ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen30▲8150400400activeno public figure
2qilin29▲21110364364activeno public figure
3storm9▼31496161activeno public figure
4krybit15▲15449595activeno public figure
5akira10▲3438787activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
6direwolf2▼9376262activeno public figure
7coinbase cartel0=355656activeno public figure
8inc ransom10▲634112112activeno public figure
9lockbit55=275454activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10audit team11▲2252727activeno public figure
11safepay9▼2226767activeno public figure
12leakeddata1▲1203939activeno public figure
13orova0=194444activeno public figure
14emperador5=192323activeno public figure
15zawoo0=191919activeno public figure
16kazu0▼17171717activeno public figure
17vexy4▼3161616activeno public figure
18shinyhunters2=143232activeno public figure
19panzer7▲6142525activeno public figure
20black nevas1▼12141414activeno public figure
21play3▼1134747activeno public figure
22chaos3▼1133535activeno public figure
23rhysida2▼2131515activeno public figure
24cyberleek0=121212activeno public figure
25dragonforce2▲1117171activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Leak-site victims2,817 records · full details

VictimGroup / typeDiscoveredDetails
Coldstat Refrigeration
tracker page ↗
cmd organizationfilter this group · Jun 23, 2026Coldstat Refrigeration offers a full range of industry-proven refrigeration services. From large restaurant chains to individual stores and cafes—Coldstat is ready to meet all your needs. The company’s qualified staff will help you determine the best solution based on your individual needs. Coldstat’s refrigeration services include: sales of commercial refrigeration equipment, installation, maintenance and repair, layout planning, custom system design, and removal of old equipment. Translated with DeepL.com (free version)
cloudquantum
tracker page ↗
novafilter this group · Jun 23, 2026cloudquantum.co - software company that builds and delivers software solutions and products, such as an app for organizing activities and tools for automatically processing information from documents and media - Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
Reynella East College
tracker page ↗
interlockfilter this group · Jun 23, 2026https://www.reynellaec.sa.edu.au/ Reynella East College is an innovative educational institution offering a comprehensive curriculum for students from preschool to 12th grade. However, the school failed to adequately protect the privacy of its students and staff and made no attempt to do so, resulting in the leak of their sensitive personal data online. We are providing you with 600 GB of interesting files and documents, including contracts, financial reports, personal data, student and staff identification numbers, seating charts, and much more.
gov.br
tracker page ↗
eraleign (apt73)filter this group · Jun 23, 2026Gov.br — this is the official state digital platform and domain zone of the Brazilian Federal G...
kliknklik.com
tracker page ↗
eraleign (apt73)filter this group · Jun 23, 2026KliknKlik.com — a company from Indonesia, an online retailer and distributor of computer equipm...
Leo International
tracker page ↗
akirafilter this group · Jun 23, 2026Leo International, established in 1986, serves as a comprehensive source for the PVF, HVAC, andPlumbing Industry. The company specializes in manufacturing products through Forging, Casting,and Injection Molding processes.We will upload 10gb of corporate data soon. Employee personal docs (passports, SSNs, DLs, medical information, phones, photos, doc scans, addresses and so on), confidential internal files and so on.
IH Engineers
tracker page ↗
akirafilter this group · Jun 23, 2026IH Engineers, P.C. is a consulting firm with over 25 years of experience, dedicated to providing innovative and technically excellent services in design, construction, and structural evaluation. The firm operates primarily in New Jersey, New York, and Pennsylvania, serving a diverse range of clients.We will upload 65gb of corporate data soon. Employee personal docs (passports, SSNs, DLs and other HR information), confidential internal files, NDAs, projects, contracts and agreements, drawings and so on.
H*
tracker page ↗
icarusfilter this group · Jun 23, 2026Salesforce data of H*.
H**
tracker page ↗
icarusfilter this group · Jun 23, 2026Salesforce data for this corp.
G*
tracker page ↗
icarusfilter this group · Jun 23, 2026Salesforce data for this corp.
C*
tracker page ↗
icarusfilter this group · Jun 23, 2026Salesforce data for this corp.
viennaairport.com
tracker page ↗
eraleign (apt73)filter this group · Jun 23, 2026Vienna Airport (Flughafen Wien AG) is an Austrian company, the operator of Vienna International A...
