Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
205
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 113 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,842 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Gene Codes Forensics tracker page ↗ | the gentlemenfilter this group | · Jul 10, 2026 | genecodesforensics.com zoominfo.com/c/gene-codes-forensics-inc/1208843964 Gene Codes Forensics is a Michigan-based technology company and a global leader in disaster victim identification and human DNA matching. They provide specialized forensic software, such as Sequencher and M-FISys, which are utilized by numerous states and countries as central DNA resources for identifying remains in mass disasters. In addition to providing software and consulting services, the company operates a one-million-dollar Humanitarian Grant Program to support non-profit organizations conducting forensic DNA testing |
utb.edu.vn tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | The school's mission is to train human resources at the undergraduate and postgraduate levels;... |
bancrofteng.com tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | Bancroft Engineering specializes in the design and manufacturing of automated welding equipment and... |
magna.com.do tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | Magna Dominicana has over 50 years of experience offering globally recognized vehicle brands, specia... |
giesdl.de tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | Die Gies Dienstleistungen GmbH ist ein deutsches Gebäudedienstleistungsunternehmen. Sie hat 19 Niede... |
jshotels.com tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | JS Hotels owns and manages ten hotel properties scattered all over Majorca. We pride ourselves on cu... |
hotel-bourse.com tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | 14 rue de la Bourse 68100 Mulhouse [email protected] +33 3 89 56 18 44 |
abianchini.es tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | Founded in 1908, BIANCHINI specializes in the manufacturing and marketing of galvanized steel wires... |
comtri.de tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | As a leading IT system house in the Stuttgart area, ComTRI GmbH is a highly qualified and trustworth... |
mediaservicemaastricht.nl tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | Media Service Maastricht is a professional team specializing in audiovisual services, offering tailo... |
ravagnan.com tracker page ↗ | lockbit5filter this group | · Jul 10, 2026 | the RAVAGNAN GROUP employs about 250 people in Italy, and many more in Latin America. E’ specialized... |
Hynet tracker page ↗ | novafilter this group | · Jul 10, 2026 | Hynet helps businesses protect and manage their most important asset: information. With a team of skilled tech experts, they solve complex IT challenges by providing smart data storage and network security services. Their remote team works closely with clients to improve productivity and keep company data safe from growing digital threats - Nova Provide tree and samples from stolen data to the company when its get in touch with support department. |
Finance Yorkshire tracker page ↗ | cmd organizationfilter this group | · Jul 9, 2026 | Finance Yorkshire provides funding solutions for small and medium-sized enterprises (SMEs) located in or planning to relocate to Yorkshire. Their offerings include business loans ranging from £25,000 to £250,000, equity-linked investments, and seedcorn startup finance, with a focus on supporting growth and innovation. The organization aims to invest over £50 million in the region over the next five years, targeting businesses that seek to expand, create jobs, and enhance productivity. With a legacy of successful investments, Finance Yorkshire is dedicated to fostering the development of technology and knowledge-based companies. |
Envision Unlimited tracker page ↗ | money messagefilter this group | · Jul 9, 2026 | No details on the leak post beyond the victim name. |
robroy.com tracker page ↗ | brain cipherfilter this group | · Jul 9, 2026 | We have more 250,000 files. If you think you are here by mistake, please contact us at [email protected] |
iac-intl.com tracker page ↗ | brain cipherfilter this group | · Jul 9, 2026 | We have stolen more than 710,000 files and documents, totaling over 1050 GB. If you think you are here by mistake, please contact us at [email protected] |
Inter Power Engineering tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Electronics |
The commune of Castries tracker page ↗ | payloadfilter this group | · Jul 9, 2026 | The commune of Castries is a picturesque, historic town in the south of France, renowned for its majestic 17th-century château and unique aqueduct. The city's official website (castries.fr) provides visitors and locals with the latest news, cultural event schedules, and tourism information. Additionally, the portal serves as a convenient digital platform for residents to access municipal services and connect with the town hall. |
Sintax tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Law Firms & Legal Services |
Sun Dolphin Boats tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Business Services |
