ZeroHour

Incidents

Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups

Ransomware & extortion groups · activity

#Group7dtrend30d90dall-time*Last postStatusEstimated earnings (public reporting)
1the gentlemen30▲8152400400activeno public figure
2qilin30▲18113364364activeno public figure
3storm9▼31496161activeno public figure
4krybit15▲15449595activeno public figure
5akira10▲3438787activeApproximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since.
6direwolf2▼9376262activeno public figure
7coinbase cartel0=355656activeno public figure
8inc ransom10▲634113113activeno public figure
9lockbit55=285454activeOver US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit…
10audit team10▲1242626activeno public figure
11safepay10=226767activeno public figure
12leakeddata1▲1203939activeno public figure
13orova0=194444activeno public figure
14zawoo0=191919activeno public figure
15emperador4▼2182222activeno public figure
16kazu0▼17171717activeno public figure
17vexy3▼4151515activeno public figure
18shinyhunters2=143232activeno public figure
19panzer7▲5142525activeno public figure
20black nevas1▼12141414activeno public figure
21play3▼1134747activeno public figure
22chaos3▼1133535activeno public figure
23rhysida2▼2131515activeno public figure
24everest0▼3123434activeno public figure
25pear0▼1122323activeno public figure

*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.

Incidents2,843 records · full details

VictimGroup / typeDiscoveredDetails
Andorra Life
tracker page ↗
playfilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
Svensk Direktreklam
tracker page ↗
playfilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
asa-international.com
tracker page ↗
inc ransomfilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
radiax.com
tracker page ↗
chaosfilter this group · Jul 16, 2026NOTICE OF DATA BREACH: RADIAX.COM We are officially announcing that we have gained full access to the internal network and sensitive data infrastructure of Radiax.com. To prove the authenticity of our access, we have published an initial 5% of the total exfiltrated data. This is merely a sample. W…
Megawork
tracker page ↗
ransomhousefilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
Converting Equipment International
tracker page ↗
interlockfilter this group · Jul 16, 2026https://www.slitandrewind.com/ CEI's mission is to produce high-quality equipment for the manufacturing industry through innovation, collaboration, and integrity. However, the company has a history of neglecting its own security, putting its customers and employees at risk. This negligence has resulted in the leakage of confidential information and personal data. We provide confidential information regarding equipment development, contracts, and customer relationships. We also have information about their subsidiaries and their entire financial structure.
Plumley Engineering
tracker page ↗
akirafilter this group · Jul 16, 2026Plumley Engineering is a firm specializing in civil, environmental, and geotechnical engineering services. They prioritize client service and quality, focusing on problem-solving and design with a common-sense approach.We will upload 11gb of corporate data soon. Client and employee personal information, projects information, contracts and agreements, confidential files, NDAs and so on.
https://www.statebankofnauvoo.com/
tracker page ↗
inc ransomfilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
Kee Wah Bakery
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Kee Wah Bakery specializes in traditional and innovative baked goods, offering a wide range of products including mooncakes, festive treats, and gift items. The...
Petrini Valores
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Petrini Valores S.A. specializes in personalized wealth management and financial planning, offering tailored financial solutions for individuals, families, and ...
Sinai Grand Casino
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Sinai Grand Casino is the premier casino in the Middle East, offering a luxurious gaming experience with a variety of games including roulette, blackjack, and p...
sanaa
tracker page ↗
black xfilter this group · Jul 16, 2026No details on the leak post beyond the victim name.
