Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
204
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 114 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 45 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 114 | 114 | active | no public figure | |
| 9 | lockbit5 | 5 | ▼2 | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 22 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure | |
| 25 | cyberleek | 0 | = | 12 | 12 | 12 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,841 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
moebelmayer.de tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Founded in 1952 and headquartered in Ahrensburg, Schleswig-Holstein, the family-owned company has more than seventy years of experience serving customers … |
paritaet-nrw.org tracker page ↗ | safepayfilter this group | · Jul 27, 2026 | Headquartered in Wuppertal, the organization represents approximately 3,100 legally independent member organizations operating more than 7,000 social institutions and services … |
The Mountain tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Kates Nussman Ellis Earle & Landolfi LLP tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Akribis Systems Pte Ltd tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Thai Seng International Co. Ltd tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
MKS Transformator tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
OPTIDEA GmbH tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Furama Bukit Bintang tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
K. Venkatesh, Co tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Wings Argo Private Limited tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
KSL Dirtworks LLC tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Diffusion de Produits Inoxydables tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
TFG Benefits, Inc. tracker page ↗ | nightspirefilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Groupe Fenwick tracker page ↗ | qilinfilter this group | · Jul 27, 2026 | Business Services |
BH Security, LLC. (brinkshome.com) tracker page ↗ | shinyhuntersfilter this group | · Jul 27, 2026 | Over 4.9 million Salesforce records containing some PII was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
RingCentral, Inc. tracker page ↗ | shinyhuntersfilter this group | · Jul 27, 2026 | Over XX of data was compromised. This is a final warning to reach out by 30 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Ernst & Young tracker page ↗ | shinyhuntersfilter this group | · Jul 27, 2026 | Yes it was us. Now come talk to us. We have been trying to reach you. If you do not come talk to us within the given deadline, we fully and completely intend to release all the data and files. This is a final warning to reach out by 31 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline. |
Colliers Real Estate tracker page ↗ | coinbase cartelfilter this group | · Jul 27, 2026 | Real Estate - $5.7 Billion |
Park Manufacturing Corp. tracker page ↗ | global secret groupfilter this group | · Jul 27, 2026 | Overview Country: Cambridge, Minnesota 55008, US | Website: parkmfg.com | Revenue: $37.9 Million | Industry: Appliances, Electrical, and Electronics Manufacturing | Employees: 50-100 | Properties: 195 GB (411,109 Files, 48,413 Folders) Detailed Analysis PARK Manufacturing is the preferred source for wire harnesses, cable assemblies, and electro-mechanical assemblies. We use the industry’s highest level of automation to provide our customers with cost competitive solutions and unparalleled consistency. |
Louisiana Coalition Against | Domestic Violence tracker page ↗ | global secret groupfilter this group | · Jul 27, 2026 | Overview Country: US | Website: lcadv.org | Revenue: $13.3 Million | Industry: Non-Profit & Charitable Organizations | Employees: 201-500 | Properties: 241 GB (287,451 Files, 31,100 Folders) Detailed Analysis The Louisiana Coalition Against Domestic Violence is dedicated to eliminating domestic violence through support, public policy, and education. They provide resources and assistance to individuals affected by domestic violence, including a statewide hotline available 24/7. Their programs empower people from all backgrounds to recognize signs of abuse and seek help. The coalition also encourages community involvement through donations, training programs, and advocacy efforts. |