Bronken's Dist tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Business Services |
Alan F Burke tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Accounting Services |
Hum & Jacoby tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Accounting Services |
gvfsinc.com tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 20,500,000 Size: 36GB | GREEN VALLEY: SELF-LEASE SCHEME How a California agricultural distributor pays rent to companies controlled by its own co-owners --- PROLOGUE The following documents are in our possession: Financial statements: audited consolidated financial statements of Green Valley Farm Supply, Inc., Pinnacle Application, Inc., and Kennedy Farm Services, Inc. for the fiscal year ended October 31, 2025 (prepared by Van Ruler & Company LLP, dated February 5, 2026); audited consolidated financial statements for the prior fiscal year; trial balances broken down by location (Gonzales CA, Yuma AZ, Hollister CA, Watsonville CA); internal income and expense tables with monthly detail; fixed asset depreciation schedules; monthly accounting summaries for multiple years. Bank documents: account statements from Wells Fargo, Bank of America, 1st Capital Bank, Pacific Valley Bank, BMO Bank, Rabobank—covering the period 2017–2026. PPP federal support program documents: application, calculation, loan agreement. Tax documents: Schedule K-1 forms (Form 568 and Form 1065) for all members of two LLCs—106 Alpine, LLC and 159 GRR, LLC; tax workpapers; property tax returns (BOE-571-D) for 2023–2026; member income distribution summaries. Contracts and agreements: operating agreements for 106 Alpine, LLC and 159 GRR, LLC; original lease agreements for all properties—Hollister, Gonzales, 159 Gonzales River Road, Yuma, Watsonville; promissory notes for $660,000 (GVFS loan to 106 Alpine) and for $983,650, $80,525, and $22,988 (GVFS loans to employee Wiegand); stock purchase plan; loan amortization schedules. Internal documents: QuickBooks exports with rent invoices; internal construction financing spreadsheets; shareholder registers with transaction history (updated as of May 27, 2026); dividend calculations; fixed asset registers with notations on related-party transactions; captive insurance documents (Terra Captive, Pioneer Health Insurance Captive, ARU Captive). Other:… |
wtlawllp.co.uk tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 5,000,000 Size: 19GB | WT Law LLP: Internal Documents of a UK Law Firm PROLOGUE Inside: full credit reports with data from three credit bureaus—on the firm's current employees, marked by the publisher as "Store and Destroy Securely." Bank account details with full transaction histories. Real estate purchase and sale agreements with buyer, seller, and price information. A personally signed Annual Risk Review protocol in which the Managing Partner explains why the firm decided not to insure against cybercrime—and why he believes the PI policy will cover a cyberattack on client funds. An open client insurance claim—nearly two years with no payouts and no reserves. Claims against the firm. A data map: NI numbers, bank details, and sources of funds across 500 open matters. An AML audit in which not a single employee was interviewed—and the firm officially acknowledged this in its response to the regulator. In this article, you will be able to review only a portion of the data we have chosen to disclose. Everything else you will be able to download and review on your own after the full archive is published. --- Part I. Who Is WT Law LLP WT Law LLP is a UK law firm (Limited Liability Partnership), regulated by the SRA (Solicitors Regulation Authority). It specializes in conveyancing, private client matters (wills, powers of attorney, probate), as well as property and corporate disputes. Registered office: 3rd Floor, 46 Aldgate High Street, London EC3N 1AL Lexcel accreditation: continuous since 2015 (annually confirmed by Recognising Excellence Limited) CQS accreditation: active (renewed May 2026) Cyber Essentials: not held The firm handles approximately 500 open client matters . Of the 11 listed employees, only 6 fee earners are actively handling cases. All key regulatory roles (COLP, COFA, MLRO, MLCO, DPM) and the Managing Partner status are concentrated in one individual— Andrew Wong . --- Part II. Strategic Business Plan: Finances and Risks Cyber insurance:… |
bergdemo.com tracker page ↗ | settrafilter this group | · Jul 9, 2026 | Revenue: 42,000,000 Size: 543GB | Berg / Crushing Corporation of America: Demolition on Federal Money --- PROLOGUE In our possession are internal documents of Berg Demo Holdings LLC , dated 2025–2026. Consolidated financial statements for 2026 — P&L, balance sheet, WIP, ratio analysis. Distribution list: owners, CFO, representatives of Canadian investor Alaris Equity Partners, two independent board members. Related party register — Berg Related Party Spreadsheet : monthly payments to four affiliated entities from January 2025 through May 2026. Daily cash sheets for April 2026. Bank transfer confirmations: $1M, $1.5M, $2.71M — within the group over two months. A log of 264 contract change entries (PCO