Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
183
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 25 | ▲11 | 119 | 360 | 360 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | = | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 23 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 24 | rhysida | 1 | ▼3 | 12 | 14 | 14 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,830 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Lancesoft India tracker page ↗ | the gentlemenfilter this group | · Aug 9, 2026 | lancesoft.in zoominfo.com/c/lancesoft-india/547301190 LanceSoft India is a key division of a global workforce solutions and IT services company founded in 2000. Based in Bengaluru, it employs thousands of professionals to deliver comprehensive staffing solutions, including temporary and permanent placements. The company connects businesses worldwide with top-tier talent across diverse industries such as IT, engineering, and healthcare. |
AIMS Group tracker page ↗ | the gentlemenfilter this group | · Aug 9, 2026 | aimsgroup.com AIMS Group LLC is a major conglomerate based in Ajman, UAE, established in 2003 with a workforce of thousands. It operates primarily in the environmental services and construction sectors, specializing in infrastructure and road development. The company provides comprehensive industrial solutions, including asphalt production, building materials supply, and fleet management |
AnMed tracker page ↗ | the gentlemenfilter this group | · Aug 9, 2026 | anmed.org zoominfo.com/c/anmed/1238269198 AnMed is an independent, not-for-profit health system founded in 1908, serving Upstate South Carolina and northeast Georgia. Its anchor facility, AnMed Medical Center, is a 461-bed acute care hospital located in Anderson, South Carolina. The network provides comprehensive medical services, including emergency care, cardiovascular surgery, advanced imaging, and specialized outpatient clinics. |
Siam Oil Product tracker page ↗ | panzerfilter this group | · Aug 9, 2026 | Siam Oil Product Co., Ltd. is a Thailand-based petroleum and industrial-products distributor, operating for 20+ years with registered capital of THB 200 million and 700+ employees; it supplies fuel oil, diesel, asphalt, base oils, automotive/industrial lubricants, petrochemicals such as HDPE/LDPE/LLDPE, plastic additives, and industrial products, and also operates a coffee-shop franchise business. Its headquarters is at RS Tower, Ratchadaphisek Road, Din Daeng, Bangkok, Thailand. |
MIE Solutions tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Rilpa Enterprises tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Marconi Industrial Services tracker page ↗ | playfilter this group | · Aug 9, 2026 | No details on the leak post beyond the victim name. |
Energetic Development Corp tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Manufacturing |
Panda Logistics Taichung Branch tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Freight & Logistics Services |
East Field Corporation tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Accounting Services |
Chun Tai Sing Chemical Industry tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Chemicals & Related Products |
Synergy Interactive tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Business Services |
Constellation HomeBuilder Systems tracker page ↗ | unsafefilter this group | · Aug 9, 2026 | Revenue: $138.1M | Views: 75240 | Posted: 8/9/2026, 9:25:11 PM | Status: 8d 22h 13m 50s |
pm-energy Die Solarexperten tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Business Services |
Harplast SRL tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Business Services |
Price Shoes tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Retail · Pennsylvania |
Naval Interior Team tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Business Services |
Phithan Phanich tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Automotive Parts |
Grupo Diestra tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Hospitality |
Université Libre de Bruxelles tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Education |
Service d'usinage 9002 tracker page ↗ | qilinfilter this group | · Aug 9, 2026 | Industrial Machinery & Equipment |
| Alcon alcon.com | breach | · Aug 9, 2026 | 218K accounts · breached 2026-08-01 · Email addresses, Names, Phone numbers, Physical addresses · In August 2026, the Alcon eye care company was named in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data allegedly sourced from Alcon containing 218k unique email addresses along with other largely corporate B2B contact fields, including name, phone number and physical address. |
studiotibaldi.it tracker page ↗ | krybitfilter this group | · Aug 9, 2026 | Studio Associato Tibaldi is an Italian professional firm based in Rome, founded over 40 years ago, specializing in condo... |
ETICOD tracker page ↗ | majinahanashifilter this group | · Aug 9, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-16T00:30:00Z Package: 1.6 GiB / 5730 files |
Lucidmotors tracker page ↗ | sovcalifilter this group | · Aug 8, 2026 | The complete engineering archive of Lucid Motors and eShocan is now available: 5.078 terabytes of CATIA and STEP models, FEA and NVH analyses, multi-gigabyte CFD simulations of the LiDAR washing system, topology optimization studies, static and modal results for the Gravity and Midsize enclosures, BOMs, and internal progress reports. |
Daily Trust tracker page ↗ | panzerfilter this group | · Aug 8, 2026 | Daily Trust is a Nigerian news organization that provides breaking news, investigative stories, and various features across multiple sectors including business, politics, sports, and entertainment. The company offers content through print, online platforms, and media outlets like Trust TV and Trust Radio. Its services cater primarily to the Nigerian public, with a focus on providing comprehensive coverage of local and international news. Daily Trust aims to inform and engage its audience through a diverse range of storytelling and analysis. |
Impact Centre Chrétien tracker page ↗ | qilinfilter this group | · Aug 8, 2026 | Business Services |
Clausing tracker page ↗ | qilinfilter this group | · Aug 8, 2026 | Food & Beverage |
CLLS Co Ltd tracker page ↗ | qilinfilter this group | · Aug 8, 2026 | Industrial Machinery & Equipment |
Louisville Bar Association tracker page ↗ | inc ransomfilter this group | · Aug 8, 2026 | No details on the leak post beyond the victim name. |
