Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
205
Leak-site victims · 30d
1K
Active groups · 30d
8011 new
Most active · 7d
the gentlemen
Breaches added · 30d
7
Accounts exposed · 30d
34.6MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲8 | 152 | 400 | 400 | active | no public figure | |
| 2 | qilin | 29 | ▲16 | 113 | 364 | 364 | active | no public figure | |
| 3 | storm | 9 | ▼31 | 49 | 61 | 61 | active | no public figure | |
| 4 | krybit | 15 | ▲15 | 44 | 95 | 95 | active | no public figure | |
| 5 | akira | 10 | ▲3 | 43 | 87 | 87 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 2 | ▼9 | 37 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 35 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 10 | ▲6 | 34 | 113 | 113 | active | no public figure | |
| 9 | lockbit5 | 5 | = | 27 | 54 | 54 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 10 | ▲1 | 24 | 26 | 26 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 1 | ▲1 | 20 | 39 | 39 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 4 | ▼1 | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | vexy | 3 | ▼4 | 15 | 15 | 15 | active | no public figure | |
| 18 | shinyhunters | 2 | = | 14 | 32 | 32 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | play | 3 | ▼1 | 13 | 47 | 47 | active | no public figure | |
| 22 | chaos | 3 | ▼1 | 13 | 35 | 35 | active | no public figure | |
| 23 | rhysida | 2 | ▼2 | 13 | 15 | 15 | active | no public figure | |
| 24 | everest | 0 | ▼3 | 12 | 34 | 34 | active | no public figure | |
| 25 | pear | 0 | ▼1 | 12 | 23 | 23 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,842 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
Spedidam tracker page ↗ | the gentlemenfilter this group | · Jul 6, 2026 | spedidam.fr Spedidam, founded in 1959 by five musical performers, is a French collective management organization that protects performers' neighboring rights.The organization manages the collection and distribution of royalties for performing artists while supporting artistic and cultural initiatives.Based in Paris, it serves as one of France's key institutions for managing intellectual property rights in music and dance |
Arabia Falcon Insurance Company SAOG tracker page ↗ | the gentlemenfilter this group | · Jul 6, 2026 | afic.om zoominfo.com/c/arabia-falcon-insurance-company-saog/447137751 Arabia Falcon Insurance Company (AFIC), is a leading insurance provider in Oman formed by the historic merger of two successful local insurers.The company underwrites a comprehensive range of general, motor, medical, and life insurance products for individuals and businesses.Headquartered in Muscat, AFIC has firmly established itself as a trusted and prominent name in the Sultanate's insurance sector |
LogiQuip tracker page ↗ | the gentlemenfilter this group | · Jul 6, 2026 | logiquip.com zoominfo.com/c/logiquip/146752157 LogiQuip, founded in 1992, is a specialized manufacturer providing inventory management and storage solutions exclusively for the healthcare industry.They design innovative systems, such as ParWire shelving, to solve complex supply chain and distribution issues in hospitals.Ultimately, their products help medical professionals save valuable time on inventory tasks so they can focus on patient care |
Virginia Historical Society tracker page ↗ | the gentlemenfilter this group | · Jul 6, 2026 | virginiahistory.org zoominfo.com/c/virginia-historical-society/184942664 is the digital platform for the Virginia Museum of History & Culture, owned and operated by the Virginia Historical Society, a private non-profit established in 1831.It is uniquely positioned as the only museum that presents all of Virginia's history under one roof, covering all centuries, regions, and topics.The organization connects people to America's past through its exhibitions, educational programs, and extensive research collections, inspiring future generations |
SON-VIDEO tracker page ↗ | majinahanashifilter this group | · Jul 6, 2026 | TARGET: Son-Video.com REVENUE: $54M EMPLOYEES: ~51-200 employees Package: 2.5 GiB / 10382 files |
GRUPO STARFOODS tracker page ↗ | majinahanashifilter this group | · Jul 6, 2026 | TARGET: starfoods.pt REVENUE: ~ EMPLOYEES: ~ Package: 4.1 GiB / 3420 files |
Vela Film S.r.l. tracker page ↗ | payloadfilter this group | · Jul 5, 2026 | Vela Film S.r.l. is an Italian production company based in Rome, specializing in the cinema and television industry. The company is involved in creating and producing various media projects, including well-known Italian TV series like “La porta rossa” and “Volevo fare la rockstar”. It actively collaborates with local directors and regional film commissions to organize and execute shootings across Italy. |
Apex Agro, LLC tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A Chemical Production Company |
