Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
8
Accounts exposed · 30d
36.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,826 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
sipresitalia.it tracker page ↗ | krybitfilter this group | · 29d ago | S.I.P.R.E.S. SRL (Società Italiana Progetti Ricerche e Sviluppo — Italian Research and Development Projects Company) ... |
www.hsi.info tracker page ↗ | krybitfilter this group | · 29d ago | hsi personaldienste hart & schenk GmbH is a German staffing and temporary employment services company founded in Februar... |
BANGKOKCABLE tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
UNIPLASTICS.COM tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
CDGARVINLAW tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
EXEL tracker page ↗ | inc ransomfilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Integraduanas tracker page ↗ | qilinfilter this group | · 29d ago | Freight & Logistics Services |
Vi***** Pe****** C***, Inc tracker page ↗ | nightspirefilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Babcock tracker page ↗ | the gentlemenfilter this group | · 29d ago | babcock.co.za rocketreach.co/babcock-international-group-africa-profile_b5cda591f42e0b42 Babcock Africa is a leading engineering and asset management company specializing in critical infrastructure and heavy equipment across the African continent. With over 130 years of experience, it provides lifetime engineering solutions, including industrial power systems, construction machinery, plant hire, and defense support. The company partners with demanding sectors such as energy, mining, transport, and manufacturing to ensure safe, reliable, and efficient operations. Its core focus is on designing, building, and sustaining complex assets through comprehensive maintenance and innovative technical services. |
Photon Health, Inc. tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
InfoFlo CRM tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
PayUp tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
Lifesum tracker page ↗ | direwolffilter this group | · 29d ago | No details on the leak post beyond the victim name. |
| Oz Hair and Beauty ozhairandbeauty.com | breach | · 29d ago | 2M accounts · breached 2026-08-15 · Email addresses, Geographic locations, Names, Phone numbers, Purchases · In August 2026, Australian beauty retailer Oz Hair and Beauty was the target of an xpl0itrs extortion attack . The group subsequently published data allegedly obtained from the company, which included 2M unique email addresses along with names, phone numbers, geographic locations (suburb and postcode) and purchases. |
| Fanlore fanlore.org | breach | · Aug 19, 2026 | 145K accounts · breached 2026-08-06 · Email addresses, Names, Passwords, Usernames · In August 2026, the Organization for Transformative Works (OTW) identified unauthorised access to the Fanlore wiki it operates . The breach resulted in the exposure of 145k unique email addresses along with usernames and passwords stored as either MD5 or PBKDF2 hashes. OTW self-submitted the exposed data to HIBP. |
Troutman Pepper Locke tracker page ↗ | leakeddatafilter this group | · Aug 18, 2026 | The second time we attacked Troutman Pepper Locke in a year (first time through physical intrusion), w… |
ADL Embedded Solutions tracker page ↗ | securotropfilter this group | · Aug 18, 2026 | If the company does not contact us before 30/08/2026, the data will be published. |
mecasem.org tracker page ↗ | 3amfilter this group | · Aug 18, 2026 | The group gives quality and reliability the highest priority in the through execution of all its business activities. Therefore MECASEM provides a wide range of solutions ISO 17025 (COFRAC) accredited and EN 9100 and ISO 9001 certified. Since 2012 | PUBLISHED 1% | Views: 33 |
R & D Machine and Engineering tracker page ↗ | dragonforcefilter this group | · Aug 18, 2026 | &D Machine and Engineering, LLC specializes in CNC machining of precision metal components primarily for the aerospace, defense, and space industries. The compa... |
Coltrane Systems tracker page ↗ | playfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Senvest Capital tracker page ↗ | the gentlemenfilter this group | · Aug 18, 2026 | senvest.com zoominfo.com/c/senvest-capital-inc/91423931 Senvest (including Senvest Capital and Senvest Management) is a major international investment firm and hedge fund sponsor managing billions of dollars in assets. Founded by Richard Mashaal, it specializes in contrarian value investing strategies across public equities, private markets, and real estate. Headquartered in New York and Montreal, the firm focuses on discretionary investment advisory services and direct capital deployment for institutional clients. |
