
lifevantage.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | 585 GIGABYTES — leaked data that was meant to stay hidden. A complete digital snapshot of a corporation that has quietly profited from the hopes of millions of people for decades. Thousands of emails. Financial reports. Payroll records with Social Security numbers. Banking details. Manufacturing formulas with a full list of suppliers. Legal agreements. Internal correspondence with regulators. Receipts belonging to real people — with real addresses. And all of it is in our possession, not just in the vaults of LifeVantage Corporation. This article contains only a portion of the data we have chosen to disclose. Everything else will be available for download and independent review after the full archive is released. |
turbodata.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | A parking ticket is the most trivial document that can enter your life. A scrap of paper under the windshield wiper. Forty dollars. Most people pay and forget about it. Behind that scrap of paper stands a private company that knows more about you than your bank does. It knows your license plate number. It knows who the vehicle is registered to — it has a direct online interface to the DMV database and access to the national NLETS network, which returns vehicle owner records from all fifty states. It knows your home address. And if you didn't pay on time — it purchases your Social Security number from a third-party data broker so it can intercept your state income tax refund through the Franchise Tax Board. Or your lottery winnings. At the same time, your debt gets reported to a credit bureau, and your car gets flagged for a registration hold. That company is Turbo Data Systems, Inc. Over more than forty years, it has become the invisible operator of the ticketing machine for more than 130 cities, police departments, universities, and hospitals across California. Through it flows the issuance of citations, the collection of payments, the placement of vehicles on registration holds, and the referral of debtors to the state tax authority, collection agencies, and credit bureaus. All of that work has accumulated in one digital archive: names, addresses, license plates, VINs, Social Security numbers of motorists, banking details for 130 municipal accounts, tax forms and medical records belonging to the company's own employees, and confidential pricing documents from competitors. We have over a quarter of a terabyte of data — more than 230 gigabytes. This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released. |
qdi.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | Quality Dining, Inc. Accounting Archive — we have more than 1,000 versions of financial reports from 2021–2026; approximately 39,000 primary documents (payroll reports, ADP tax registers, bank instructions, supplier invoices); approximately 15,000 payroll documents; entire series of backup copies with metadata for each file — who created it, who last saved it, when. Quality Dining operates Burger King, Chili's, Slim Chickens, and Bravo restaurants from a single office: 4220 Edison Lakes Parkway, Suite 300, Mishawaka, Indiana 46545. In this article, you will have access to only a portion of the data we have decided to disclose. Everything else you will be able to download and review independently after the full archive is published. |
dystar.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | 1.3 terabytes of data — from a company that manufactures dyes for the global textile industry. Inside: financial reports and AR registers. Budget letters with instructions for global controllers. Technical specifications for cloud systems. Employee lists with Microsoft 365 account identifiers. Banking details belonging to the company itself and its clients. Board of directors minutes. OSHA inspection records and complaints from neighboring residents. Lists of active litigation across six countries. Records of government subsidies. All of it — internal documents belonging to DyStar, a global manufacturer of textile dyes headquartered in Singapore. This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released. |
pchome.com.tw tracker page ↗ | settrafilter this group | · Jun 26, 2026 | A payment company sells trust, security, and reliability. Its internal files tell a different story. THE ARCHIVE THAT WAS NEVER MEANT TO LEAVE Inside the servers of PiPay International Information Corp. and International Link Co., Ltd., you will find: data on more than 3.5 million users, a police watchlist of more than 87,000 citizens, payroll records containing home addresses, production database schemas, and nine years of operational history — all sitting in a single archive. This article covers only a portion of the data we have chosen to disclose. The complete archive will be available for download and independent review following full publication. |
va-glass.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | We have an archive of data from Virginia Glass & Mirror Holdings LLC — a group of companies manufacturing glass and mirrors in Virginia (USA), owned since December 2022 by private equity fund Gemini Investors. The scale of the archive: 671,653 files totaling 443 gigabytes. Inside — emails, spreadsheets, contracts, receipts, medical records, regulatory reports, tax forms, photographs. The company's complete operational memory spanning more than a decade of operations. Inside — full Social Security Numbers of rank-and-file workers, the full SSN of the company's CEO in an unencrypted bank form. The SSN and personal address of the chief controller and his wife — on a tax form embedded in the corporate archive. Employee bank account details — routing numbers, account numbers — from an ACH payroll file. A sales department employee's passport details with home address. Medical records from workplace injuries. Data on environmental violations. Lead emissions up 80% year-over-year. Illegal discharge — two photos in the archive with no captions. And on top of all this — documents about the transaction by which Gemini Investors acquired control of the company with 94.79% ownership for $5 million in investment. This article presents only a portion of the data selected for publication. The full archive is planned for release for download and independent review at a later date. |
tmscentral.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | In the archive of Total Monitoring Services: dealer agreements; a subcontract that routes every dispute into mandatory arbitration; a confidentiality agreement concerning an investment in the company. HR investigations and disciplinary actions with employees' names, pay rates, and signatures. Invoices to a federal customer. A receipt bearing a customer's payment-card number. And, as a layer of its own, the owner's personal identity archive: passport, weapon permit, tax forms, bank statements, family members' Social Security documents. In this article you will see only a portion of the documents we have chosen to disclose. The rest will be available for review after full publication. |
doosan.com tracker page ↗ | settrafilter this group | · Jun 26, 2026 | Over 3.2 terabytes of data. A complete digital snapshot of a corporate group that has spent decades manufacturing equipment that workers trust with their lives on construction sites around the world. Thousands of internal emails. Signed settlement agreements with suppliers covering every major defect. Financial statements from subsidiaries across eight countries. Payroll records. Bank account details in multiple currencies — and a full history of every time those details changed. Product line items under US export controls tied to chemical weapons non-proliferation. An internal support ticket asking: "Are we even still supplying the safety latch for the quick-coupler?" Complete engineering drawings and manufacturing tooling — hundreds of PDFs and original CAD files from which the product could be reproduced from scratch. Field modification and rework tools for known hydraulic defects — documented, signed, with tolerances measured in thousandths of an inch. Sixteen years of patent strategy: what the company patented, what it studied in competitors' work, which competitors it was preparing patent claims against — and a federal lawsuit filed against Bobcat itself. Personal data of US employees: Social Security numbers, payroll direct deposit bank accounts, medical records. This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.