Hinduja Tech | BMW Group & Škoda Auto tracker page ↗ | global secret groupfilter this group | · Jul 27, 2026 | Overview Country: India | Website: hindujatech.com | Revenue: $381 Million | Industry: Engineering Services, Architecture, Engineering & Design, Product Engineering Solutions | Employees: 2000-5000 | Properties: 515 GB (212,785 Files, 83,982 Folders) Detailed Analysis Hinduja Tech (HT), part of the multi-billion-dollar global business conglomerate, Hinduja Group, provides product and digital engineering solutions. The services are catered to the disruptive mobility segment, especially in the electric and autonomous space. Hinduja Tech’s product engineering services division has inherited decades of automotive product development expertise in our DNA, and we offer full vehicle and powertrain development services from concept through SOP for ICE vehicles and EVs. Headquartered in Chennai, Hinduja Tech has pioneered automotive product co-development using its unique ‘Frugal EngiNEARing Paradigm’ with a strong focus on 'zero-based design to cost process' and delivered award-winning programs. Focused on the automotive industry, Hinduja Tech’s digital technologies services & solution division is a co-innovation partner for SAP/ERP services and offers enterprise mobility services, full stack IT development, testing, and maintenance using its own agile development methodology and accelerators. Our 100+ client list includes Top Global Auto OEMs, leading disruptive and emerging OEMs, & Global Tiers in Asia, North America, Europe and the Middle East. Hinduja Tech is strengthened by its subsidiaries: Drive System Design (DSD): Experts in electrified propulsion systems, transmission and driveline design, and energy efficiency improvements for hybrid and electric vehicles. https://www.drivesystemdesign.com/ TECOSIM Group: Pioneers in advanced simulation and clean energy solutions, catering to automotive, energy, and industrial sectors globally. https://tecosim.com/ Together, we drive excellence in sustainable mobility engineering. Office Location: India- Chennai, Bengaluru,… |
Spergel tracker page ↗ | global secret groupfilter this group | · Jul 27, 2026 | Overview Country: Canada | Website: spergel.ca | Revenue: $28.2 Million | Industry: Business Services,Project Management | Employees: 51-200 | Properties: 5.4 TB (7,830,792 Files, 902,844 Folders) Detailed Analysis Spergel is here to make debt relief feel less overwhelming — and a lot more human. For over 35 years, we’ve helped Canadians navigate debt with clarity, compassion, and real solutions that fit their lives. Whether you’re facing overwhelming credit card or business debt, worried about affording household expenses or having enough for retirement, our experts are here to guide you through your options and get you real results. |
Savills France tracker page ↗ | qilinfilter this group | · Jul 27, 2026 | Construction |
Wilbert's tracker page ↗ | qilinfilter this group | · Jul 27, 2026 | Automotive Parts |
Katathani Phuket Beach Resort tracker page ↗ | dragonforcefilter this group | · Jul 27, 2026 | Katathani Phuket Beach Resort is a luxury beachfront resort located on Kata Noi Beach in Phuket, Thailand, offering a range of accommodations from suites to fam... |
Tesco Engineer tracker page ↗ | deadlockfilter this group | · Jul 27, 2026 | Tesco Engineer Co., Ltd. is a Thai construction and manufacturing company based in Bangkok, operating in civil engineering and industrial pipe manufacturing since 1976. |
Hardware Asesorias Software Ltda tracker page ↗ | deadlockfilter this group | · Jul 27, 2026 | Hardware Asesorías Software Ltda (HAS Ltda) is a technology provider based in Bucaramanga, Colombia, specializing in the distribution of hardware and software licenses . The company acts as an official partner for brands such as Apple, Adobe, and HP, serving business customers, government agencies, and engineering firms. |
takethehop.com tracker page ↗ | inc ransomfilter this group | · Jul 27, 2026 | No details on the leak post beyond the victim name. |
Williams Accounting Professional tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A full service CPA firm |
JJP Slip Forming Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A company that operates in the Restaurants industry |
Building Envelope Systems tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A reputable construction company based in Plainville, MA |
Westlake Realty Group, Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A full-service real estate development company |
Servonix Technologies tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A provider of IT services |
Infinity Pipeline,Inc. tracker page ↗ | genesisfilter this group | · Jul 27, 2026 | A family owned, local construction company. |
High Class Car Limo tracker page ↗ | deadlockfilter this group | · Jul 26, 2026 | High Class Limousine & Car Service Corp. is a licensed private passenger transportation service in New York City, founded in 1995, specializing in non-emergency medical transportation . The company provides rides to medical appointments, dialysis sessions, and rehabilitation facilities, and has locations in Manhattan and the Bronx. |
West African Resources ltd tracker page ↗ | deadlockfilter this group | · Jul 26, 2026 | West African Resources Limited (ASX: WAF) isan Australia-based, mid-tier gold mining and exploration companywith its primary operations located in Burkina Faso, West Africa . Founded in 2006, the company is headquartered in Subiaco, Western Australia, and focuses on the acquisition, development, and mineral processing of high-grade gold assets. |