Terry P Moosmann CPA PC
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026Terry P. Moosmann CPA PC is a local accounting and tax preparation firm based in Washington, Missouri. Owned by Terry Moosmann, the company provides professional financial, accounting, and tax services tailored to individuals and small businesses in the surrounding communities. The firm is recognized for its personalized approach and long-standing presence in the local business community
Mesto Celakovice
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026celakovice.cz zoominfo.com/c/město-čelákovice/426355970 town in the Central Bohemian Region of the Czech Republic, situated on the Elbe River approximately 27 kilometers from Prague. With a population of around 12,000 residents, it serves as a local administrative and cultural hub. The official website functions as the primary municipal portal, offering citizens and visitors essential information, administrative services, news, and contact details for the local government
Kaneko
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026kaneko-corp.co.jp zoominfo.com/c/kaneko/540044079 Japanese software company based in Itoigawa, Niigata, specializing in construction project management solutions. For over three decades, the company has developed the CDPM series, a widely recognized software for creating and managing complex construction schedules. Recently, the company has been actively driving digital transformation in the construction industry through its advanced CDPM-X64 platform, which introduces innovative features like native JSON support and comprehensive schedule analysis tools
Byggelit Sverige
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026byggelit.se zoominfo.com/c/byggelit-sverige-ab/6046017 Swedish manufacturing company based in Lit that has been producing particleboard since 1962. They specialize in sustainable, customized particleboard component solutions, using advanced CNC technology to cut, drill, and mill panels to exact customer specifications. This approach minimizes on-site labor and waste while promoting a circular economy by recycling production scraps into new boards
Southport Outdoor Living
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Southport Outdoor Living is a Canadian company established in 2008, specializing in outdoor patio furniture. They offer a wide range of products including loung...
Metro Design Cente
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Metro Design Center offers a variety of design ideas through its room settings, creating an experience reminiscent of Architectural Digest. The center is conven...
North Atlantic Engineering Consultants
tracker page ↗
dragonforcefilter this group · Jul 16, 2026Established in the early 1980's North Atlantic Engineering Consultants has since inception conscientiously led the way with holistic sustainable energy solution...
Comet Enterprise Corp
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026comet-bearing.com.tw zoominfo.com/c/comet-enterprise-corp/425713239 leading Taiwanese industrial bearing distributor founded in 1973, serving as one of the major authorized distributors of the Schaeffler Group's FAG and INA brands in Taiwan. The company provides high-quality precision bearings for machine tools, power machinery, and equipment maintenance, backed by comprehensive factory technical support. With its headquarters in New Taipei City and branches across Taiwan, China, and Thailand, it offers extensive inventory and one-stop procurement solutions to help clients minimize equipment downtime and maintenance costs
Landesbibliothek Coburg
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026landesbibliothek-coburg.de zoominfo.com/c/landesbibliothek-coburg/429940598 regional state scientific library in Bavaria, Germany, originally founded in 1547. Located in the historic Ehrenburg Palace in Coburg, it houses a vast collection of around 500,000 volumes, including rare manuscripts, incunabula, and the historical book collections of the former Dukes of Coburg. Since 1973, the library has been administered by the Free State of Bavaria, serving as a vital cultural and research institution dedicated to preserving the region's historical heritage
ALUFE Femszerkezeti Kft
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026alufe.hu zoominfo.com/c/alufe-fémszerkezeti-kft/452408141 Hungarian manufacturing and construction company based in Székesfehérvár, with a history of aluminum production dating back to 1968. The company specializes in manufacturing and installing aluminum windows, doors, curtain walls, and complex facade systems, including steel, glass, and ceramic structures. With around 150 employees, it provides comprehensive, high-quality metal structure solutions for commercial and architectural projects across the region
Tooltec
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026tooltec.se zoominfo.com/c/tooltec-ab/371817746 advanced manufacturing company based in Trollhättan, Sweden, specializing in the precision machining of complex components. The company utilizes technologies like 5-axis milling, turning, and Wire EDM to produce high-quality parts for the automotive, energy, aeronautical, and aerospace industries. As an ISO 9001 certified supplier, Tooltec is recognized for its strict quality standards, delivery reliability, and commitment to long-term partnerships with both clients and employees
Terra Vitis
