Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
199
Leak-site victims · 30d
1K
Active groups · 30d
7910 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲17 | 123 | 365 | 365 | active | no public figure | |
| 3 | krybit | 15 | ▲15 | 49 | 95 | 95 | active | no public figure | |
| 4 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲4 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 9 | = | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼7 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | ▼1 | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | ▲1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,845 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
GILDE Handwerk Macrander GmbH & Co. KG tracker page ↗ | aurorafilter this group | · Aug 4, 2026 | GILDE Handwerk Macrander GmbH & Co. KG is a family-owned German Mittelstand group headquartered in Bocholt, Nordrhein-Westfalen. The GILDE Gruppe operates across wholesale trade in gifts, home accessories, and furniture through brands including GILDE Handwerk, Fink Living, and HAKU Möbel, with 50+ legal entities spanning Germany, Austria, the Netherlands, France, the UK, and Hong Kong. The exposed material includes: 148+ personal ID document scans — Personalausweise (national ID cards), Reispässe (passports), Führerscheine (driver's licences), and Heiratsurkunden (marriage certificates) for employees, directors, and family members. Names range from warehouse staff to the CEO. ELSTER tax certificates for 50+ entities — the digital keys for filing tax returns with the German Finanzamt, plus personal certificates for directors and family members. Enables fraudulent VAT returns and income tax filings. Full employee payroll records (2006–2025) — tax IDs (Steuer-IDs), social security numbers, bank accounts, salary details, sick notes (Krankmeldungen), and disciplinary records for an estimated 200–400 current and 200–500 former employees across all entities. 20 years of consolidated financial records — balance sheets, P&L statements, bank reconciliations, loan documentation, shareholder agreements, and capital contribution records for the entire group from 2004 to 2025. 1,800+ Access databases — inventory valuations, customer lists, supplier terms, product pricing, and order history spanning the entire commercial operation. |
clintonhealthaccess.org tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
pushidrosal.id tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
lccgroup.com tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
https://geleximco.vn/ tracker page ↗ | inc ransomfilter this group | · Aug 4, 2026 | No details on the leak post beyond the victim name. |
azn.co.jp tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1991, the company specializes in comprehensive asset management, inheritance planning, business succession consulting, real estate advisory services, and … |
southshorerecycling.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | The company specializes in metal recycling, concrete and asphalt recycling, aggregate production, and construction waste processing for commercial, industrial, and … |
cpu-ag.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1981 and headquartered in Friedberg, Bavaria, the company has more than four decades of experience developing specialized software … |
multiaqua.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Founded in 1999, the company specializes in the design, engineering, and production of air-cooled water chillers, heat pump chillers, hydronic … |
pradotuylaw.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | The firm focuses on practice areas including personal injury, wrongful death, workplace harassment, business litigation, civil settlements, and environmental litigation. … |
naskdoorinc.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in West Chester, Pennsylvania, the company has served customers throughout southeastern Pennsylvania and northern Delaware for several decades. Although … |
new-point.it tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Signa, Florence, Italy, the company was founded in 2006 and has grown into one of Italy's established suppliers … |
simonrack.com tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Alfamén, Zaragoza, Spain, the company has been manufacturing metal shelving since 1964 and has become one of Europe's … |
hanan-hov.co.il tracker page ↗ | safepayfilter this group | · Aug 4, 2026 | Headquartered in Neve Yamin, Israel, the company provides comprehensive logistics support for construction, infrastructure, industrial, and commercial projects throughout the … |
Service Electric tracker page ↗ | qilinfilter this group | · Aug 4, 2026 | Software |
Universitatea De Vest Vasile Goldi Din Arad tracker page ↗ | qilinfilter this group | · Aug 4, 2026 | Education |
Camandona SA tracker page ↗ | majinahanashifilter this group | · Aug 4, 2026 | TARGET: https://www.camandona.ch/ REVENUE: $61.7M EMPLOYEES: 200 Camandona SA is a major Swiss construction and road-building company founded in 1948 and based in the French-speaking canton of Vaud. It specializes in asphalt paving, road construction, civil engineering, building demolition, and the recycling of construction materials. HQ: Rue de Cossonay 30, 1023 Crissier, Switzerland Phone: +41 21 632 89 00 Email: [email protected] Website: https://www.camandona.ch/ Package: 12.1 GiB / 9584 files File manager: http://cc666mzpsjhn3yi6t7hqkwi5thjeh7prxg3mndpceb7xtchsbsmct3ad.onion/dl/47c27aa75b082421627fc9a7491eaabd |
Winn-Dixie tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Inside a multibillion-dollar retail giant. |
BLACKBURN'S tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Major home healthcare provider data breach. |
Cameron Regional Medical Center tracker page ↗ | anubisfilter this group | · Aug 3, 2026 | Patient and employee data breach at a healthcare provider. |
PCL Holding tracker page ↗ | ransomhousefilter this group | · Aug 3, 2026 | No details on the leak post beyond the victim name. |
[DISCLOSED]Fidelity Services Group tracker page ↗ | ransomhousefilter this group | · Aug 3, 2026 | No details on the leak post beyond the victim name. |