FTL-Fast Transit Line
tracker page ↗
novafilter this group · Jun 23, 2026FTL International N.V. specializes in shipping, consolidation, forwarding, and groupage services, with a strong presence in major Northern European ports and an office in Colombo, Sri Lanka. With over 25 years of experience, they offer cost-effective port-to-port and door-to-door logistics solutions, including air freight and cargo insurance. Their services cater to a wide range of clients looking for reliable shipping options across the globe. FTL is committed to exceptional personalized attention and efficient shipment handling, embodying their motto 'Experience the Difference - Data included sales data, invoices and costumers full names and phones etc; Nova Provide tree and samples from stolen data to the company when its get in touch with support department.
Corporación Primax S.A.
tracker page ↗
aurorafilter this group · Jun 23, 2026Corporación Primax S.A. is Peru's largest fuel distribution company, operating 2,185+ stations across Peru, Ecuador, Colombia, and Uruguay with annualised revenue of approximately USD 3.4 billion (Peru alone). The dataset spans every function of the business: Complete financial reporting — Monthly P&L, balance sheet, cash flow, and EBITDA through May 2025. GRIO (Grupo Romero Investment Office) management reporting packages. Budget 2025 vs. actuals. Employee identity data for 15,000–60,000 individuals — DNI national ID numbers, bank accounts, salary amounts, pension fund details, scanned identity documents. Live system credentials — Plaintext SQL database passwords, banking SFTP credentials (Banco Bolivariano Ecuador), AD encryption master key, OSINERGMIN fuel-control system credentials. Complete OT network map — IP addresses and identifiers for 137 fuel stations on the internal 10.55.40.x network, plus JD Edwards ERP production servers. 54 GB of POS transaction data — XML records of consumer fuel purchases across the entire station network. Legal and M&A documentation — Arbitration case files (PUCP/AMCHAM), UNO Corp acquisition materials (Dec 2025), bank covenant waivers.
randa.net
tracker page ↗
chaosfilter this group · Jun 23, 2026Randa Apparel & Accessories is a global powerhouse and one of the world's leading apparel and lifestyle accessories companies, headquartered in New York City at 417 Fifth Avenue, 11th Floor. Founded in 1910, with the founder's family having been in the neckwear business since that time and the curre…
belpointeasset.com \ belpointe.com
tracker page ↗
inc ransomfilter this group · Jun 23, 2026No details on the leak post beyond the victim name.
[DISCLOSED]Karl Chevrolet
tracker page ↗
ransomhousefilter this group · Jun 23, 2026No details on the leak post beyond the victim name.
ehg.bayern
tracker page ↗
safepayfilter this group · Jun 22, 2026Founded in 1991, the company has evolved from a regional waste management enterprise into a specialized provider of infrastructure operations, …
Schumacher Homes
tracker page ↗
qilinfilter this group · Jun 22, 2026Construction
******
tracker page ↗
payoutskingfilter this group · Jun 22, 2026No details on the leak post beyond the victim name.
Huntress
tracker page ↗
icarusfilter this group · Jun 22, 2026Salesforce data of Huntress.
HDS (Hdscorp)
tracker page ↗
icarusfilter this group · Jun 22, 2026Salesforce data for this corp.
Gms-net
tracker page ↗
icarusfilter this group · Jun 22, 2026Salesforce data for this corp.
Cqcrm
tracker page ↗
icarusfilter this group · Jun 22, 2026Salesforce data for Cqcrm
Cbassociations
tracker page ↗
icarusfilter this group · Jun 22, 2026Salesforce data for this corp.
EON Meditech Pvt
tracker page ↗
cmd organizationfilter this group · Jun 22, 2026EON Meditech specializes in innovative medical technology solutions aimed at enhancing patient care and improving healthcare outcomes. Their product offerings include advanced medical devices and software solutions tailored for healthcare providers. The company primarily serves hospitals, clinics, and healthcare professionals looking for cutting-edge technology to streamline operations and enhance patient experiences. EON Meditech is committed to driving advancements in the medical field through research and development.
