Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
178
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 153 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | ▼2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,825 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
4M REALTY COMPANY tracker page ↗ | global secret groupfilter this group | · Aug 17, 2026 | Country: Texas, US | Website: 4mrealty.com | Revenue: $5 Million | Industry: Real Estate Brokerage, Real Estate Sales, Property Sales, Commercial Real Estate | Employees: 20-50 | Properties: 237 GB (54,995 Files, 4,600 Folders) |
Euroscreen tracker page ↗ | the gentlemenfilter this group | · Aug 17, 2026 | euroscreen.it zoominfo.com/c/euroscreen-srl/454657849 Euroscreen is a leading Italian company specializing in digital printing technologies and the manufacturing of high-quality projection screens. They design and produce a wide range of professional and home cinema screens entirely in Italy, including motorized models up to 12 meters wide and projector lifts. Their bespoke audio-visual and printing solutions are exported worldwide to serve both commercial and residential markets. |
terra-petra.com tracker page ↗ | lockbit5filter this group | · Aug 17, 2026 | Terra-Petra is an environmental engineering firm specializing in contaminated soil and groundwater c... |
Planungsgruppe M+M AG tracker page ↗ | aurorafilter this group | · Aug 17, 2026 | Planungsgruppe M+M AG is a German Aktiengesellschaft headquartered in Böblingen, Baden-Württemberg, with approximately 432 employees across 10 offices (Böblingen, Stuttgart, München, Nürnberg, Regensburg, Ingolstadt, Augsburg, Esslingen, Mannheim, Frankfurt). Annual revenue: approximately €52 million. The firm provides architecture, urban planning, structural engineering, building physics, fire protection, BIM, landscape planning, and interior design services. Over 5,200 projects completed across decades of operation. The exfiltrated dataset spans two complete file servers (MMBB04, MMBB05), plus the DATEV financial processing archives, SFirm banking software databases, the ELO document management system, Outlook email archives (PSTs), and payroll/HR data — a total of 268 GB across approximately 124,000 files, covering 2006 to 2026. |
SAGASTA sro tracker page ↗ | panzerfilter this group | · Aug 17, 2026 | SAGASTA is a design and engineering company specializing in modern construction, offering comprehensive design, engineering, and consulting services in the fields of railway, road, bridge, and water management construction. |
Castilla La Mancha tracker page ↗ | panzerfilter this group | · Aug 17, 2026 | The Government of Castilla-La Mancha provides a wide range of services and information related to public administration, economy, education, health, and social services. It aims to support various sectors including agriculture, tourism, and employment, while also addressing issues like sustainability and equality. The intended clients include residents of Castilla-La Mancha, businesses, and individuals seeking assistance in various life situations. The government also promotes transparency and participation through its digital platforms. |
Doimo Cucine tracker page ↗ | panzerfilter this group | · Aug 17, 2026 | Doimo Cucine specializes in modern, customizable designer kitchens that blend beauty and harmony. The company emphasizes a holistic approach to kitchen design, offering a versatile system called All-arounD for creating personalized spaces. With a commitment to quality and innovation, all production is carried out in Italy, ensuring high standards and craftsmanship. Their target clients are those seeking stylish and functional kitchen solutions that nourish the soul. |
Mighty Kingdom tracker page ↗ | direwolffilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Eva AI Limited tracker page ↗ | direwolffilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Arizona State University (ASU) tracker page ↗ | direwolffilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Wishfully Studios tracker page ↗ | direwolffilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Natco Home Group tracker page ↗ | aurorafilter this group | · Aug 17, 2026 | Natco Home Group — a fourth-generation, family-owned home furnishings manufacturer headquartered in West Warwick, Rhode Island, with ~800 employees, ~$100M annual revenue, and facilities across seven US states. The exfiltrated dataset spans the company's entire corporate history and includes: Social Security numbers in plaintext for 100–120 legacy employees dating back to 1979 in an unencrypted PayUSA payroll database, plus 10 years of ADP payroll data (2017–2026) covering 700–1,000 current and former employees — pay stubs, W-2s, W-4s, 401k records, drug test results, background checks, and medical leave records. Years of divisional financial statements, income tax records, customer credit data for major retailers, 18 years of bad-debt reserve calculations, and acquisition-related materials. |