| Brinks Home brinkshome.com | breach | · Aug 8, 2026 | 732K accounts · breached 2026-07-13 · Dates of birth, Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases · In July 2026, Brinks Home was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published data they alleged was taken from the company, including 732k unique email addresses and other personal information relating to leads, customers and Brinks staff such as name, phone numbers and physical addresses. The data also included purchases from Brinks along with partial credit card data (last 4 digits, card type and expiry). In Brinks' disclosure notice , they acknowledged the incident and risk of disclosure, and advised that they would notify impacted parties "consistent with applicable law". |
Rutan & Tucker, LLP tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Founded in 1909 and headquartered in Costa Mesa, California, Rutan & Tucker, LLP. is a law firm. The F… |
Floyd Skeren Manukian Langevin, LLP tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Floyd Skeren Manukian Langevin, LLP is a multi-service law firm with ten offices throughout California… |
Ropers Majeski PC tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | For more than 75 years, Ropers Majeski has provided high-quality legal advice to a wide range of clien… |
Farella Braun + Martel LLP tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | They offered $520,000 to keep the data from being published. Farella Braun + Martel LLP is a leading N… |
Sandberg Phoenix tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Over 45 years providing superior legal services to clients of every size throughout the Midwest and ac… |
Porter Wright tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Founded in 1846, Porter Wright is a full-service law firm offering legal helo for the community specia… |
Marshall Dennehey tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | They offered $100,000 to keep the data from being published. Founded in 1962 and headquartered in Phil… |
Barclay Damon tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | They are offering 325,000 for the safety of their clients' data. Barclay Damon LLP is a full-service, … |
Fox Rothschild LLP tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Fox Rothschild LLP is an AmLaw 100 full-service law firm built to serve businesses of all sizes as wel… |
Mayer Brown tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | Mayer Brown is a distinctively global law firm, uniquely positioned to advise the world's leading comp… |
Moses & Singer tracker page ↗ | leakeddatafilter this group | · Aug 8, 2026 | They offered $250,000 to keep the data from being published........Moses & Singer LLP is a full-servic… |
CEN and Cenelec tracker page ↗ | coinbase cartelfilter this group | · Aug 8, 2026 | Membership Organizations - $21.9 Million |
MIM Fertility tracker page ↗ | coinbase cartelfilter this group | · Aug 8, 2026 | Healthcare Software - $10.5 Million |
M. B. Kahn Construction Co. tracker page ↗ | coinbase cartelfilter this group | · Aug 8, 2026 | Construction - $500 Million |
Xs Cad tracker page ↗ | coinbase cartelfilter this group | · Aug 8, 2026 | Architecture - $26.9 Million |
MEDICOS 🇫🇷 tracker page ↗ | bravoxfilter this group | · Aug 8, 2026 | European manufacturer of packaging for beauty and food. Expertise in plastic injection molding and drawn glass production. |
UAB Biotecha tracker page ↗ | majinahanashifilter this group | · Aug 8, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-15T22:12:00Z Package: 21.2 GiB / 20888 files |
ALTAIR tracker page ↗ | majinahanashifilter this group | · Aug 8, 2026 | PUBLICATION SCHEDULED. Publication scheduled: 2026-08-15T01:01:00Z Package: 23.9 GiB / 84251 files |
United Group of Companies tracker page ↗ | stormfilter this group | · Aug 7, 2026 | Construction | Troy, New York, United States | Since 1972, The United Group of Companies, Inc. has specialized in all phases of real estate: development, financing, construction, and management. Their specialties include independent senior living, student apartment communities, multi-family (including affordable) housing, commercial properties, and mixed-use neighborhoods. The United Group of Companies is headquartered out of Troy, New York. The company headquarters is located in 300 Jordan Road, Troy, NY 12180, United States. 201-500 Employees | Deadline: 2026-09-04T20:36:13.000Z |
Sawyer Savings Bank tracker page ↗ | stormfilter this group | · Aug 7, 2026 | FinTech | Saugerties, New York, United States | Sawyer Savings Bank is a community-focused financial institution with over 150 years of experience, offering a range of personal and business banking services. Their products include personal checking, savings accounts, business loans, and digital banking solutions designed to enhance customer convenience and security. The bank is dedicated to supporting local communities through various initiatives, including scholarships and volunteerism. Their target clients include individuals seeking personal banking solutions and businesses looking for comprehensive banking support. The company headquarters is located in 87 Market Street, Saugerties, NY 12477, United States.11-50 Employees | Deadline: 2026-09-01T20:31:56.429Z |
Hitech Distribuzione Informatica S.r.l. (HTDI) tracker page ↗ | space bearsfilter this group | · Aug 7, 2026 | HTDI is a leading Italian provider of comprehensive IT solutions based in Rome (Via Tempio del Cielo). It positions itself as a single technological partner that accompanies clients through every stage of the IT infrastructure lifecycle — from design and equipment selection to delivery, installation, integration, and ongoing operation (“turnkey” solutions).The company offers hardware solutions (servers, storage systems, workstations, mobility, and hyperconvergence — certified partner of Dell-EMC, HP, IBM, Lenovo and others), software (middleware, business applications, security solutions, data and business process management — partner of Microsoft, Oracle and other vendors), and full services including design, installation, helpdesk, technical support, system integration, and lifecycle management.Its slogan is “Making IT Happen.” HTDI operates as both a system integrator and IT infrastructure supplier for corporate clients, delivering the entire service cycle in one place. https://www.htdi.it/ |
Alya Construtora tracker page ↗ | ransomhousefilter this group | · Aug 7, 2026 | No details on the leak post beyond the victim name. |
ATMS tracker page ↗ | inc ransomfilter this group | · Aug 7, 2026 | No details on the leak post beyond the victim name. |
Astro Electroplating tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Industrial Machinery & Equipment |
Filtronic tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Manufacturing |
EISNER ZT GMBH tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Construction |
John C Saunders, CPA tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Accounting Services |
Nikan Awasisak Agency tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Government |
Depona tracker page ↗ | qilinfilter this group | · Aug 7, 2026 | Hospitality |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.