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026terravitis.com zoominfo.com/c/terra-vitis/447256156 French national certification for sustainable and responsible winegrowing, founded in 1998 by a group of committed Beaujolais winegrowers. It is the only national certification specifically dedicated to the wine sector and is officially recognized by the French Ministry of Agriculture and Food. The association unites nearly 2,000 members across France, guaranteeing environmentally friendly, socially responsible, and economically viable practices from vine to wine glass through strict annual audits
Vignobles Toutigeac
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026toutigeac.com zoominfo.com/c/vignobles-toutigeac/456813413 Vignobles Toutigeac family-run wine estate located in Targon, within the Bordeaux and Entre-Deux-Mers appellations in France. Originally an ecclesiastical property managed by monks, the estate now spans approximately 42 hectares of vineyards under the guidance of Oriane and Philippe Mazeau. The winery produces classic red and white Bordeaux wines, recognized for their smooth tannins and balanced fruit profiles, successfully blending historical tradition with modern winemaking practices
Dink Co Ltd
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026dink.co.jp zoominfo.com/c/dink-co-ltd/1340493249 Osaka-based Japanese company specializing in the development, design, and sale of wastewater treatment systems specifically for cardboard manufacturing plants. Originally founded as a cardboard printing ink manufacturer, the company leveraged its industry knowledge to transform into a dedicated water treatment equipment specialist in 2021. Today, their eco-friendly systems are installed and operational in over 430 factories across Japan, helping to clean industrial wastewater to safe environmental levels
Lsn
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026lsn.io zoominfo.com/c/lsn/557824732 software development company specializing in tailor-made IT solutions for the insurance industry. Founded in 2008 as Logisfera Nova and rebranded in 2020, the company provides full-stack services including back-office development, UX/UI design, data science, and enterprise software architecture. Headquartered in Gdańsk, Poland, with a branch in Athens, Greece, LSN partners with leading insurance sector clients to deliver agile, business-focused, and customized technological solutions
Giraudi Group
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026giraudi.com zoominfo.com/c/giraudi-group/1157060956v Monaco-based company founded in 1968, specializing in the import, export, and distribution of premium meats, including exclusive Japanese Kobe and certified Black Angus beef. Under the leadership of Riccardo Giraudi, the group has expanded into a comprehensive hospitality and lifestyle brand, owning and managing over 35 restaurants worldwide, most notably the famous Beefbar. The company also operates in the lifestyle sector with fashion, art, and premium spirits, while providing global consulting and franchising services for the food and beverage industry
Customs Watch
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026customswatch.com zoominfo.com/c/customs-watch/467458469 is an intelligence and IT consulting company specializing in anti-counterfeiting and product protection strategies throughout their lifecycle. The company primarily serves the pharmaceutical sector, working with 22 of the 25 largest pharmaceutical companies globally. Founded in 2001, it employs 51 to 200 people and is an active member of the International AntiCounterfeiting Coalition.
Gallant
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026gallant.fi zoominfo.com/c/gallant/474332534 is a forward-looking Finnish advisory and accounting company founded in 1967. It provides comprehensive financial, HR administration, taxation, and business law solutions for businesses of all sizes. The company operates in multiple locations across Finland, aiming to keep its clients one step ahead of their competition through modern financial management and strategic support
Hanseata
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026hanseata.de traditional German flat glass wholesaler based near Hamburg, operating since 1953. The company specializes in supplying high-quality glass solutions, including vacuum glass, flat glass, and insulating glass, to commercial clients, architects, and construction firms worldwide. They are particularly known for their extensive stock capacity, specialized consulting for energy-efficient vacuum glazing, and comprehensive global logistics services
Metro Mondego
tracker page ↗
the gentlemenfilter this group · Jul 16, 2026metromondego.pt zoominfo.com/c/metro-mondego-sa/430685182 public transport company responsible for sustainable mobility in the Coimbra, Miranda do Corvo, and Lousã region of Portugal. Originally conceived as a light rail network, the project has been restructured into a fully electric, high-capacity Bus Rapid Transit system known as Metrobus. The network spans 42 kilometers with 42 dedicated stations and 35 electric buses, designed to provide efficient, eco-friendly, and integrated urban transportation for an estimated 13 million passengers annually
Saint George's School
tracker page ↗
cmd organizationfilter this group · Jul 16, 2026Saint George's School: a bilingual school in Bogotá with a Cambridge curriculum and EFQM-certified quality. A well-rounded education that helps your child thrive.