Log): individual change order amounts reach $1,808,074. More than 50 executed subcontracts and agreements — subcontractor agreements, equipment rental contracts, and general contractor agreements from 2024–2025. Among them: a direct government contract with the Maryland Stadium Authority under the Project C.O.R.E. program, heavy equipment rental from Carter Site Services for Key Bridge debris work, master subcontracts with four asbestos subcontractors, an executed subcontract for the Homestead Wakefield school — the very one for which Berg is now litigating in Harford County. Internal personnel evaluations: peer reviews of management on the KPA platform. The President evaluates subordinates, subordinates evaluate the President, the COO evaluates his direct reports. Documents include written comments and self-assessments with personal signatures. Insurance documents for 2026–2027: fleet, Workers' Compensation, General Liability, D&O. A lawsuit filed in the Circuit Court of Harford County from April 2026. Monthly covenant compliance certificates, signed by CFO Scott Luman and sent to Alaris. In this article, you will only be able to review a portion of the data we have chosen to disclose. The rest you will be able to download and study independently after the full… |
Pinturas Prisa tracker page ↗ | ailockfilter this group | · Jul 9, 2026 | No details on the leak post beyond the victim name. |
Peligro Sports tracker page ↗ | qilinfilter this group | · Jul 9, 2026 | Retail · Pennsylvania |
Creative Smiles Pediatric Dentistry tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
AMHWA Biopharm Co., Ltd. tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
SF Smile Doctor tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | SF Smile Doctor |
Bishop Arts Dental PLLC tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Top Notch Dentistry of Dallas tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Benjamin H. Wang DDS Inc. tracker page ↗ | crpx0filter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
tws-tac.net tracker page ↗ | 3amfilter this group | · Jul 8, 2026 | While ownership has changed over the years, the company has remained locally owned for over 65 years and family-owned for almost 40 years. The company is proud of the company's history and look forward to the future as the company continue to serv | PUBLISHED 1% | Views: 39 |
S.J. Louis tracker page ↗ | qilinfilter this group | · Jul 8, 2026 | Civil Engineering Construction |
shelby.com.mx tracker page ↗ | krybitfilter this group | · Jul 8, 2026 | Shelby Manufacturing de México, S.A. de C.V. is a Mexican maquiladora company specializing in the manufacturing of sewi... |
xuerong.com tracker page ↗ | krybitfilter this group | · Jul 8, 2026 | Shanghai Xuerong Biotechnology Co., Ltd. (上海雪榕生物科技股份有限公司), formerly known as Shanghai Gaoron... |
Wade's Dairy tracker page ↗ | akirafilter this group | · Jul 8, 2026 | A family-owned business for over a century, Wade's Dairy has been a staple in the Connecticut community.We will upload corporate data soon. Detailed employee personal information (name, DOB, SSN, DL,height, weight, race, sex, eyes and hair color, tattoo information, emails, phones and so on),projects files, financials, customers, contracts and agreements and so on. |
PCCC Realty LLC tracker page ↗ | nightspirefilter this group | · Jul 8, 2026 | No details on the leak post beyond the victim name. |
Tostrud & Temp, S.C. tracker page ↗ | pearfilter this group | · Jul 8, 2026 | Full service CPA firm serving La Crosse |
corepharma.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: CorePharma – Full GMP & Regulatory Compromise We are officially announcing that our security team has successfully breached the internal network of CorePharma. We are currently in possession of a comprehensive archive of the company’s internal operations, including sensitive regu… |
opportune.com tracker page ↗ | chaosfilter this group | · Jul 8, 2026 | DATA EXPOSURE: Opportune LLP – Full Operational Transparency We are officially announcing that our security team has successfully breached the internal network of Opportune LLP. As of this moment, we are in possession of the entire Opportune internal data environment—an massive archive containi… |
Biessse tracker page ↗ | space bearsfilter this group | · Jul 8, 2026 | The BiesSse group, which has been operating on the global market for over 40 years, specializes in the production and conversion of highly performing technical adhesive tapes. The BiesSse Tape production plant covers a surface area of over 11,000 sq.mt. and is equipped with modern and advanced installations, in line with lean manufacturing practices. The BiesSse group operates worldwide through its subsidiaries in Austria, Brazil, China and Mexico, availing itself of a professional and strongly committed local workforce. The direct presence on the ground makes it possible to quickly and efficiently respond to customers’ demands and to ensure on-going assistance and support.-Personal information of employees and clients -Financial documents-SQL DB https://www.biessseworld.com/ |
<h2 id="about">ABOUT</h2>
