Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
207
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
qilin
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 30 | ▲18 | 113 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼7 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 28 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼2 | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,843 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
wikoff.com tracker page ↗ | chaosfilter this group | · Jul 20, 2026 | [PUBLIC DISCLOSURE] Target: Wikoff Color Corporation (wikoff.com) Data Volume: 650 GB Status: Full Compromise Confirmed We are officially confirming that the entire internal infrastructure of Wikoff Color Corporation—ranging from Board of Directors financial reports and proprietary R&D formulas… |
McKeever , Varga & Senko tracker page ↗ | akirafilter this group | · Jul 20, 2026 | McKeever Varga & Senko is a firm of Certified Public Accountants dedicated to providing superior client service and professional guidance. They offer a range of services including informative articles, interactive financial calculators, and links to external resources to assist their clients.We will upload 12gb of corporate data soon. Detailed client internal data, employee personal information, contracts and agreements, confidential files, NDAs, etc. |
L&A Transport tracker page ↗ | akirafilter this group | · Jul 20, 2026 | L & A Transport is a reputable trucking company with over 50 years of experience in providing awide range of shipping services, including international shipping, white glove handling, and logistics solutions for businesses of all sizes. They specialize in truckloads, container loads,less than container truckloads, and offer warehousing services in Union, NJ.We will upload corporate data soon. Detailed financials, employee information (DLs and so on), contracts, client information, NDAs, etc. |
Sirl tracker page ↗ | the gentlemenfilter this group | · Jul 20, 2026 | sirl.pt zoominfo.com/c/sirl/372746430 Portuguese manufacturing company founded in 1988 and headquartered in Penela, Coimbra. It specializes in producing and selling machinery and tools for the civil construction industry.Their flagship products are concrete mixers, complemented by various other construction equipment and welding tools. The company employs 51–200 people and is a recognized supplier in the European construction machinery sector |
| Suno suno.com | breach | · Jul 20, 2026 | 55.3M accounts · breached 2025-11-25 · Email addresses, Names, Partial credit card data, Phone numbers, Physical addresses, Purchases · In November 2025, AI music generation tool Suno suffered a data breach that later came to light in July the following year . The data contained over 55M unique email addresses. Phone numbers were also present where they had been used as the sign-up method. Although representing a small portion of the corpus, the breach also included tens of thousands of Stripe records relating to purchases, containing names, physical addresses, purchase amounts and partial credit card data including the card type, expiry date and last 4 digits. The company advised that "Suno does not have access to customers' full credit card numbers in Stripe". |
Bath Fitter tracker page ↗ | anubisfilter this group | · Jul 20, 2026 | Employee data breach at a major manufacturing company. |
Fairlife / Coca-Cola tracker page ↗ | anubisfilter this group | · Jul 20, 2026 | www.fairlife.com |
| Paidwork paidwork.com | breach | · Jul 19, 2026 | 23.3M accounts · breached 2026-03-29 · Bank account numbers, Dates of birth, Device information, Education levels, Email addresses, Financial transactions, Genders, IP addresses, Names, Passwords, Personal interests, Phone numbers, Physical addresses, Profile photos · In March 2026, hackers claimed they had obtained data from the gig economy platform Paidwork which they then listed for sale . Almost 11GB of data allegedly obtained from the platform was subsequently posted publicly in July and contained over 23M unique email addresses. The breach also included a broad range of other data relating to the operation of the platform including user profile data, banking information, payout history for workers and passwords stored as bcrypt hashes. |
Associated Theatrical Contractors tracker page ↗ | qilinfilter this group | · Jul 19, 2026 | Hospitality |
Don Tortaco Mexican Grill tracker page ↗ | qilinfilter this group | · Jul 19, 2026 | Hospitality |
Dephub tracker page ↗ | novafilter this group | · Jul 19, 2026 | Directorate of Shipping and Maritime Affairs Jl. Medan Merdeka Barat No. 8 Jakarta, Indonesia 10110 |
meralmanisa tracker page ↗ | novafilter this group | · Jul 19, 2026 | MER-AL was established in Turkey in 2005, but our experience in the automotive industry started in Germany in 1995. MER-AL started its activities with the production of cast filters, which are specifically used to produce aluminum wheels and components produced in low-pressure-casting. In addition, a significant part of the production department consists of “rim pallets” and “rim pallet covers.” As a result, MER-AL is now one of the world’s largest manufacturers of cast filters and rim pallet sets and a well-known brand in this field in many countries - 1.5 GB of sales data and secret documents, Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
City Ambulance Service tracker page ↗ | qilinfilter this group | · Jul 19, 2026 | Healthcare Services |
Famesa tracker page ↗ | qilinfilter this group | · Jul 19, 2026 | Business Services |
bluebellgroup.com tracker page ↗ | blackoutfilter this group | · Jul 18, 2026 | Bluebell Group is a Hong Kong-based, family-owned omnichannel brand curat...5 |
Dissinger and Dissinger Law Firm tracker page ↗ | gunrafilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
euroins.bg tracker page ↗ | krybitfilter this group | · Jul 18, 2026 | Euroins Insurance Company AD (Застрахователна компания Евроинс АД) is one of the first a... |
The Nueva School tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Education |