graymont.com
tracker page ↗
chaosfilter this group · Jun 22, 2026NOTICE: Graymont – Final Warning We have successfully gained full access to the corporate infrastructure of Graymont. Our team currently holds a massive volume of highly sensitive data. The scope of our access covers the entire core of your operations, from executive financial strategy to individ…
sterlinggloballtd.com
tracker page ↗
brain cipherfilter this group · Jun 22, 2026We have 100gb files and documents. If you think you are here by mistake, please contact us at [email protected]
eggetttax.ca
tracker page ↗
brain cipherfilter this group · Jun 22, 2026330,000 documents and files of this company, with a total size of over 250 GB. If you think you are here by mistake, please contact us at [email protected]
Ntd Apparel
tracker page ↗
akirafilter this group · Jun 22, 2026NTD Apparel specializes in creating high-quality apparel that connects with pop culture, offering a range of licensed products and in-house labels. They provide comprehensive services including market analysis, price point management, and visual merchandising to retailers.We will upload 62gb of corporate data soon. Employee personal docs (passports, SSNs, DLs, medical information, phones, addresses and so on), projects, client information, confidential agreements and so on.
NEW PRINZ EUGEN SITE [NOT A CASE FILE]
tracker page ↗
prinz eugenfilter this group · Jun 22, 2026prinzkpn6d3itrgcytmsmlcpt5mgwn3ihpck2hsed5cezlbtbi3wklid.onion OLD SITE (this site) WILL BE TAKEN OFFLINE SHORTLY
Aerospace & Advanced Composites GmbH
tracker page ↗
aurorafilter this group · Jun 22, 2026Aerospace & Advanced Composites GmbH (AAC) — an Austrian space-materials R&D company headquartered in Wiener Neustadt, with deep ties to the European Space Agency. Obtained two complete NAS snapshots spanning 30+ years of operations: aacdata (31 December 2022) — 123 GB: the complete Testhouse, R&D, and engineering share, including the ESA thermal vacuum test archive, polymer composites formulations, and 22 Outlook PST email backups. aacdata1 (14 January 2025) — 86 GB: the administrative share, including managing director's full PC backup (browser credentials, passport scans), 15 years of financial statements, shareholder agreements, and the IT credentials master spreadsheet. BMD_DATA — 34 MB: the complete BMD business software accounting database with employee payroll, SEPA payments, and VAT declarations. done/ — Bitlocker recovery keys for 12 endpoints and WMI system dumps. The exposed material includes: 4 passport scans, 1 social security number, 25 employees' complete HR files, 50–100+ job applicant CVs — the full identity-theft toolkit for the workforce plus third-party data subjects. The IT credentials master spreadsheet (AAC CODES.xlsx) containing every system password, plus browser-stored logins for ESA SSO, the company's IT provider, and industrial suppliers. 12 Bitlocker recovery keys enabling full-disk decryption of 6 company laptops. 123 GB of ESA thermal vacuum test data — 30+ years of space-grade materials testing that represents the company's core competitive advantage and cannot be recreated. 137 executed NDAs with partners including Airbus, RUAG, Safran, Thales, ESA, BMW, Tesla, Google, Samsung SDI, CERN, DLR, and 126 others. 15 years of annual financial statements, bank records, insurance policies, and shareholder agreements — the company's entire financial anatomy laid bare.
bits-pilani.ac.in
tracker page ↗
dragonforcefilter this group · Jun 22, 2026BITS Pilani is a premier Indian private research university and "Institution of Eminence" known for elite engineering and science programs across five campuses....
mihana-v.com
tracker page ↗
dragonforcefilter this group · Jun 22, 2026Here is the comprehensive corporate overview of MIHANA Seisakusho Co., Ltd. based on their official company profiles, technical catalogs, and industrial registr...
Omax Autos
tracker page ↗
wallstreetfilter this group · Jun 22, 2026OMAX Autos Limited is a leading manufacturer of sheet metal components, specializing in the production of auto and non-auto components.
Central Bank of Libya
tracker page ↗
qilinfilter this group · Jun 22, 2026Banking
Union Tractor
tracker page ↗
cmd organizationfilter this group · Jun 22, 2026Union Tractor Ltd. is an independent business selling aftermarket parts and accessories for construction and transportation equipment. It engages in the distribution of undercarriage components, ground engaging tools, engine and drive train parts, hydraulic system parts, exchange compoUnion Tractor Ltd. is an independent business selling aftermarket parts and accessories for construction and transportation equipment. It engages in the distribution of undercarriage components, ground engaging tools, engine and drive train parts, hydraulic system parts, exchange components, and used parts. The company was founded in 1927 and is headquartered in Nisku, Canada.nents, and used parts. The company was founded in 1927 and is headquartered in Nisku, Canada.