Mirage Endoscopy Center tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A healthcare organization |
Bri-Tech, Inc tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A technology design and integration firm |
SBI Software tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | An Enterprise Resource Planning Software Provider |
DICON tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A general contracting construction firm |
Westgate tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A construction management company |
Dunagan Associates tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | Provides services in residential real estate and insurance |
Synergy Interactive tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A provider of staffing services |
East Texas Family Medicine tracker page ↗ | genesisfilter this group | · Jul 5, 2026 | A healthcare organization |
Gold Standard Automotive tracker page ↗ | wallstreetfilter this group | · Jul 5, 2026 | Gold Standard Automotive Network administers vehicle service contracts sold through dealerships, offering coverage for repairs after your factory warranty ends, with claim approvals handled through the company. |
Baraga County Memorial Hospital tracker page ↗ | wallstreetfilter this group | · Jul 5, 2026 | Baraga County Memorial Hospital is a critical access hospital serving Baraga County with emergency, surgery, imaging, rehab, and outpatient care. |
Asisken tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | Asisken (asisken.com) is a medical assistance/health insurance company offering prepaid medical coverage and member support services, with a hospital network in Ecuador (and Colombia). |
Edgewood Police Department tracker page ↗ | wallstreetfilter this group | · Jul 4, 2026 | The Edgewood Police Department is part of the Pierce County Sheriff’s Department, providing public safety and law enforcement services for the city, including community-focused programs like its free Community Academy |
Eureka Construction INC tracker page ↗ | titanfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Medic Rescue tracker page ↗ | the gentlemenfilter this group | · Jul 4, 2026 | https://www.medicrescue.org/ https://www.zoominfo.com/c/medic-rescue/47367866 Medic Rescue Services has been providing trusted emergency medical services to Beaver County since 1978. They offer a range of services including on-site emergency care, non-emergency transports, stretcher van trips, and wheelchair van services, all available 24/7. Their dedicated team and extensive fleet ensure swift and effective responses to medical needs. Medic Rescue aims to prioritize health and safety while fostering community trust through their reliable service |
Locati Architects tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Silvestri & Associates Insurance tracker page ↗ | playfilter this group | · Jul 4, 2026 | No details on the leak post beyond the victim name. |
Md Lewis tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Accounting Services |
Goodwill Manasota tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Business Services |
Sitmatic tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Furniture |
Sisint tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Architecture, Engineering & Design |
TQ Financial Services tracker page ↗ | qilinfilter this group | · Jul 3, 2026 | Accounting Services |
| Moody Bible Institute moody.edu | breach | · Jul 3, 2026 | 2.3M accounts · breached 2026-06-15 · Dates of birth, Email addresses, Genders, Marital statuses, Names, Phone numbers, Physical addresses · In June 2026, Moody Bible Institute was targeted by a ShinyHunters "pay or leak" extortion campaign . Over 2.3M unique email addresses and other personal data were later published publicly, including names, physical addresses, phone numbers, dates of birth and other information relating to donors, supporters, students and alumni. In their disclosure notice , Moody advised that they had "engaged both internal and external cybersecurity experts to thoroughly investigate the matter". |
aydeniz.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 3, 2026 | Aydeniz Group is a family-owned group of companies founded in 1975, operating in several key indu... |
AC Beverage, Inc. tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Provider in the draft beer service industry, specializing in the installation of high-quality systems and beer line |
CNW Electronics Pte Ltd tracker page ↗ | pearfilter this group | · Jul 3, 2026 | Providing complete wire harness solutions, from design to manufacturing |
duflosa.com tracker page ↗ | krybitfilter this group | · Jul 3, 2026 | DUFLO SAS (Duflo Servicios Integrales S.A.S.) is a Colombian company specializing in integrated facility management and ... |
