ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen30▲6152400400activeno public figure
2qilin25▲11119360360activeno public figure
3krybit15▲15499595activeno public figure
4storm9▼31496161activeno public figure
5akira9=438686activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
6direwolf3▼8376262activeno public figure
7coinbase cartel0=375656activeno public figure
8inc ransom8▲436112112activeno public figure
9lockbit54▼4275353activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10audit team9=232525activeno public figure
11safepay10=226767activeno public figure
12leakeddata1▲1203939activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15emperador5=182222activeno public figure
16kazu0▼17171717activeno public figure
17vexy3▼7151515activeno public figure
18shinyhunters2▼1143232activeno public figure
19panzer7▲5142525activeno public figure
20black nevas1▼12141414activeno public figure
21chaos3▼1133535activeno public figure
22everest0▼4123434activeno public figure
23pear1=122323activeno public figure
24rhysida1▼3121414activeno public figure
25cyberleek0=121212activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents2,830 records · full details

VictimGroup / typeDiscoveredDetails
advancedtaxsolutions.com
tracker page ↗
settrafilter this group · Aug 11, 2026Revenue: 7,100,000 Size: N/A | Frank Rim & Associates: Archive of a Tax Consulting Practice PROLOGUE Every tax case. Initial client meetings. Letters containing full details. Financial calculations of IRS liabilities. Paycheck stubs. Social Security numbers. Home addresses and ZIP codes. Bank accounts and balances. Tax returns. All IRS correspondence. Court collection notices. Installment agreement plans with the federal tax authority. Medical insurance coverage. Family members. Dependents. Children. A contact management system (CRM) with the full history of meetings and negotiations. Automated export and backup processes. This article contains only a portion of the data. The full archive will be available to download and review independently once it is published. --- Part I. Frank Rim & Associates CPA PC Frank Rim & Associates CPA PC — a tax consulting practice in Denver, Colorado. Has operated for decades, serving thousands of taxpayers. Basic information: - Registered address: 1609 Gaylord Street, Denver, CO 80206 - Phone: (303) 753-6040 - Fax: (303) 753-6275 - Entity type: Professional Corporation (C-Corp) - Active since: at least 2003 Practice partners: | Name | Role | PTIN | Status | |------|------|------|--------| | Francis A. Rim | Founder/Senior Partner | P00392819 | Founder | | Glenn D. Robbins | Senior Partner | P00392819 | Active in current matters | | Dale K. Erickson | Partner | — | CPA | Frank Rim & Associates areas of practice: - Tax returns (1040, 941, 940, 1099, state returns) - Payroll taxes (FUTA, FICA, federal/state withholding) - IRS representation (Power of Attorney, direct representation) - Tax disputes (dispute resolution, negotiations) - Installment Agreements (payment plans for outstanding tax debt) - IRS Appeals (representation before the Appeals Office) - Medical insurance coverage (1095B/1095C consultations) - Payroll processing - Property tax (advisory services) Service model: Each client receives a full-cycle engagement: 1. First…
profinrg.nl
tracker page ↗
settrafilter this group · Aug 11, 2026Revenue: 6,200,000 Size: N/A | How Profinergy BV Lost Control of Thousands of Files PROLOGUE: Thousands of files. The complete digital archive of a group of companies building solar power plants across Europe. Consolidated financial statements totaling over €35 million in assets . A Tesla Energy commercial proposal — marked "Proprietary & Confidential | Disclosed under NDA" — with three pricing options for Megapack energy storage systems with a combined value ranging from €5.1 to €6.4 million . Credit documents for a 9.4 MW solar farm financed by BNG Bank. A power purchase agreement with ENGIE Energie Nederland NV . Insurance policies with exact coverage amounts. Confidential supplier technical manuals marked "CONFIDENTIAL/PROPRIETARY" . Court documents from a lawsuit against Profinergy — a summons seeking a penalty of €1,000 per violation . Personal customer data: names, addresses, phone numbers, and banking details for payments. A letter confirming "highly skilled migrant" status — an employee record complete with work authorization. All of it — in a single unprotected archive belonging to Profinergy BV (trade name ProfiNRG ), a Dutch solar energy developer and EPC contractor headquartered in Utrecht. This article presents only a portion of