samuelkoon.com
tracker page ↗
settrafilter this group · Jul 16, 2026Revenue: 5,000,000 Size: 748GB | How Samuel D. Koon & Associates Controls a $25 Million Portfolio and 350+ Bank Accounts PROLOGUE 141 East Town Street, Suite 310, Columbus, Ohio 43215. At first glance — a standard downtown office. An unremarkable building, three floors, commercial space. But inside Suite 310 sits Samuel D. Koon & Associates, LTD. — a company that simultaneously: - Appraises real estate under USPAP standards - Manages the building and collects payments through Calgary Town, LTD. - Conducts real estate brokerage through Calgary Realty, Ltd. - Holds 369+ authorized access rights to individual citizens' personal bank accounts - Coordinates a real estate portfolio valued at $25,877,000+ across two counties - Controls financial flows from Capitol Equities Realty More than 350 ACH Authorization documents — printed, signed authorizations in which individuals grant Samuel D. Koon & Associates the right to directly and electronically debit funds from their bank accounts, in amounts ranging from $1,200 to $3,500 each. Each document is a physical record of financial control. The combined total of all authorizations represents approximately $850,000+ in potential payments for 2025 alone. This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released. --- Part I. Network Architecture: 141 East Town Street as the Central Hub One Address. Four Companies. One Money Source. 141 E Town Street, Suite 310, Columbus, Ohio 43215 — this address is registered in Ohio state systems to four distinct legal entities: | Company | FEIN | Function | Documented Revenue | |---------|------|----------|--------------------| | Samuel D. Koon & Associates, Ltd. | 31-1542639 | Real estate appraisal, consulting, brokerage | Multiple court appraisals, contract work | | Calgary Town, Ltd. | — | Building management, payment collection, operating expenses | $345,713/year…
torsiongroup.co.uk
tracker page ↗
settrafilter this group · Jul 16, 2026Revenue: 5,000,000 Size: 400GB | END OF THE LINE A company that builds homes and promises safety to its residents failed to protect the data of the people who trusted it. --- Torsion Group is a private construction and property development group based in Leeds, West Yorkshire, specialising in student accommodation, care homes, and residential apartment schemes. Archive scale: 401 gigabytes of corporate data. Inside: bank statements, construction contracts, tax correspondence, accounting ledgers, directors' passports, employee payroll records with National Insurance numbers, medical documents, HMRC letters about deferred payments and penalty threats, internal legal memoranda on insolvency, settlement agreements with subcontractors, and confidential correspondence about structural defects in completed and occupied buildings. The company's records spanning more than a decade. The Legal Director's passport sitting in a shared corporate folder . A confirmed 9,958 National Insurance numbers belonging to employees. Bank account details of individuals. Data on student tenants. Letters about structural defects in residential properties concealed from buyers. And a formal legal letter dated February 2026 stating: "Torsion is an insolvent company for the purpose of the Insolvency Act 1986" . On top of all this, the group's internal documents reveal that behind the public image of a reliable developer lies an operating loss of £5.5 million, a cash position that collapsed in a single month, four consecutive PAYE deferrals totalling £1.27 million, a Luxembourg financing structure on £21.1 million, and directors borrowing from their own company's cash at 15% interest — while subcontractors pursued them through the courts. This article presents only a portion of the data selected for publication. The full archive is intended to be published at a later date. --- Part I. Who They Are Group Structure Torsion Group is a private construction and property development group registered in…