majuhome.com.my tracker page ↗ | krybitfilter this group | · Jul 3, 2026 | MAJUHOME Concept (Maju Home Furnishing Sdn. Bhd.) is a Malaysian leading one-stop mega furniture mall and lifestyle bran... |
KOLORKIM KIMYA tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1GB | 1 files |
Mercedes-Benz Turk tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 50GB | 1 files |
Innovano tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1GB | 1 files |
Francisco Imóveis tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | LEAKED | 1 files |
Solventa & Riskmetrica | Calificadora de Riesgos tracker page ↗ | doommageddonfilter this group | · Jul 3, 2026 | upcoming | 0 files |
oakparkmi.gov tracker page ↗ | inc ransomfilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
Ferrum AG tracker page ↗ | anubisfilter this group | · Jul 3, 2026 | Data breach at one of the largest family-owned manufacturing businesses in Switzerland. |
[EVIDENCE]Prince George County tracker page ↗ | ransomhousefilter this group | · Jul 3, 2026 | No details on the leak post beyond the victim name. |
Shamrock Holdings Inc. tracker page ↗ | the gentlemenfilter this group | · Jul 2, 2026 | https://en.wikipedia.org/wiki/Shamrock_Holdings https://www.zoominfo.com/c/shamrock-holdings-inc/102187761 https://www.zoominfo.com/c/shamrock-capital-advisors-llc/80380310 https://www.shamrock.com/ Shamrock Holdings, Inc. is an investment firm founded by Roy E. Disney in 1978, primarily serving the investment needs of the Disney Family. The company emphasizes integrity, responsibility, and transparency in its operations. In addition to its investment activities, Shamrock manages various real estate investment programs through a subsidiary. Its intended clients include members of the Roy E. Disney Family and other potential investors in real estate. Assets Under Management: The firm manages over $6.6B in assets across entertainment IP, media rights, and private equity . Included 2021-2026 Stanley Gold inbox(80778) and sent(21617) |
tambasa.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
tricountyhs.org tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
acworth-ga.gov tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
carvalima.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
ezortea.com.br tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
hamilton-eye.com tracker page ↗ | inc ransomfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
flazio.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | lazio.com — this is a company from Italy. Flazio is a website builder platform that allows use... |
holidaypalace.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | Holiday Palace Hotel in Spain. Guest information, internal documents, reports, photos, videos, an... |
ritavo.com tracker page ↗ | eraleign (apt73)filter this group | · Jul 2, 2026 | ritavo.com is the website of Rita Võ Group, a private multidisciplinary holding company from Vie... |
Service IT tracker page ↗ | worldleaksfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Treet Group of Companies tracker page ↗ | worldleaksfilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Quest Healthcare Solutions tracker page ↗ | anubisfilter this group | · Jul 2, 2026 | Employee data, internal files, and a few unexpected discoveries. |
Pennant Hills Golf Club tracker page ↗ | qilinfilter this group | · Jul 2, 2026 | Advertising & Marketing |
X-Copper Professional tracker page ↗ | money messagefilter this group | · Jul 2, 2026 | No details on the leak post beyond the victim name. |
Salters propane tracker page ↗ | space bearsfilter this group | · Jul 2, 2026 | Salter’s Propane is excited and proud to be joining the Salter’s Family of businesses with competitive pricing, excellent customer service, and 65 combined years of industry experience. We are ready and more than capable to service all of your propane needs.From residential to commercial and everything in between we are confident that your experience with us will be nothing short of spectacular.We have many options available to suit your needs including a variety of tank sizes, and we offer competitive lease or purchase options.-Personal information of employees and clients -Financial documents -Other files https://salterspropane.com/ |
Tofutown tracker page ↗ | payloadfilter this group | · Jul 2, 2026 | TOFUTOWN is a traditional organic manufacturer specializing in plant-based foods, founded in 1981. The company offers a diverse range of products including vegan spreads, tofu, and seitan, all made from high-quality organic ingredients. With a commitment to sustainability and natural ingredients, TOFUTOWN caters to health-conscious consumers looking for convenient and delicious plant-based meal options. |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.