the data we have chosen to disclose. The rest will be available for download and review following publication of the full archive. --- Part I. Who Are Profinergy / ProfiNRG Profinergy BV (trade name ProfiNRG ) is a Dutch renewable energy project developer specializing in the design, construction, and operation of solar power plants. Registered address: Maarssenbroeksedijk 37, 3542 DM Utrecht, Netherlands . Phone: 030-2658512 / 030-341 09 03 . Corporate domain: @profinrg.nl . The group is structured through a network of specialized legal entities: | Company | Role | |---------|------| | Profinergy BV | Parent company and EPC contractor | | Sunvest BV / Sunvest Ontwikkeling BV | Development entities | | Vamat BV | Equipment…
Leafwell
tracker page ↗
direwolffilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
FREYWILLE
tracker page ↗
aurorafilter this group · Aug 11, 2026FREYWILLE — the Austrian luxury fire-enamel jewelry house with 70+ boutiques across Europe, the Americas, Middle East, Russia/CIS, and Asia-Pacific. 142+ employee files with salary statements (2024–2026), social security numbers (ELDA), employment contracts across 24 countries, COVID vaccination records, passport copies, visa card statements spanning a decade, and personnel files. FREYWILLE's trade secrets — complete 2025 product costing for all lines (18ct gold, plated, textiles), and the crown jewels: enamel colour recipes from the Siebdruck department. FREYWILLE's fire-enamel technique is what makes the brand unique. The formulations for SPHINX, JOYB2, and Entwurf colour systems are in the dataset. Defence files from 40+ lawsuits across Austria, the US, China, France, Canada, Slovakia, Poland, and Belgium — including a criminal proceedings file (Strafsache Grgic, Mrsic & Co). Documentation of the 2018 webshop malware attack — DSB filings, customer notification drafts, incident reports.
Cleaver-Brooks
tracker page ↗
anubisfilter this group · Aug 11, 2026Major data breach at a leading industrial manufacturer.
Turner
tracker page ↗
payoutskingfilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
BigSpark
tracker page ↗
direwolffilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
Consolidated Medical Practices of Memphis
tracker page ↗
genesisfilter this group · Aug 11, 2026A healthcare organization
Interim HealthCare
tracker page ↗
genesisfilter this group · Aug 11, 2026A healthcare organization dealing with elderly care services
Chat Jurídico
tracker page ↗
direwolffilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
Merge
tracker page ↗
direwolffilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
LT Group / Fortune Tobacco Corp
tracker page ↗
deadlockfilter this group · Aug 11, 2026No details on the leak post beyond the victim name.
CALICHE
tracker page ↗
majinahanashifilter this group · Aug 11, 2026PUBLICATION SCHEDULED. Publication scheduled: 2026-08-18T03:03:00Z Package: 22.9 GiB / 39200 files
HIGEN MOTOR(critical data)
tracker page ↗
qilinfilter this group · Aug 10, 2026Industrial Machinery & Equipment
R... D...
tracker page ↗
leakeddatafilter this group · Aug 10, 2026To be announced...
AliveCor, Inc.
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Statista GmbH
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Quironsalud
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Health Carousel
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Fondo
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Osmo Wallet
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Swyft Inc.
tracker page ↗
direwolffilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Elettrica System 🇮🇹
tracker page ↗
bravoxfilter this group · Aug 10, 2026Electrical and Engineering Solutions for Business.
[DISCLOSED]City of McMinnville OR
tracker page ↗
ransomhousefilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
The Minor Food Group
tracker page ↗
panzerfilter this group · Aug 10, 2026Founded in 1980, Minor Food is the culinary pillar of Minor International (MINT) and one of the largest food and beverage companies in the Asia-Pacific region. With a footprint spanning over 2,600 outlets across 24 countries, Minor Food operates a dynamic dual-engine strategy combining globally renowned franchises—such as Burger King, Dairy Queen, Swensen's, and Bonchon—with a powerful roster of wholly-owned homegrown brands like The Pizza Company, The Coffee Club, and GAGA. Committed to delivering exceptional dining experiences, Minor Food continues to drive the industry forward through digitized kitchen ecosystems, end-to-end supply chain mastery, and consumer-centric innovation.