<p>Nissin Foods Do Brasil Ltda is a company that operates in the tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | Nissin Foods Do Brasil Ltda is a company that operates in the Food & Beverages industry. It employs 251-500 people and has $100M-$250M of revenue |
<h2 id="about">ABOUT</h2>
<p>The RKW Group is an independent private company headquartered tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | The RKW Group is an independent private company headquartered in Mannheim, Germany, and is one of the world's leading manufacturers of excellent film solutions. RKW is the market leader in the areas of hygiene and agricultural films, films for the beverage industry and packaging for powdery goods. Moreover, the company also supplies films and nonwovens for medical applications, for the chemical and processing industries as well as for the construction sector. The RKW Group's sustainable plastic-based films enable its customers to improve the daily life of consumers worldwide. |
<h2 id="about">ABOUT</h2>
<ul>
<li></li>
</ul>
<h2 id="target">TARGET</h2>
<p>ni*usa.com</ tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | ni*usa.com |
<h2 id="about">ABOUT</h2>
<p>SCHERDELWiesauplast ist ein international tätiger Hersteller tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | SCHERDELWiesauplast ist ein international tätiger Hersteller für Baugruppen und Komponenten aus Kunststoff. Der Hauptsitz des Unternehmens ist in Wiesau, weitere Niederlassungen befinden sich in den USA, sowie ein eigenes Produktionswerk in Mexiko. Seit mehr als 50 Jahren steht der Name Wiesauplast für Erfahrung, Kompetenz und Innovation in Sachen Kunststofftechnik, eines der ersten Produkte war die Blinkerleuchte für den legendären VW Käfer. SCHERDELWiesauplast fertigt in Deutschland und Mexiko eine Vielzahl technischer Komponenten und Systeme, welche sicherheitsrelevante Funktionen With over 35 years of experience since our inception, GRANT & WEBER has established a reputation as a leading authority in all revenue solutions & receivables management services for healthcare, Credit Union & Financial, as well as, Insurance industries. Our services are delivered nationwide and including: Consulting, Insurance Billing & Follow-Up, Self Pay Billing & Customer Service Follow-Up, Self Pay Collections, Third Party Liability Recovery, Workers’ Compensation Recovery, Pre-Charge Off Account Management, Third Party Late Stage Collection Services, and Arbitration. |
<h2 id="about">ABOUT</h2>
<p>The Beacon Insurance Company Limited is ranked as the fourth tracker page ↗ | dataleakfilter this group | · Jul 8, 2026 | The Beacon Insurance Company Limited is ranked as the fourth largest insurer in Trinidad and Tobago. Our roots go back to 1972 when Mr Aziz Hadeed founded The Caribbean Insurance Company, passing the proverbial baton to his son, Gerald Hadeed, who sits at the helm today. The company was rebranded as The Beacon Insurance Company in 1996. The early years of the company were characterised by direct personal relationships between Aziz and his clients, rather than through Brokers and after 45 years of cumulative growth, Beacon is now a regional player with Branch Offices and an Agency network that spans Trinidad & Tobago, Barbados, Grenada, St Lucia, St Vincent & The Grenadines, St Kitts & Nevis, and Dominica. Beacon therefore enjoys a reputation as an emerging giant in the regional insurance industry. |
CDA tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: https://centrodiagnosticocda.it/ REVENUE: ~ EMPLOYEES: ~ Package: 73.4 GiB / 135426 files |
WONDR DIAMONDS & D GEM MOUNT tracker page ↗ | majinahanashifilter this group | · Jul 8, 2026 | TARGET: wondrdiamonds.com & gemmount.com REVENUE: $12m USD EMPLOYEES: 200+ Package: 2.5 GiB / 247 files |
Aesthetic Surgical Images tracker page ↗ | inc ransomfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Lechner Massivhaus GmbH tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | Building Materials |
COP® Vertriebs-GmbH Zentrale tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | Business Services |
Next Clinics tracker page ↗ | qilinfilter this group | · Jul 7, 2026 | 0 |
Preneed Funeral Programs tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
Kevin Bao Lenguyen tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
United Infrastructure tracker page ↗ | playfilter this group | · Jul 7, 2026 | No details on the leak post beyond the victim name. |
YMCA of Western North Carolina tracker page ↗ | interlockfilter this group | · Jul 7, 2026 | https://www.ymcawnc.org/ The YMCA of Western North Carolina operates seven fitness centers, a summer camp, dozens of food trucks, youth sports programs, and many other initiatives. They are also the state's largest provider of licensed school-age childcare. However, they don't ensure security and aren't responsible for it, and you can gain access to confidential client information (complete sets of documents, even fingerprints), contracts, and incidents (of which they have many!), as well as to employee personal data and financial documents. |
hiddeenn tracker page ↗ | the gentlemenfilter this group | · Jul 7, 2026 | hidddenn |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.