Caspian One tracker page ↗ | deadlockfilter this group | · Jul 26, 2026 | Caspian One is an international provider of IT services and specialist talent for industries such as FinTech investment banking and broadcasting. Based in England the company offers professional recruitment and managed technology solutions and operates in Europe and North America. |
Syntron Bioresearch tracker page ↗ | dragonforcefilter this group | · Jul 26, 2026 | Syntron Bioresearch, Inc. specializes in manufacturing rapid in vitro diagnostic tests and detection readers, focusing on fertility and over-the-counter tests f... |
Deluxe Medical Supply tracker page ↗ | dragonforcefilter this group | · Jul 26, 2026 | Deluxe Medical Supply is a distributor of healthcare supplies that focuses on delivering quality home healthcare products and services. They provide a wide rang... |
remco.ca tracker page ↗ | chaosfilter this group | · Jul 26, 2026 | Founded in 1977 and headquartered in Quebec, Canada, Remco is an industry leader in warehousing, transportation and country-wide distribution for the retail industry |
Universitatea de Vest „Vasile Goldiș” din Arad tracker page ↗ | qilinfilter this group | · Jul 26, 2026 | Education |
Contacto Garantido tracker page ↗ | qilinfilter this group | · Jul 26, 2026 | Finance |
UK Department for Education (education.gov.uk) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Police National Legal Database tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Microsoft tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Allstate tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
TaylorMade & Sun Day Red golf tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Frontier Airlines tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Zenith Bank Plc tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
District of Columbia Public Schools (dcps.dc.gov) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Newcastle University (ncl.ac.uk) tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Viavi Solutions tracker page ↗ | exfilsquadfilter this group | · Jul 26, 2026 | No details on the leak post beyond the victim name. |
Novum Energy tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: Texas, United States | Website: novumenergy.com | Revenue: $966 Million | Industry: Convenience Stores, Gas Stations & Liquor Stores | Employees: 51-200 | Properties: 842 GB (971,325 Files, 117,085 Folders) Detailed Analysis Novum Energy is a physical supply and trading company founded on the beliefs that every client is different and that service should be tailored to individual customer needs. Our customer driven company is focused on attending our client's particular requests. We are not only set apart from our competition by our expert team, who has extensive experience in the oil industry; but also, we are committed to customer service. Novum Energy honors the trust our customers instill in us and that is why trust, commitment, and quality are the pillars of our business |
Uniview Technologies tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: China | Website: uniview.com | Revenue: $610 Million | Industry: Manufacturing, Electronics | Employees: 1000-5000 Employees | Properties: 1.5 TB (2,172,194 Files, 114,352 Folders) Detailed Analysis We have 1.5 TB of the company’s confidential data. We have all the company’s passwords and those of its employees from all devices, and we have a complete set of documents for all employees (approximately 10,000 employees), including their passport information and all additional documents! We have access to all employees’ personal social media accounts as well as the company’s IT infrastructure. We also have all the company’s databases, all financial transactions, and all invoices. There are many confidential contracts and even top-secret agreements between the company and other countries and companies. We have photos and videos showing that the company’s cameras are used in places such as prisons, hospitals, cities, and many private projects—we have all this data. We’ll attach a lot of other interesting material later... Thank you for your attention! Uniview Technologies Co Ltd is the third-largest video surveillance manufacturer in China and fourth-largest globally, having achieved approximately 13-fold revenue growth since its founding in 2011. Differentiated by its core networking expertise, Uniview approaches the CCTV and video surveillance market with a technology-forward strategy that sets it apart from traditional competitors. The company prioritizes continuous research and development to maintain competitive advantage in a market where technological capabilities are superseded every three years, enabling Uniview to deliver professional, reliable, and cutting-edge surveillance products and services designed to build safer communities worldwide. With operations spanning 145 countries and regions, Uniview has established 12 international subsidiaries and branch offices to provide timely sales and localized support, with plans for continued… |