Belasco Electric tracker page ↗ | akirafilter this group | · Aug 3, 2026 | Belasco Electric is a reliable electrical service provider based in Muskegon, Michigan, catering to both residential and commercial clients. They offer a wide range of services including emergency generator systems, fire alarm security systems, HVAC wiring, and EV installation.We will upload 16gb corporate data soon. Employee information (name, home addresses, passport, SSN, DL numbers, photos, credit card scans and so on), financials, contracts and agreements, NDA, etc. |
Albers Mechanical Contractors tracker page ↗ | akirafilter this group | · Aug 3, 2026 | Albers Mechanical Contractors specializes in custom fabrication, welding, stainless steel fabrication, and dust collection HVAC solutions. With over 54 years of experience, they provide design and on-site consultations, positioning themselves as leaders in facility solutions.We will upload 30gb corporate data soon. Employee information, financials, contracts and agreements, NDA, customers information, etc. |
Freedom Claims Management tracker page ↗ | qilinfilter this group | · Aug 3, 2026 | Insurance |
Hans & Jos. Kronenberg GmbH tracker page ↗ | payloadfilter this group | · Aug 3, 2026 | Hans & Jos. Kronenberg GmbH is a German company founded in 1932 and based in Bergisch Gladbach. It specializes in the development and manufacturing of high-quality components for the elevator industry and mechanical engineering, including door locks, switches, control panels, and LED lighting. |
Baicizhan tracker page ↗ | dragonforcefilter this group | · Aug 3, 2026 | Baicizhan is a language learning platform specializing in English instruction. It offers a wide range of tools and resources designed to help users overcome the... |
TUI China tracker page ↗ | dragonforcefilter this group | · Aug 3, 2026 | An affiliate of TUI Group, the world's number one leisure tourism business, TUI China was established in late 2003 as the first joint venture with foreign major... |
www.prohealth.sg tracker page ↗ | krybitfilter this group | · Aug 3, 2026 | ProHealth Medical Group Pte Ltd is a Singaporean private primary healthcare group founded in the 1990s, headquartered at... |
Goccia S.p.A. tracker page ↗ | majinahanashifilter this group | · Aug 3, 2026 | TARGET: https://www.joygioielli.com/ https://www.gocciagioielli.com/ REVENUE: €19.2M EMPLOYEES: ~ Package: 320 MiB / 3557 files |
SCHMITZ & NITTENWILM tracker page ↗ | majinahanashifilter this group | · Aug 3, 2026 | TARGET: schmitz-nittenwilm.de REVENUE: €13,8M EMPLOYEES: ~ Package: 3.2 GiB / 886 files |
INTERTRUST AUSTRALIA PTY LTD tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Real Estate |
Asset Flooring Group Australia tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Construction |
sirsa.it tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | SIRSA operates in the field of processing and molding plastic materials, offering concrete, safe, an... |
sms-sme.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | SMS-SME is a global leader in marine cargo access and securing equipment, specializing in RORO equip... |
adventusasia.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Adventus is a Top-Rated Information and Communications Technology (ICT) Solutions and Services Provi... |
pcclimitedindia.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | PIONEER COLDSTORE & CLADDING PVT. LTD. (PCC) is Leading Manufactures of insulated Panels for Coldsto... |
delkartindustries.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Delkart Industries Limited specializes in manufacturing high-quality custom felts, automobile carpet... |
micropack.com.ar tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Micropack is a well-known food and household goods distributor that has been serving businesses and... |
setic-pourtier.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Consolidating gains and preparing the future, Setic, Pourtier C2S help you to stay ahead of the prod... |
microphase.com tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Microphase Corporation is an innovative and trusted customer-driven supplier of advanced electronic... |
rai.com.br tracker page ↗ | lockbit5filter this group | · Aug 2, 2026 | Grupo Rái is one of the largest independent communication groups in Brazil, consisting of six specia... |
ecfa.org tracker page ↗ | inc ransomfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Mairie de Drancy tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Government |
The Saturday Evening Post tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Advertising & Marketing |
Commercial Furniture Interiors tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Architecture, Engineering & Design |
Dienst Pack Systems tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Industrial Machinery & Equipment |
Ceragres tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Home Improvement & Hardware Retail |
Pointe Property Group tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Real Estate |
Schreiner Trockenbau GmbH tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Home Improvement & Hardware Retail |
Wire Products tracker page ↗ | qilinfilter this group | · Aug 2, 2026 | Manufacturing |
The Butcher Brothers tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Sigma Plastics Group tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Cambridge Management tracker page ↗ | playfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
www.buzztrading104.co.za tracker page ↗ | krybitfilter this group | · Aug 2, 2026 | Buzz Trading 104 (Pty) Ltd (also trading as Master Products) is a South African privately owned manufacturer and wholesa... |
www.ville-rinxent.fr tracker page ↗ | krybitfilter this group | · Aug 2, 2026 | Mairie de Rinxent (Municipality of Rinxent) is the official website of the town hall (mairie) of Rinxent, a small French... |
countrymotors.com.mx tracker page ↗ | krybitfilter this group | · Aug 2, 2026 | Country Motos S.A. de C.V. (also known as Country Motors or Country Honda) is a Mexican motorcycle dealership and multi-... |
www.dcpartner.co.za tracker page ↗ | krybitfilter this group | · Aug 2, 2026 | DC Partner (Pty) Ltd is a South African market-leading Payment Distribution Agency (PDA), one of only four NCR-accredite... |
nigeria.asa-international.com tracker page ↗ | krybitfilter this group | · Aug 2, 2026 | ASHA Microfinance Bank Limited (ASA Nigeria) is a Nigerian for-profit deposit-taking microfinance institution, a fully l... |
quantinuum.com tracker page ↗ | inc ransomfilter this group | · Aug 2, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.