Verona 83 🇮🇹
tracker page ↗
bravoxfilter this group · Aug 10, 2026Integrated services, logistics and event management.
T... P... L...
tracker page ↗
leakeddatafilter this group · Aug 10, 2026To be announced...
Coggins Insurance Agency
tracker page ↗
global secret groupfilter this group · Aug 10, 2026Country: Florida, United States | Website: cogginsinsurance.com | Revenue: $5 Million | Industry: Insurance | Employees: 1-10 | Properties: 85.9 GB (245,768 Files, 26,563 Folders)
Presentations.AI
tracker page ↗
unsafefilter this group · Aug 10, 2026Revenue: $5 million | Views: 492 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 16h 15m 42s
One Vision Imaging
tracker page ↗
akirafilter this group · Aug 10, 2026One Vision Imaging are a team that are passionate about the process of photographic printing and framing. This is why we started over 40-years ago. Many of our staff are photo enthusiasts orworking photographers in their spare time.We will upload 180gb corporate data soon. Employee personal information and other HR files, sources, contracts and agreements, clients information and so on.
i4 Solutions
tracker page ↗
akirafilter this group · Aug 10, 2026i4 Solutions has created thousands of Websites for companies all over the world! i4 Solutions creates custom websites and prides itself that all work is done by i4 employees not outsources contractors.We will upload 170gb corporate data soon. Lots of working files, projects and so on.
Alcast
tracker page ↗
akirafilter this group · Aug 10, 2026ALCAST is a leading aluminum casting company specializing in precision casting, sand casting, and die casting. They provide high-quality aluminum castings for various industries, including agriculture, defense, heavy equipment, and marine.We will upload 170gb corporate data soon. Employee personal files (passport, DLs, SSNs, addresses and so on), projects, customers information, contracts and agreements and so on.
BerlinerLuft. Technology GmbH
tracker page ↗
ethicsfilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Holstrom, Block & Parke, A Professional Law
tracker page ↗
ethicsfilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
Philadelphia Insurance Companies
tracker page ↗
ethicsfilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
••••••••••
tracker page ↗
ethicsfilter this group · Aug 10, 2026No details on the leak post beyond the victim name.
City Government of Baguio
tracker page ↗
emperadorfilter this group · Aug 10, 2026The City Government of Baguio stands as one of the wealthiest and most prominent local governments in the Philippines. This leak includes highly sensitive and confidential data, such as official contracts, legal permits, identification documents, financial statements, construction blueprints, project proposals, procurement records, and other classified administrative materials. Publication scheduled: 2026-08-25 15:29:08 UTC Size: 2.9 GB Sectors: Government, Finance, Construction
Elixi International SA
tracker page ↗
space bearsfilter this group · Aug 10, 2026Elixi International SA is a Swiss pharmaceutical distributor (headquartered in Chiasso, founded in 2016) specializing in the global supply of both licensed and unlicensed medicinal products, including expanded access programs for patients.The company operates on a B2B model, serving hospitals, clinics, and pharmacies, ensuring quality through its Swissmedic license and robotic authenticity control systems, while prioritizing the rapid delivery of life-saving medicines.In addition to Switzerland, it has offices in Singapore.-SQL Data-Personal information of employees and clients-Financial documents https://www.elixi-int.com/
City of Winchester
tracker page ↗
qilinfilter this group · Aug 10, 2026Government
B Wright Drywall
tracker page ↗
qilinfilter this group · Aug 10, 2026Construction
Cook Remodeling
tracker page ↗
global secret groupfilter this group · Aug 10, 2026Country: Arizona, United States Website: cookremodeling.com | Revenue: $5 Million | Industry: Construction Management | Employees: 11-50 Properties: 23.2 GB (47,193 Files, 8,323 Folders)
MACOFIN HELLAS S.A.
tracker page ↗
global secret groupfilter this group · Aug 10, 2026Country: Greece | Website: maco-fin.com | Revenue: $10 Million | Industry: Real Estate / Asset Management / Investment Services | Employees: 11–50 Employees | Properties: 55.3 GB (48,089 Files, 7,491 Folders)
T.RAD North America
tracker page ↗
wallstreetfilter this group · Aug 10, 2026T.RAD North America (tradna.com) is a Hopkinsville, Kentucky-based manufacturer focused on heat exchangers for thermal-management applications such as vehicle powertrains, HVAC/architectural systems, and emerging technologies like battery and fuel-cell cooling.