Roadvision Systems tracker page ↗ | the gentlemenfilter this group | · Aug 18, 2026 | roadvision.com zoominfo.com/c/roadvision-systems-llc/358950436 Roadvision is a cloud-based trucking management software (TMS) designed to help logistics companies and carriers, particularly in the less-than-truckload (LTL) sector, operate more efficiently. Headquartered in Hanover, New Hampshire, it provides an all-in-one platform to automate workflows, reduce operational costs, and modernize fleet management. |
Logitech/ Streamlabs tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | This is a final warning to reach out by 21 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
[DISCLOSED]Alya Construtora tracker page ↗ | ransomhousefilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Borchert & LaSpina tracker page ↗ | akirafilter this group | · Aug 18, 2026 | Borchert & LaSpina, P.C. is a respected law firm located in Queens, New York, with a team of six experienced attorneys specializing in various areas of law including real estate, mortgage foreclosure, commercial litigation, personal injury, and elder law.We will upload corporate data soon. Client personal information (lots of passports, DLs, SSNs and other information), financials, confidential legal files, contracts and so on. |
CRASL tracker page ↗ | the gentlemenfilter this group | · Aug 18, 2026 | crasl.co.uk zoominfo.com/c/crasl-accounting-services/355829364 CRASL Accounting Services is an approachable, user-friendly accounting firm based in Suffolk, UK, dedicated to supporting individuals, sole traders, and growing businesses. They combine traditional financial values with modern efficiency, offering personalized bookkeeping, tax planning, and strategic business advice. Their client-focused approach ensures you receive the clear insights and practical tools needed to make confident decisions and achieve your financial goals. |
SD Associates Sdn Bhd tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Third Coast Bancshares tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Foresee Pharmaceuticals tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
SpearFin Ltd tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
ssf-int.com ssf-ing.de tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
nyklawfirm.com nyk.ae tracker page ↗ | inc ransomfilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
Berlin Brandenburgische Wohnungsbaugenossenschaft tracker page ↗ | qilinfilter this group | · Aug 18, 2026 | Real Estate |
The 11TB NYC Health + Hospitals Archive is Now Public tracker page ↗ | leaknetfilter this group | · Aug 18, 2026 | #NYCHealthHospitals #HealthcareBreach #DataLeak #HIPAA #SenateHELP #Cassidy #Mamdani #CyberSecurity #DataBreach #PatientPrivacy #HIV #MedicalRecords #12MillionNot1Point8 #HealthcareSecurity #2026Breach #NYC #PublicHealth #SenateInvestigation |
Brinks Home tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Over 4.9 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Alcon, Inc. tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Over 25 million Salesforce records containing some PII was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Lumenis Ltd. tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Over 1.1 million records containing some PII of customers/employees and 177GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Questel SAS tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Over 21 million Salesforce records containing some PII and 147GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Metabase tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | :P |
Sharecare, Inc. tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | This Company data was published due to them hiring a very incompetent and unskilled negotiator. If you choose incompetency to negotiate for you, that is on you. We will be publishing companies data who are negotiating with us, without a warning if negotiators continue to take us as misinformed individuals and BS us. Over 3.4 million Salesforce records containing some PII and 28GB+ of internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
NOTICE OF WARNING tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | We are currently experiencing an influx of volume. More leaks are on their way. Kindly be informed, it is in your best interests to not stall and waste our time. Just pay and get it over with. We are on short temper and patience. We are the ones with the leverage, not you. Don't be naive. If you aren't with the program, go away. Your data will be published immediately and accordingly. SH |