OFS tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: Indiana, United States | Website: ofs.com | Revenue: $517.1 Million | Industry: Furniture,Manufacturing,Transportation | Employees: 1K - 5K | Properties: 321 GB (322,742 Files, 18,081 Folders) Detailed Analysis OFS is a family owned, community-driven parent company providing socially responsible furniture and logistics solutions in markets across the world. Established in 1937 in Huntingburg, Indiana, OFS has grown into a global leader while staying true to its local roots and core values of sustainability and craftsmanship. |
Portman Finance Group tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: United Kingdom | Website: portmanfinancegroup.co.uk | Revenue: £300 Million | Industry: Finance | Employees: 1000-5000 Employees | Properties: 209 GB (255,244 Files, 34,852 Folders) Detailed Analysis We uncovered all passwords and access credentials to the company’s portals, identified all of the company’s databases, and exposed the company’s fraudulent schemes and money laundering operations! We also uncovered more than 10,000 customer passports and hundreds of thousands of pieces of personal data, including residential addresses and email addresses. The employees of this company are extremely careless and indifferent toward their work! In addition to the customers, the company’s employees were also affected, and all personal data—including employees’ incomes and salaries—was exposed! We also took care of sending an email to all employees via their personal email accounts, urging them to sue the company and demand compensation! "Portman Finance Group" - is a specialist business to business finance broker and lender, providing a personal and professional approach to SME funding for over 20,000 businesses and securing over £1.5bn in funding since 2007. We support limited companies in any sector, working with local independent businesses right through to household names. Your dedicated account manager will try to help regardless of your credit history and aim for a single lender or combination that provides the finance you need, tailored to your business. Spread the cost of new equipment or boost your cashflow. Get what your business needs now and realise your ambition. The new Growth Guarantee Scheme is now available. Government-backed funding where your principal private residence cannot be taken as security and a 70% guarantee to lenders increases their appetite to support small businesses. |
Cold Front Distribution tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: Colorado, United States | Website: coldfrontdist.com | Revenue: $120.1 Million | Industry: Transportation | Employees: 201-500 Employees | Properties: 473 GB (890,775 Files, 51,621 Folders) Detailed Analysis "Cold Front Distribution" - is a leading DSD supplier specializing in grocery and foodservice supply chain solutions across a fifteen-state region. The company focuses on delivering high-quality products, including ice cream, frozen pizza, and frozen prepared foods, to various clients such as convenience stores, drug stores, military commissaries, and retail grocery outlets. With a commitment to customer success, Cold Front aims to optimize operations and enhance profitability for businesses of all sizes. Their services include turn-key convenience store programs and effective merchandise management solutions. |
Nourison | Home tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: New Jersey 07663, US | Website: nourison.com | Revenue: $59.4 Million | Industry: Wholesale, Furniture, Home Decor, Retail, Real Estate | Employees: 100-300 | Properties: 799 GB (93,941 Files, 13,733 Folders) Detailed Analysis Nourison is the leading multi-category resource in today’s floor covering market. Our company offers comprehensive programs from signature At Nourison Home, we’ve got something for everyone. Nourison Home provides a seamless blend of style, quality, and value that caters to our customers’ desire for a thoughtfully designed home that reflects their values. Our products are intentionally crafted to simplify placement and upkeep, freeing our customers to unwind and appreciate their newly personalized living spaces. Nourison Home inspires joy with designs that both look and feel good. Comments and posts by users on this site are not created or controlled by Nourison Home and Nourison is not responsible for such content. |
SPDM tracker page ↗ | global secret groupfilter this group | · Jul 26, 2026 | Overview Country: Brazil | Website: spdm.org.br | Revenue: $197 Million | Industry: Hospitals & Clinics | Employees: 10.000 - 20.000 | Properties: 847 GB (871,912 Files, 76,047 Folders) Detailed Analysis SPDM - Associação Paulista para o Desenvolvimento da Medicina is a non-profit, philanthropic civil association, recognized as a public utility at the federal, state, and municipal levels where its headquarters are located, respectively by decrees nos. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.