Black Hills Bentonite
tracker page ↗
wallstreetfilter this group · Aug 10, 2026Black Hills Bentonite LLC (bhbentonite.com) is a Wyoming-based producer of high-quality sodium bentonite, along with lignite-related products, supplying global industrial and commercial uses such as drilling fluids, environmental/civil engineering sealing, absorbents (including cat litter), and metal casting/foundry applications
DECK APP TECHNOLOGIES PTE. LTD
tracker page ↗
unsafefilter this group · Aug 10, 2026Revenue: $5 million | Views: 87 | Posted: 8/10/2026, 2:44:12 PM | Status: 9d 22h 42m 45s
Southern Metals
tracker page ↗
stormfilter this group · Aug 10, 2026E-commerce | Charlotte, North Carolina, United States | Southern Metals Company, based in Charlotte, NC, specializes in the recycling of ferrous and non-ferrous metals, including steel, brass, copper, aluminum, and automobile bodies. Established in 1938, the company is committed to responsible recycling, superior customer service, and providing exceptional value for recyclable products. Serving a diverse clientele throughout the Carolinas, Southern Metals has built a reputation for integrity and efficiency over its long history. The company continues to uphold the principles set by its founders while adapting to modern recycling needs. The company headquarters is located in 2200 Donald Ross Road, Charlotte, NC 28208, United States. 51-200 Employees | Deadline: 2026-09-11T10:06:27.000Z
TRP International
tracker page ↗
stormfilter this group · Aug 10, 2026E-commerce | Elkhart, Indiana, United States | TRP International, LLC specializes in the distribution of high-quality components for various markets, including axle manufacturers, boat trailer manufacturers, and specialty vehicle manufacturers. The company utilizes state-of-the-art technology and strategically located distribution centers to ensure efficient order processing and delivery across the U.S., Canada, and Mexico. With a strong focus on engineering, quality, and lean manufacturing principles, TRP is committed to meeting and exceeding customer specifications. Their ISO 9001:2015 certification underscores their dedication to quality and continuous improvement in their product offerings. The company headquarters is located in 22420 Challenger Drive, Elkhart, IN 46514, United States. 51-200 Employees | Deadline: 2026-09-09T10:04:14.243Z
Supportive Insurance Services
tracker page ↗
stormfilter this group · Aug 10, 2026FinTech | Vincennes, Indiana, United States | Supportive Insurance Services is a specialized insurance compliance firm that provides comprehensive licensing solutions for agents, agencies, adjusters, and carriers across the United States. The company helps clients navigate complex, state-specific regulatory requirements, ensuring full compliance while reducing administrative burdens and operational risk. By managing every aspect of the licensing process with precision and personalized service, Supportive Insurance Services enables insurance professionals to focus on client service and business growth. The firms expertise, deep industry knowledge, and client-centered approach make it a trusted partner for insurance organizations seeking efficient and reliable licensing support. The company headquarters is located in 1610 S Old Decker Road, Vincennes, IN 47591, United States. 11-50 Employees | Deadline: 2026-09-07T10:01:20.790Z
Zion Contracting
tracker page ↗
the gentlemenfilter this group · Aug 10, 2026zioncontracting.com Zion Contracting LLC is a trusted general contractor based in New York, specializing in complex infrastructure and transportation projects. As a certified MBE, DBE, and SBE firm, they partner with government agencies to help fulfill minority and diversity contracting goals. Their main focus is delivering essential public works projects that strengthen communities across the state
Premier Pigs
tracker page ↗
the gentlemenfilter this group · Aug 10, 2026premierpigs.com zoominfo.com/c/premier-pigs/458500816 Grupo Premier Pigs is a family-owned agricultural company based in Spain, founded in 1992 and specializing in the swine farming industry. Operating as a major pig farming integrator, the business manages its own breeding and fattening farms alongside a dedicated feed production mill. The organization is committed to sustainable livestock practices and comprehensive agricultural management, which also includes cereal farming.