Otter Tail County, Minnesota tracker page ↗ | inc ransomfilter this group | · Aug 17, 2026 | No details on the leak post beyond the victim name. |
Vermont XCenter tracker page ↗ | dragonforcefilter this group | · Aug 17, 2026 | A Vermont coloca seus clientes estrategicamente no Centro das Decisões, pois entende que o cliente deve estar no Centro das Atenções. Com isso estabelecido, a c... |
Lloyd Coils Europe tracker page ↗ | aurorafilter this group | · Aug 17, 2026 | 4 Coils Technology s.r.o. (trading as Lloyd Coils Europe) is a Czech-headquartered manufacturer of custom heat exchangers for the HVAC&R industry, with offices in Germany, France, and the United Kingdom. They serve 200+ OEM customers across 39 countries — names like Carrier, Daikin, Trane, Systemair, Remak, GEA, Swegon, and VTS. Their competitive advantage comes from two things: decades of thermodynamic engineering expertise embodied in their MyCoil selection software (licensed to OEM customers worldwide), and a manufacturing capability for custom heat exchangers. Approximately 200 employees work across four countries. |
Moores 🇬🇧 tracker page ↗ | bravoxfilter this group | · Aug 17, 2026 | Kitchen solutions provider for housing developers. |
Coface tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Insurance |
Spoonful of Comfort tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Grocery Retail |
Albania's Official National Teacher Training Portal tracker page ↗ | emperadorfilter this group | · Aug 16, 2026 | Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:33:40 UTC Size: 5.9 GB Sectors: Education, Government |
Albania's official national teacher training portal. tracker page ↗ | emperadorfilter this group | · Aug 16, 2026 | Albania’s official national teacher training portal provides centralized professional development resources and accredited programs for educators nationwide. This leak include data such as; Roughly ~100k Full national ID numbers, full names and teacher certificates in PDF. Publication scheduled: 2026-08-30 21:31:58 UTC Size: 5.9 GB Sectors: Education, Government |
Teikoku USA tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Manufacturing |
AGUNSA tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Freight & Logistics Services |
Moscord tracker page ↗ | eclipsefilter this group | · Aug 16, 2026 | Moscord is a digital marketplace that connects buyers and sellers in the maritime industry, offering a platform for various suppliers to aggregate and present their products. The company aims to enhance business operations for its clients by providing innovative solutions in procurement, logistics, and eCommerce. Targeting maritime and oil & gas sectors, Moscord serves a global clientele through its extensive network of ports and offices across multiple countries. With a focus on improving user experience and operational efficiency, Moscord leverages advanced technology and industry expertise to facilitate seamless transactions. |
Dynatrace tracker page ↗ | xpl0itrsfilter this group | · Aug 16, 2026 | AI observability platform |
Oz Hair & Beauty tracker page ↗ | xpl0itrsfilter this group | · Aug 16, 2026 | Hair and beauty products |
********* tracker page ↗ | xpl0itrsfilter this group | · Aug 16, 2026 | School management software |
RapidFort tracker page ↗ | xpl0itrsfilter this group | · Aug 16, 2026 | Software supply chain security |
Mulino Padano tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Food & Beverage |
WEBA Meubelen tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Business Services |
MOSAID Technologies tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Finance |
Desatera Sdn Bhd tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Business Services |
Loescher editore Torino tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Advertising & Marketing |
Botek tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Industrial Machinery & Equipment |
Zanichelli tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Advertising & Marketing |
INVENSITY tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Business Services |
Megawide tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Construction |