acilab.com
tracker page ↗
settrafilter this group · Jul 16, 2026Revenue: 12,000,000 Size: 653GB | How ACI Financed Its Owners' Companies — and Paid Them Rent PROLOGUE Inside the archive of American Color Imaging, Inc. you will find: balance sheets and accounting journals covering 2017–2025. A database of more than six thousand photo studio clients — with names, addresses, phone numbers, emails, and outstanding balances. Payroll records. A retirement plan with plan identifiers. Dividend checks to the owners. Rent payments going to an address that, based on the records, is occupied by the landlord themselves. Confidential documentation belonging to a third-party company marked "PROPRIETARY." A court-ordered wage garnishment. This article contains only a portion of the data we have chosen to disclose. Everything else will be available to download and review independently once the full archive is released. --- Part I. Who Is American Color Imaging American Color Imaging, Inc. — ACI, domain @acilab.com — is a photo lab and print shop in Cedar Falls, Iowa. Address: 715 E 18th St, Cedar Falls, IA 50613 . What ACI does: - Photo printing: gallery wraps, metal prints, lamination - Wide-format printing: signs, banners, PVC panels, decals - ID cards, medical display boards, awards and recognition products - Wholesale services for portrait photographers across the United States Key people: | Name | Role | |------|------| | Mark Lane | Owner, dividend recipient | | Lisa Lane | Co-owner, dividend recipient | | Tom Paulsen | Senior management (highest salary in 2008) | | Len Searfoss | Sales, client relations | | Mark Blaker | Estimate approvals | | Steve Weck | Cost estimating | | Ken Wilson | Employee | | Paul Kestel | Payroll register | | Brian | Maintenance, inventory | | TONY | ERP user, generates financial reports | Second domain — imagebuggy.com Len Searfoss uses two email addresses simultaneously: [email protected] and [email protected] . ImageBuggy is a separate brand or web platform operated by ACI for online…
Fidelity Services Group
tracker page ↗
ransomhousefilter this group · Jul 15, 2026No details on the leak post beyond the victim name.
Danone (International Delights)
tracker page ↗
qilinfilter this group · Jul 15, 2026Food & Beverage
Abbott owned Exact Sciences Corporation
tracker page ↗
shinyhuntersfilter this group · Jul 15, 2026You wouldn't want us to describe what was exfiltrated from you publicly. This is a final warning to reach out by 18 July 2026 before we leak along with several annoying (digital) problems that'll come your way. Make the right decision, don't be the next headline.
Heritage Mechanical LLC
tracker page ↗
dragonforcefilter this group · Jul 15, 2026Built on a family legacy of proud steamfitters dating back to over 100 years, Heritage Mechanical was established in 2012 to provide quality mechanical service ...
Anglo Belgian Corp: NATO's Nightmare? 6TB of Submarine Secrets, Nuclear Plant Schematics,
tracker page ↗
leaknetfilter this group · Jul 15, 2026#Leaknet #CyberResilience #SecurityCulture #DigitalPrivacy #PasswordSecurity #CyberDefense #IdentityProtection #Infosecurity #abcengines #AngloBelgianCorporation #ABC #PrivateData #SystemCompromised
Isegen South Africa (Pty) Ltd
tracker page ↗
dragonforcefilter this group · Jul 15, 2026Isegen South Africa (Pty) Ltd is a South African chemical company founded in 1974. It is the sole producer of certain chemical products in South Africa. Data th...
Hughes Atwood & Mullaly pllc
tracker page ↗
dragonforcefilter this group · Jul 15, 2026Hughes Atwood & Mullaly PLLC is a full-service law firm that offers professional legal services to individuals, businesses, and institutions in the Upper Valley...