NTU Alumni Club
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026ntualumni.org.sg zoominfo.com/c/ntu-alumni-club/447180090 The NTU Alumni Club is an independent association for graduates of Nanyang Technological University in Singapore. It serves as a dedicated platform for alumni to connect, network, and maintain a lifelong relationship with their alma mater. Members enjoy exclusive perks, career opportunities, and access to physical facilities like lounges and co-working spaces at their clubhouse.
Canopy Support Services
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026canopysupport.ca zoominfo.com/c/canopy-support-services/347650822 Canopy Support Services is a community-based organization in Peterborough, Ontario, dedicated to supporting individuals with intellectual and developmental disabilities. They provide a safe, welcoming environment for people, including those with Autism Spectrum Disorder, to learn new skills and achieve their personal goals. The organization empowers its clients to overcome everyday barriers, build self-confidence, and lead more independent lives
Mikel Coffee
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026mikelcoffee.com zoominfo.com/c/mikel-coffee/456172290 Mikel Coffee Company is a prominent Greek coffeehouse chain that began its journey in 2008 in the city of Larissa. It has rapidly expanded into a global brand, operating a network of over 410 coffee shops across 19 different countries. The company offers a comprehensive menu of premium coffee blends, beverages, snacks, and retail products, focusing on delivering a unique and welcoming coffee experience.
Zion Construction
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026zionconstructioninc.com Zion Construction Inc is a reputable general contracting and home building company based in Ephrata, Washington. With over three decades of industry experience, they specialize in custom homes, remodeling, and general construction services. The company is recognized for delivering high-quality residential projects and is highly rated among contractors in the region.
Hong Kong Baptist University
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026hkbu.edu.hk zoominfo.com/c/hong-kong-baptist-university/429650952 Hong Kong Baptist University (HKBU) is a leading public research university established in 1956 in Hong Kong. It is highly regarded for its academic excellence, particularly in liberal arts, business, communication, and traditional Chinese medicine. As one of the region's eight statutory publicly funded universities, it is dedicated to fostering global citizenship and innovative research.
Eva Care
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026evacare.com rocketreach.co/eva-care-profile_b7a227f8c53b4785 Eva Care Group is a healthcare provider specializing in the post-acute care industry, headquartered in Los Angeles, California. With over 50 years of combined experience, the company operates and manages a network of nursing homes and rehabilitation facilities. They deliver comprehensive solutions encompassing clinical, financial, operational, and environmental management to ensure high-quality patient care.
[DISCLOSED]Nichirei
tracker page ↗
ransomhousefilter this group · Aug 9, 2026No details on the leak post beyond the victim name.
PharmaEssentia
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026pharmaessentia.com zoominfo.com/c/pharmaessentia-corp/145441146 PharmaEssentia is a global biopharmaceutical innovator founded in 2003 and headquartered in Taiwan. It specializes in developing best-in-class therapies and biologics for blood disorders, hematologic cancers, and other serious diseases. The company is fully integrated and operates internationally with a strong commercial and clinical presence in the U.S., Europe, and Japan.
CONTAC Ingenieros
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026contac.cl zoominfo.com/c/contac-ingenieros-division-sistemas/372522727 Contac is a technology company based in Santiago, Chile, specializing in operations and asset management technologies. They provide comprehensive automation services and real-time information systems to help industrial clients maximize their operational performance. The company focuses on delivering custom solutions to optimize asset management, reduce costs, and improve overall system reliability.
RAK Construction
tracker page ↗
the gentlemenfilter this group · Aug 9, 2026rakconstruction.in zoominfo.com/c/rak-construction/1266108608 RAK Construction is a premier construction company based in Bangalore, India, with over 20 years of industry experience. They specialize in delivering high-quality residential and commercial building projects as a leading civil contractor. The company employs a dedicated team of professionals focused on providing reliable construction and contracting services.

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.