Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
179
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▼1 | 21 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,828 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Davroc tracker page ↗ | booba teamfilter this group | · 24d ago | Furniture and Home Furnishings Manufacturing Website: www.davroc.co.uk Stolen data: 15 GB. |
Chernyy & Associates tracker page ↗ | booba teamfilter this group | · 24d ago | Law Practice Website: www.chernyy-law.com Stolen data: 67 GB. |
Meridian Forest Services tracker page ↗ | beastfilter this group | · 24d ago | Meridian Forest Services Limited is a progressive natural resource consulting company that offers a range of services including forest engineering, silviculture, tenure management, strategic planning, geomatics, wildlife and danger tree assessment, and project management. The company caters to a diverse clientele, including First Nations, industry stakeholders, private forest landowners, and government entities. Committed to safety, Meridian is Safe Certified through the BC Forest Safety Council, ensuring a secure work environment. Their innovative approach positions them as a leader in the natural resource sector |
Bihl tracker page ↗ | akirafilter this group | · 24d ago | Boustead International Heaters (BIH) is a leading global designer and supplier of thermal process equipment, including direct fired heaters, waste heat recovery units (WHRUs), and heat recovery steam generators (HRSGs).We will upload 392gb of corporate data soon. Huge amount of detailed personal employee information (passports, DLs, addresses, SSNs, death/birth certs, phones, contacts), confidential financials and agreements and contracts, client information, NDAs and so on. |
Coldfish Seafood tracker page ↗ | qilinfilter this group | · 24d ago | Food & Beverage |
Country-Wide Insurance tracker page ↗ | booba teamfilter this group | · 24d ago | Insurance Website: www.cwico.com Stolen data: 92 GB. |
www.ptesm.com tracker page ↗ | blackwaterfilter this group | · 24d ago | Sinarmas Cepsa Pte. Ltd. is a joint venture between Cepsa and Sinar Mas Group, specializing in the production and marketing of oleochemicals, particularly fatty alcohols and their derivatives |
ManagementPro tracker page ↗ | arcus mediafilter this group | · 24d ago | No details on the leak post beyond the victim name. |
Mark’Techno tracker page ↗ | arcus mediafilter this group | · 24d ago | No details on the leak post beyond the victim name. |
A&E + SMA Design tracker page ↗ | qilinfilter this group | · 24d ago | Architecture, Engineering & Design |
Federis Abogados tracker page ↗ | booba teamfilter this group | · 24d ago | Law Practice Website: www.federisabogados.com Stolen data: 61 GB. |
GTA 6: Nudist Town (Strong Nudity) tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Map Sneak Peek 1 tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Map Sneak Peek 2 tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Basketball Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Full Map tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Taser Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Hypercar Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Plane Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Junkie Video tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
Strip Club tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Gas tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
GTA 6: Plane (Night) tracker page ↗ | cyberleekfilter this group | · 24d ago | No details on the leak post beyond the victim name. |
resi.com tracker page ↗ | krybitfilter this group | · 24d ago | Resi is a UK-based online architectural and home renovation platform founded in 2017 by Alexandra Depledge and Jules Col... |
Westwing Group SE NEW tracker page ↗ | coinbase cartelfilter this group | · 24d ago | Furniture - $465.5 Million |
CyrusOne, LLC. tracker page ↗ | shinyhuntersfilter this group | · 24d ago | Update 23 Aug: We are removing the clients name off this post. They are refusing to pay a $13 million demand. They have 24 hours left to engage with us. We hold 12.9 million Salesforce records along with: Sharepoint: (369.6 GB Compressed / 645 GB Uncompressed) 288,729 Files, 60,513 Folders - More than 182,000 rows of Customer data Extracted from the "Contacts" Salesforce Object. - Over 8,300 Rows of Employee PII (Full Name, Email, Job Title, Phone Number, ect.) - Thousands of executed contracts, MSAs, NDAs, amendments, leases, and SOWs - Extensive physical key inventory logs, verification photos, and contractor Green Badge audits - Large collection of data center drawings, floor plans, electrical one-line diagrams, security system drawings, and site schematics - Full CERM (Critical Environment Reliability Management) process library - Physical and information security policy suite plus governance materials - Regional security scorecards, KPI workbooks, GAM sheets, and signed performance packages - Credential and access-control artifacts (including PasswordList.xlsx, Okta SSC Access lists, active badge reports, and multiple Data Center Access Control forms)This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Hospitality Health ER (Longview) tracker page ↗ | genesisfilter this group | · 24d ago | A healthcare organization |
| NIUS nius.de | breach | · 25d ago | 6.1K accounts · breached 2025-07-13 · Bank account numbers, Email addresses, Names, Partial credit card data, Physical addresses, Purchases · In July 2025, the German news service NIUS suffered a data breach which was subsequently leaked publicly . The data included 6k unique email addresses along with names, physical addresses and payment details for purchases including either IBANs or partial credit card data (masked card number, type and expiry). |