Shillen Mackall & Seldon
tracker page ↗
dragonforcefilter this group · Jul 15, 2026Shillen Mackall Seldon Spicer & Fraas is a law firm dedicated to representing personal injury victims primarily in Vermont, New Hampshire, and Florida since 198...
Stephens Precision
tracker page ↗
dragonforcefilter this group · Jul 15, 2026Stephens Precision, Inc. is a versatile HUBZone manufacturing facility in Vermont, specializing in the machining of mechanical assemblies, components, and tooli...
Pioneer Construction
tracker page ↗
akirafilter this group · Jul 15, 2026Established in 1933, Pioneer Construction is headquartered in Grand Rapids, Michigan. They provide construction solutions throughout the United States including general contracting, crane services, program management, and more.We will upload 168gb of corporate data soon. Scanned employee personal documents (passports, DLs and other docs), projects information, detailed financials, client internal information, contracts and agreements, confidential correspondence and other files, NDAs and so on.
Carient Heart & Vascular
tracker page ↗
pearfilter this group · Jul 15, 2026Expert resource for heart and vascular care in Northern Virginia
South Plains Rural Health Services, Inc.
tracker page ↗
pearfilter this group · Jul 15, 2026Comprehensive and family care in West Texas
PanasonicAero
tracker page ↗
coinbase cartelfilter this group · Jul 15, 2026Aerospace - $2.71 Billion
Nihon Kotsu Co., Ltd.
tracker page ↗
ailockfilter this group · Jul 15, 2026No details on the leak post beyond the victim name.
Solid Advance Inc.
tracker page ↗
ailockfilter this group · Jul 15, 2026No details on the leak post beyond the victim name.
Ferrovial
tracker page ↗
ailockfilter this group · Jul 15, 2026No details on the leak post beyond the victim name.
Feliubadaló
tracker page ↗
qilinfilter this group · Jul 15, 2026Grocery Retail
Fluke
fluke.com
breach · Jul 15, 2026821K accounts · breached 2026-07-01 · Email addresses, Employers, Job titles, Names, Physical addresses, Support tickets · In July 2026, electronic test and measurement equipment company Fluke was targeted in a ShinyHunters "pay or leak" extortion campaign . The group subsequently published more than 100GB of data allegedly taken from the company. The corpus contained largely corporate contact information, including over 800k unique email addresses, names, phone numbers and physical addresses. A large collection of support cases was also present.
Levin Furniture
tracker page ↗
qilinfilter this group · Jul 15, 2026Furniture
sanaa.center
tracker page ↗
black xfilter this group · Jul 15, 2026Sanaa Center for Strategic Studies (sanaa.center) is an independent research organization focused on Yemen and the surrounding Middle East, particularly politics, conflict, economics, governance, and regional security.
Goose Creek
goosecreek.com
breach · Jul 15, 20266.6M accounts · breached 2026-06-09 · Email addresses, Names, Phone numbers, Physical addresses, Purchases · In June 2026, a party claiming to have access to data from Goose Creek Candle Company sent emails to a number of the company's customers , claiming the company had a security vulnerability and suffered a data breach. The data was subsequently sent to Have I Been Pwned and contained 6.6M unique email addresses along with names, phone numbers, physical addresses, order IDs and total spent. The data appears to have been obtained from the company's Shopify instance. Goose Creek is aware of the reports but was unable to provide Have I Been Pwned with any further information at the time of publication.
ProDirectional Drilling
tracker page ↗
securotropfilter this group · Jul 15, 2026If the company does not contact us before 25/07/2026, the data and proof of negligence will be published.
Axiom Global NEW
tracker page ↗
coinbase cartelfilter this group · Jul 14, 2026Business Services - $19.2 Million
sleemanbreweries.ca
tracker page ↗
chaosfilter this group · Jul 14, 2026Sleeman Breweries was founded in 1851 and headquartered in Guelph, Ontario. The company now markets and distributes world-class domestic and imported products.

Breach & ransomware newsAll →

Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.