FMZ Tecnologia em Sistemas tracker page ↗ | novafilter this group | · Jul 18, 2026 | FMZ Tecnologia em Sistemas is a Brazilian software company that develops solutions for the book industry. Its main product, HORUS, is an ERP system designed for publishers, bookstores, and distributors. The system helps manage inventory, sales, royalties, and consignment operations. The company has over 15 years of experience and is based in São Paulo, Brazil. |
NewNet tracker page ↗ | dragonforcefilter this group | · Jul 18, 2026 | NewNet S.A. is a Colombian company specializing in managing IT risks, offering advanced and personalized data protection services. Their extensive range of serv... |
KLD Labs tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Manufacturing |
Armara tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Grocery Retail |
Heartland Catfish tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Agriculture |
Salina Supply tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Home Improvement & Hardware Retail |
St Martha Catholic Church tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Non-Profit & Charitable Organizations |
AK Preparedness tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Building Materials |
Sicc tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Building Materials |
v-silicon.com tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
FAST.COM.PH tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
D.MAG New Material Technology Co., Ltd. Taiwan Giant tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
vedan corp tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
pokka.co tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
reatile.co.za tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
V&P Nurseries tracker page ↗ | inc ransomfilter this group | · Jul 18, 2026 | No details on the leak post beyond the victim name. |
Droguería Martorani tracker page ↗ | qilinfilter this group | · Jul 18, 2026 | Drug Stores & Pharmacies |
Ecopetrol tracker page ↗ | the gentlemenfilter this group | · Jul 18, 2026 | $33.1 Billion www.ecopetrol.com.co ECOPETROL copetrol SA is a company organized as a public limited company, of national order, linked to the Ministry of Mines and Energy. It has operations located in the center, south, east and north of Colombia, as well as abroad. It has two refineries in Barrancabermeja and Cartagena. Through its subsidiary Cenit, specialized in hydrocarbon transportation and logistics, it owns three ports for the export and import of fuels and crude oil in Coveñas (Sucre) and Cartagena (Bolvar) with access to the Atlantic, and Tumaco (Nariño) on the Pacific. Cenit also owns most of the country's oil and multi-purpose pipelines that connect production systems with large consumption centers and maritime terminals. Ecopetrol also has a stake in the biofuels business and is present in Brazil, Mexico and the United States (Gulf of Mexico and Permian Texas). CHANGE NEGOTIATOR IMMEDIATLY. CONTACT - CONFIRM. Drop in stock - free gift. |
Powder River Heating & Air Conditioning tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Construction |
Cafar tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Insurance |
Sunway Scientific tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | sun-way.com.tw zoominfo.com/c/sunway-scientific-corp/456158414 SUNWAY Co., Ltd., a leading Taiwanese distributor and exclusive agent for international scientific and laboratory equipment brands (such as HETTICH, EYELA, JASCO, and SHASHIN KAGAKU). The company specializes in providing advanced laboratory solutions, including centrifuges, freeze dryers, spectrometers, and cell disruptors for research, biotech, and chemical industries. |
Military Sealift Command tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | sealiftcommand.com zoominfo.com/c/military-sealift-command/149045906 ITAR documentation, personal data, cargo manifests—including ESSM shipments—vessel blueprints, and both disclosed and undisclosed information. U.S. Navy's Military Sealift Command (MSC). It is the primary provider of ocean transportation and global logistics support for the U.S. military, operating approximately 125 ships daily worldwide. |
Advantage Home Health Care tracker page ↗ | the gentlemenfilter this group | · Jul 17, 2026 | advantagehhc.com zoominfo.com/c/advantage-home-health-care-inc/357944466 Advantage Home Health Care, a leading Indiana-owned provider of in-home care services with over 30 years of experience.The company operates multiple locations across Indiana, serving dozens of counties with post-procedure recovery and long-term home assistance. |
Acosol tracker page ↗ | qilinfilter this group | · Jul 17, 2026 | Energy, Utilities & Waste |
Centre for Newcomers tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://www.centrefornewcomers.ca/ The Newcomers Center provides immigration services aimed at supporting newcomers and creating a welcoming community. They maintain complete information about their clients in their databases, but they fail to ensure the security of this data. Due to their negligence toward their clients and employees, this data has been compromised. We offer you 380 GB of personal client data, company financial information, its current status and reporting, and human resources planning and policies. |
Paragon Store Fixtures tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://paragonstorefixtures.com/ Paragon Store Fixtures specializes in custom display cases, retail fixtures, and interior design elements for luxury stores, beauty salons, offices, restaurants, and entertainment venues. A security breach resulted in the breach of partnership agreements, resulting in the intellectual property of both the company and its clients. Internal design files were exposed, including work completed for clients in the high-end retail sector and luxury brands. Due to the company's negligence, contracts, architectural plans, and confidential design documentation became public. The identities of clients and projects have now been revealed. |