S.E.M.P. s.r.l. tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
adt.com tracker page ↗ | lockbit5filter this group | · 25d ago | ADT is a security company that offers security systems, cameras, alarms ad home automation services.... |
Studio BOLDRIN PAOLO tracker page ↗ | qilinfilter this group | · 25d ago | Real Estate |
Euroflora srl tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
Tecnici Associati STP tracker page ↗ | qilinfilter this group | · 25d ago | Architecture, Engineering & Design |
Aurore Development S.p.A. tracker page ↗ | qilinfilter this group | · 25d ago | Business Services |
Clear Align tracker page ↗ | qilinfilter this group | · 25d ago | Manufacturing |
Difor tracker page ↗ | qilinfilter this group | · 25d ago | Automotive Parts |
Black Cat Engineering & Construction WLL tracker page ↗ | qilinfilter this group | · 25d ago | Civil Engineering Construction |
compendiumusa.net tracker page ↗ | l groupfilter this group | · 25d ago | No details on the leak post beyond the victim name. |
FRUCASTRO SL tracker page ↗ | emperadorfilter this group | · 25d ago | Recent databases, important documents Publication scheduled: 2026-09-06 11:40:43 UTC Size: 540.1 MB Sectors: Manufacturing |
ReliaQuest, LLC tracker page ↗ | shinyhuntersfilter this group | · 25d ago | This time the post is about you, not us. Let Mandiant report and advise on us accurately, go away. DISCLAIMER: This information is being provided "as is" for informational purposes only. We do not endorse any commercial entity, product, company, or service, including any entities, products, or services linked within this post. Any reference to specific commercial entities, products, processes, or services by service mark, trademark, manufacturer, or otherwise, does not constitute or imply endorsement, recommendation, or favour by us. |
el-group tracker page ↗ | inc ransomfilter this group | · 25d ago | No details on the leak post beyond the victim name. |
Vietnam Electricity(EVNHANOI) tracker page ↗ | emperadorfilter this group | · 26d ago | Vietnam Electricity (EVN), legally known as Tập đoàn Điện lực Việt Nam, is the largest power company and the sole national electric utility in Vietnam. Fully owned and controlled by the Vietnamese government since its inception in 1994, EVN operates as a vertically integrated monopoly responsible for the nationwide generation, transmission, and distribution of electricity, as well as international power exchanges. The group oversees all major power plants and regional distribution subsidiaries, including EVNHANOI. Serving as a crucial pillar for Vietnam's macroeconomic stability and industrial expansion, EVN is currently undertaking extensive grid digitalization and spearheading the national transition from coal dependency toward clean and renewable energy integration. The data content exceeds 300GB, comprising 13.36 million rows of customer details, 6.99 million subscriptions, 2.26 million account records, and other miscellaneous data.The price is open to negotiation. Session:054e5b6edf03e8ba012626b5dcd83a7dd47a046760bcd9b9b32d02a039d24d9608 Tox:852E34CBEBA2D40FD21BAC9F9E588B5194DBA9F31CACF9ECE316403120BE18765D22A8A453C4 Size: 300GB Sectors: Government, Energy |
NovoCure Limited tracker page ↗ | shinyhuntersfilter this group | · 26d ago | This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
BOK Financial tracker page ↗ | shinyhuntersfilter this group | · 26d ago | This is a final warning to reach out by end of day 24 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Integrated Health Systems NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Business Services - $9.3 Million |
RXPE Group NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Electronics - $319 Million |
Tower Insurance NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Insurance - $283.7 Million |
Flecha Bus NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Transportation, Freight & Logistics Services - $366.3 Million |
OTEIS Conseil & Ingénierie NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Architecture, Engineering & Design - $69.8 Million |
Longhorn Investments NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Finance - $15.5 Million |
Kessler Creative NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Advertising Networks - $17.1 Million |
Klasko Immigration Law Partners NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Law Firms & Legal Services - $19.7 Million |
Patel NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Accounting For Legal Practices - $5 Million |
Abacus Advisors NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Accounting For Legal Practices - $5 Million |
LifeBank Microfinance Foundation NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Finance - $5 Million |
PT Perusahaan Jamu Air Mancur NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Pharmaceuticals & Healthcare - $100 Million |
PT. Bank Perekonomian Rakyat Bintan NEW tracker page ↗ | coinbase cartelfilter this group | · 26d ago | Banking & Financial Services - $5 Million |
icnavais.com tracker page ↗ | lockbit5filter this group | · 26d ago | The Itaguaí Construções Navais S.A. known as ICN, is a Brazilian state-owned defence company special... |
Test tracker page ↗ | emperadorfilter this group | · 26d ago | test test test Size: 9.8 GB Sectors: Other |
Island Networks tracker page ↗ | pearfilter this group | · 26d ago | Provider for Business-class Internet, Cybersecurity & Home Wi-Fi |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.