Carhartt, Inc. tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Our demand for this Company was $3.3 million. The Company reached out. However, The Company did not try to negotiate. If The Company attempted to negotiate with us The Company would've ended up saving a good chunk of money. Instead they decided to do (see blow); this is also because The Company hired a very unskilled and incompetent negotiator. If The Company hired competency to negotiate for them, this post would've never been published. [21:24:22] carhartt: After careful review and internal discussions with leadership, we have decided not to move forward with negotiations or further discussions. We appreciate your patience throughout this process. There is millions of customers of data involved here. As we always say, these companies don't care. Millions of records of customer data and vast amount of sensitive information and PII containing employee, customer, customer metadata (royalty info), and other internal corporate data was compromised. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Cook Medical LLC tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Customer data, employee data, and other internal corporate data was compromised. The Company engaged with us but made several paltry offers, did not want to pay what we asked for and decided they are okay with the data leak to happen instead of increasing their offer by a little, then we'd likely have accepted and this post would not have gone up. The Company failed to reach an agreement with us despite our incredible patience, all the chances and offers we made. They don't care. |
Baxter International, Inc. tracker page ↗ | shinyhuntersfilter this group | · Aug 18, 2026 | Over 7.1M Salesforce records containing some PII was compromised. This is a final warning to reach out by 17 Aug 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Prefeitura Municipal de Arcos tracker page ↗ | emperadorfilter this group | · Aug 18, 2026 | We hold complete, unrestricted access to your internal infrastructure. All servers, databases, emails, and admin credentials have been exfiltrated. Critical systems have been encrypted. We have your data. You do not. You have 14 days to respond. No response = data published + permanent loss. Contact us through the provided channel. No third parties. No recovery attempts. Publication scheduled: 2026-09-01 07:24:09 UTC Size: 462.3 MB Sectors: Government |
T****w**x tracker page ↗ | nightspirefilter this group | · Aug 18, 2026 | No details on the leak post beyond the victim name. |
AUDIT ENTITY: De***up tracker page ↗ | audit teamfilter this group | · Aug 18, 2026 | AUDIT ID: 22C42D81C3DA7328 / DISCOVERY DATE: 2026-08-18 |
Scholle IPN / SIG tracker page ↗ | anubisfilter this group | · Aug 18, 2026 | Data breach at a global leader in packaging manufacturing. |
Codinter tracker page ↗ | insomniafilter this group | · Aug 18, 2026 | Private company supplying welding, cutting, finishing products and services across North/Central/South America. Offers equipment, tools, accessories, consumables - from mobile units to robotic systems. Oil industry: pipeline, tanks, refinery, platforms. |
GSW Gemeinschaftsstadtwerke GmbH tracker page ↗ | qilinfilter this group | · Aug 17, 2026 | Electricity, Oil & Gas |
White-Daters & Associates, Inc tracker page ↗ | qilinfilter this group | · Aug 17, 2026 | Construction |
The University of the West Indies tracker page ↗ | qilinfilter this group | · Aug 17, 2026 | Education |
EmpireWorks tracker page ↗ | qilinfilter this group | · Aug 17, 2026 | Construction |
Bridgeport Capital Services tracker page ↗ | playfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Sam Pack Auto Group tracker page ↗ | playfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Woodhaven Association tracker page ↗ | playfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
BMW Group tracker page ↗ | xpl0itrsfilter this group | · Aug 17, 2026 | German multinational luxury vehicles |
DL E&C tracker page ↗ | panzerfilter this group | · Aug 17, 2026 | DL E&C Co., Ltd. is a major South Korean construction and engineering company, founded in 1939, specializing in building, infrastructure, housing, and industrial/energy plant projects worldwide. |
Lansing Urgent Care tracker page ↗ | inc ransomfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
The Rubber Group tracker page ↗ | global secret groupfilter this group | · Aug 17, 2026 | Country: New Hampshire,US | Website: www.rubber-group.com | Revenue: $19.4 Million | Industry: Plastics Manufacturing, Tires & Rubber, Manufacturing | Employees: 50-100 | Properties: 162 GB (207,203 Files, 21,624 Folders) |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.