MBO GmbH
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026mbo-gmbh.com MBO GmbH is a German surface technology company based in Roding, serving as the in-house surface treatment unit for the Mühlbauer Parts & Systems Group.With over 40 years of experience, they specialize in various advanced coating processes, including electroplating, powder coating, and painting.The company provides comprehensive technical advice and surface finishing solutions that are directly integrated with their parent company's production lines
CTM India Limited motherson INDIA
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026dnb.com/business-directory/company-profiles.ctm_india_limited.c67e34c4f71f7ed11aaf1dc39e0e10a6.html CTM India Limited is located in New Delhi, Delhi, India and is part of the Metalworking Machinery Manufacturing industry. CTM India Limited is associated with the global Motherson Group, focusing on producing specialized equipment and forms essential for industrial manufacturing processes. The company is led by key principal Bimal Dhar and operates within the broader machinery manufacturing sector
GIA Partners
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026giallc.com zoominfo.com/c/gia-partners-llc/347817491 GIA Partners, LLC is a New York-based registered investment advisor specializing in fixed income strategies and credit analysis .The firm focuses on diversified portfolios, including core fixed income, high yield, and emerging market debt, leveraging the extensive experience of its investment team.With over $1 billion in assets under management, GIA emphasizes that credit risk is well-compensated and diversifiable to generate excess returns for its clients
Hooke Laboratories
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026hookelabs.com zoominfo.com/c/hooke-laboratories-inc/345976723 Hooke Laboratories is a biotechnology company based in Lawrence, Massachusetts, specializing in biological products for medical and pharmaceutical research.They are best known for their "Hooke Kits™," which are ready-to-use emulsions used to induce animal models of autoimmune diseases, such as EAE, in laboratory rodents.The company operates strictly as a preclinical research supplier, working only with rodents and in vitro, and does not offer any products for human clinical use
Rowley Properties
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026rowleyproperties.com zoominfo.com/c/rowley-properties/1117416022 Rowley Properties is a multi-generational, family-owned real estate company based in Issaquah, Washington, founded in 1954. The firm specializes in owning, developing, and managing approximately 80 acres of commercial and residential properties, including office spaces, apartments, and storage facilities in downtown Issaquah. They are deeply committed to local community development, focusing on long-term projects that help businesses succeed and families thrive
Canada Wide Media
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026canadawide.com zoominfo.com/c/canada-wide-media-ltd/24612070 Canada Wide Media is Western Canada's leading independent publishing and custom content creation company, headquartered in Burnaby, British Columbia.They produce over 48 premium print and digital publications, such as BC Business and TV Week, reaching an audience of over 6 million readers.The firm specializes in audience engagement, custom publishing, and prestige media solutions tailored for various industries
ErgoMed
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026ergomed.net ErgoMed Work Systems is a US-based occupational health and employment testing company that has been providing loss control programs since 1992.They specialize in physical demand simulation testing, musculoskeletal evaluations, and post-offer employment screening to help businesses and HR managers reduce workplace injuries
Royal Thai Navy Housing Cooperative
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026kehanavycoop.com Royal Thai Navy Housing Cooperative Limited, a service organization based in Bangkok, Thailand.It primarily manages housing projects like "Navy Place," offering residential units for sale and rent to naval personnel and members.Additionally, the cooperative provides financial services such as member shares, loans, and deposits, alongside educational scholarships for members children
International Freight Services
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026ifs-sfo.com zoominfo.com/c/ifs-sfocom/348198952 IFS (International Freight Services, Inc.) is a logistics company headquartered at San Francisco International Airport (SFO). It provides international air and ocean freight forwarding, customs brokerage, warehousing, and end-to-end supply chain solutions. With decades of experience, IFS specializes in time-critical and high-touch cargo, serving industries from technology and life sciences to automotive and retail
NTP B.V. Civil Engineering Construction
tracker page ↗
aurorafilter this group · Jun 22, 2026NTP B.V. (trading as NTP Infra / NTP Groep) is a Dutch civil engineering contractor headquartered in Hattem, Gelderland. They build roads, lay cables, install sewers, and perform ground works across the Netherlands. With 150–200 employees, offices in Hattem, Enschede, and Zevenaar, and a 2024/2025 acquisition of Aannemingsbedrijf Dubbink B.V., they are a typical mid-market Dutch “aannemingsbedrijf” — government contracts, municipal works, private developments. Their file server contained everything: 10+ years of operations, every employee's personal files, the complete HR/payroll system exports, every network device configuration, every project bid, and every financial record.