Jone Précision tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Manufacturing |
Arnall Golden Gregory tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Law Firms & Legal Services |
ASCII Group tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Business Services |
DELTA WAYS tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Healthcare Services |
motorenmaier gmbh tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Business Services |
Double H Equipment tracker page ↗ | qilinfilter this group | · Aug 16, 2026 | Industrial Machinery & Equipment |
actua.fr tracker page ↗ | lockbit5filter this group | · Aug 16, 2026 | Groupe Actua is a recruitment and temporary staffing agency headquartered in Strasbourg, founded in... |
dupouy-associes.fr tracker page ↗ | lockbit5filter this group | · Aug 16, 2026 | Dupouy et Associes - Crowe Horwath is a company that operates in the Accounting Services industry. |
agricolagalbusera.it tracker page ↗ | lockbit5filter this group | · Aug 16, 2026 | The Galbusera Agricultural Company Greenhouse-grown leafy vegetables Here, with dedication and p... |
tecosim.com tracker page ↗ | lockbit5filter this group | · Aug 16, 2026 | TECOSIM is a technology corporation specializing in computer-aided engineering (CAE). They are headq... |
vgrn.de tracker page ↗ | lockbit5filter this group | · Aug 16, 2026 | Verbandsgemeinde Rhein-Nahe is a company that operates in the Government industry. |
TOTVS tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
Colla Health tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
PayrHealth tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
DXS International tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
DodoPayments tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
AAM:HOA Management tracker page ↗ | direwolffilter this group | · Aug 15, 2026 | No details on the leak post beyond the victim name. |
servmarmg.cl (Chile, Valparaíso) tracker page ↗ | ms13-089filter this group | · Aug 15, 2026 | Empresa con más de 25 años de experiencia en el rubro marítimo, orientada a ejecutar operaciones con estándares de calidad, control de riesgo y tiempos de respuesta consistentes... |
Alpine Electronics Europe tracker page ↗ | panzerfilter this group | · Aug 15, 2026 | Alpine Electronics Europe specializes in the distribution of automotive electronics and audio products. The company offers a range of products and support services tailored for various European markets. Their intended clients include automotive manufacturers and consumers seeking high-quality audio solutions. Alpine is committed to providing innovative technology and exceptional customer service across multiple countries in Europe. |
SEARS (Grupo Sanborns) tracker page ↗ | space bearsfilter this group | · Aug 15, 2026 | SEARS (Grupo Sanborns, S.A. de C.V.) is a leading Mexican retail company and a key subsidiary of Grupo Carso, owned by the Slim family.Founded in 1903 by the Sanborn brothers, the company has grown into one of the country’s most iconic and successful retail groups.It owns and operates two of Mexico’s most famous brands: Sears (mid-range department stores) and Sanborns (the signature “store + restaurant/cafe” format).Today, Grupo Sanborns manages more than 41,000 employees and hundreds of stores nationwide, with a strong focus on e-commerce and digital transformation.Website: www.sears.com.mx and www.sanborns.com.mx.AttentionDemo files will appear here in the coming days, ahead of the full-scale release. https://www.sears.com.mx/ |
Lepi Enterprises tracker page ↗ | securotropfilter this group | · Aug 15, 2026 | If the company does not contact us before 20/08/2026, the data will be published. |
VR Advogados tracker page ↗ | barracudafilter this group | · Aug 15, 2026 | [upcoming] VR Advogados, a Brazilian law firm, neglected its clients’ personal data, violating laws regarding data storage and confidentiality—they posted and shared all of their clients’ documents, passport information, and powers of attorney via a Discord server. We hacked it. Now we have 3,000 documents belonging to all of their clients—passports, powers of attorney, declarations, personal and work-related correspondence, and more. The firm hasn’t responded to us for three days; if this continues, we’ll start selling the data. |
www.amca.org.ar tracker page ↗ | blackwaterfilter this group | · Aug 15, 2026 | system breach, data blocking |
www.shalina.com tracker page ↗ | blackwaterfilter this group | · Aug 15, 2026 | system breach, data blocking |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.