Westcoast Communication Services tracker page ↗ | akirafilter this group | · Jul 17, 2026 | Westcoast Communication Services is a leading expert in low voltage and structured cabling, specializing in voice and data cabling solutions across Florida. They offer a range of services including network integration, telecommunication networks, and access control systems. We will upload 20gb of corporate data soon. Employee personal information (DL, passports, SS card scans and so on), contracts and agreements, customer info, financials, confidential agreements, etc. |
Nesco Bus Maintenance tracker page ↗ | akirafilter this group | · Jul 17, 2026 | Nesco Bus specializes in manufacturing and maintaining a wide range of buses, including school,childcare, activity, commercial, and specialty buses. With over three decades of experience, they are committed to providing exceptional customer support and ensuring the safety and comfortof their passengers.We will upload 26gb of corporate data soon. Employee personal information (DL scans and so on),contracts and agreements, customer info, payment details and other financial docs, etc. |
suppcentersa.com tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +506 40003397. SuppCenter Global Services officially positions itself as one of the leading Xcitium solution partners and providers in the Latin America region. Xcitium is the new name of COMODO’s enterprise business. Their key cybersecurity specialization is based on a threat prevention architecture that uses Xcitium Zero Trust and ZeroDwell technologies. Official partnership: SuppCenter Global acts as a managed security service provider, or MSSP. They implement, configure, and support Xcitium/Comodo security solutions for large businesses, retail companies, and the public sector. Stolen: -- |
arambol.co.uk tracker page ↗ | m3rxfilter this group | · Jul 17, 2026 | +44 2079276370 , Arambol LLP is a dynamic partnership of chartered surveyors and property consultants, recognized for their commitment to quality and professionalism in property services. They cater to a diverse clientele, including large property organizations, retailers, local authorities, and small residential developers. Their service offerings encompass property consultancy, project management, cost consultancy, building surveying, and construction management. Arambol operates across various sectors such as healthcare, industrial, commercial, public sector, education, and hospitality. Stolen: 922 GB 584,228 Files |
Kyokuto Kaihatsu Kogyo tracker page ↗ | inc ransomfilter this group | · Jul 17, 2026 | No details on the leak post beyond the victim name. |
Phi tracker page ↗ | novafilter this group | · Jul 17, 2026 | PHI Studio focuses its activities on the presentation and curation of immersive works in virtual reality (VR), augmented reality (AR) and extended reality (XR). Recognized locally and internationally for its innovative production approach, technical expertise and achievements in new forms of storytelling, PHI Studio collaborates with major global industry players and has worked on many award-winning projects, with international presentations in New York, Tokyo, Venice, Frankfurt, Luxembourg and Salt Lake City, among others. As a pioneer in interactive experiences, PHI Studio pushes the boundaries of immersive projects, with a focus on enhancing the visitor experience through a keen sense of detail and the elaboration of high-quality scenography. With a reputation for close collaborations with artists, creators, directors and producers from different backgrounds, PHI Studio aspires to be a catalyst of innovation, supporting the development of present and future talent - Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
Digipro tracker page ↗ | novafilter this group | · Jul 17, 2026 | digipro.com.vn appears to be the website of DIGIPRO TECH JSC (Công ty Cổ phần Phát triển Công nghệ DIGIPRO), a Vietnamese IT company. According to its own website, the company was established in 2020 and is based in Hanoi, Vietnam - Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
Integrated Marketing Services tracker page ↗ | novafilter this group | · Jul 17, 2026 | Integrated Marketing Services is a company that operates in the Commercial Printing industry. It employs 20to49 people and has 5Mto10M of revenue. The company is headquartered in Liverpool, New York - Nova Provide tree and samples from stolen data + decrypt sample to the company when its get in touch with support department. |
eitzchaim.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Eitz Chaim Schools (Hebrew: ישיבת עץ חיים — Yeshivas Eitz Chaim) is a private Orthodox Jewish elementary sc... |
formasuniversales.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Formas Universales, S.A. is a Panamanian company founded in 1985, specializing in the production and commercialization o... |
rehabmalaysia.com tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | Pusat Rehabilitasi PERKESO Tun Abdul Razak (PERKESO Rehabilitation Centre Malaysia) is a Malaysian government-linked reh... |
www.lagus.cz tracker page ↗ | krybitfilter this group | · Jul 17, 2026 | LAGUS s.r.o. is a genuine Czech manufacturing company established on April 21, 1998, headquartered in Hruškové Dvory (... |
District of Columbia Housing Authority tracker page ↗ | interlockfilter this group | · Jul 17, 2026 | https://www.dchousing.org/ DC Housing, the organization entrusted with the powers of the District of Columbia Housing Authority, was completely compromised due to its negligence and greed in security, and all confidential information, databases, passports, and personal data of clients were stolen. We offer you 1.6 TB of confidential information, including all data of District residents and large databases. |
Boston Electric and Telephone tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Wring Group tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
AG Scholtes tracker page ↗ | playfilter this group | · Jul 16, 2026 | No details on the leak post beyond the victim name. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.