Kochs GmbH
tracker page ↗
aurorafilter this group · Jun 22, 2026Kochs GmbH — a family-owned German manufacturer of windows, doors, and aluminium façade systems headquartered in Herzogenrath, Nordrhein-Westfalen, with ~240 employees across Germany, the Netherlands, and Hungary. The exposed material includes: 22 GB of payroll database backups (7 MSSQL .bak files, 2016–2023) — every employee's salary, bank IBAN, tax class, social insurance number, pension contributions, and wage garnishments. 2.3 GB of DATEV payroll records (through May 2026) — individual named salary documents, garnishment data, company car records for all three entities. 7 Active Directory passwords in plaintext batch scripts — including both Managing Directors, with one MD's credentials spanning three separate AD domains. 28+ proprietary application source code repositories — WinPro ERP, Apertum CRM, MES integrations, production viewers, time-tracking, and rack-management systems. Each one hardcodes its database credentials. SSL/TLS private keys for kochs.de (2021–2026) — enabling domain impersonation and man-in-the-middle attacks. 77 VPN pre-shared keys from the LANCOM gateway configuration — the complete remote-access roster since 2018. Managing Director's MRI and X-ray scans — brain and spine medical imaging, GDPR Art. 9 special category health data. 16 named employee disciplinary records, 11 driver's license scans, attorney-client privileged litigation files from two active employment lawsuits. Complete financial records — 2024 annual accounts, P&L, balance sheets, SFirm banking database, Syska ProFI general ledger, cost accounting through December 2024.
Keywest Projects
tracker page ↗
the gentlemenfilter this group · Jun 22, 2026keywestprojects.ca zoominfo.com/c/keywest-projects-ltd/354074136 KeyWest Projects Ltd. is a Canadian EPCM (Engineering, Procurement, Construction Management) company headquartered in Calgary, Alberta. It specializes in full-cycle project delivery for the energy sector — including oil and gas facilities, pipelines, and industrial infrastructure — primarily across Western Canada. The firm is recognized for its integrated, client-driven approach that emphasizes safety, efficiency, and technical reliability on complex energy projects
NationsBuilders Insurance Services
tracker page ↗
aurorafilter this group · Jun 22, 2026NationsBuilders Insurance Services (NBIS) is the premier US underwriter of crane & rigging, concrete-pumping, heavy-haul, and residential-builder insurance — a specialty managing general underwriter founded in Atlanta in 2001, acquired by Align Financial / DUAL North America (Howden Group) in August 2021. 2,748,845 filetree entries across 24 shares (AIM, IMAGERIGHT, the claims and policy-admin stores, HR, finance, IT, and a decade of M&A diligence rooms).
jaggroup.com UPDATE-FULL DATA DUMP
tracker page ↗
stormousfilter this group · Jun 22, 2026Full database containing corporate emails (⁠@jaggroup.com⁠), Active Directory domain logins, and clear plain-text passwords.Complete Microsoft Dynamics GP databases, software license keys, financial reports, and system configuration Multiple compressed archives (⁠zBackups.zip⁠, ⁠wetransfer⁠ packages), SQL server connection data, and ⁠IM.mdb⁠ database files.Internal project management sheets (⁠Jag Project.xlsx⁠), user listings, purchasing, and sales import logs.
Taiwan Sintong Machinery Co., Ltd
tracker page ↗
qilinfilter this group · Jun 21, 2026Industrial Machinery & Equipment
Wall ISD
tracker page ↗
cmd organizationfilter this group · Jun 21, 2026Wall ISD is an educational institution that serves students in the Wall, Texas area, providing a range of programs and activities for elementary, middle, and high school students. The district emphasizes inclusivity and equal access to education, ensuring that all students, regardless of their background, have the opportunity to participate in school activities. Wall ISD is committed to fostering a supportive learning environment and offers resources for both new and returning students. The intended clients are students and their families within the Wall community.
Sivatel Bangkok
tracker page ↗
qilinfilter this group · Jun 21, 2026Hospitality
Belz Institutions
tracker page ↗
qilinfilter this group · Jun 21, 2026Education
Tri-tec
tracker page ↗
qilinfilter this group · Jun 21, 2026Business Services
Florida Engineering Services
tracker page ↗
qilinfilter this group · Jun 21, 2026Architecture, Engineering & Design

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.