Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
182
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 155 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | akira | 9 | = | 44 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 5 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 9 | ▲5 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 2 | ▼1 | 15 | 32 | 32 | active | no public figure | |
| 18 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,826 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
G... ...g tracker page ↗ | leakeddatafilter this group | · 14d ago | To be announced... |
S... M... tracker page ↗ | leakeddatafilter this group | · 14d ago | To be announced... |
Cartrack Holdings tracker page ↗ | direwolffilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Ormond Beach Florida tracker page ↗ | wallstreetfilter this group | · 14d ago | Ormond Beach, Florida, is a scenic coastal city just north of Daytona Beach, known for its beaches, relaxed atmosphere, historic charm, and outdoor activities. |
PTT Oil and Retail Business tracker page ↗ | direwolffilter this group | · 14d ago | No details on the leak post beyond the victim name. |
N*************** tracker page ↗ | insomniafilter this group | · 14d ago | Medical center with 9 locations offers coordinated care for patients and families, including dentistry, digital X-rays, ultrasound, bone density scans, mammograms, lab testing, and mental health counseling in a comfortable setting. |
Asfaltos y Pavimentos S.A. (Asfalpasa) tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Westfield Public School District tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Trucka tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Policlinico Triestino tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Multiver Ltée tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Metales Panamericanos tracker page ↗ | inc ransomfilter this group | · 14d ago | No details on the leak post beyond the victim name. |
Leo Schachter Diamonds tracker page ↗ | the gentlemenfilter this group | · 14d ago | leoschachter.com Leo Schachter Diamonds (USA/Global) Family diamond house since 1952, four generations; De Beers sightholder for 60+ years. Invented the branded diamond (THE LEO at Kay/Jared, ~2,000 stores) — a diamond sold like a Nike sneaker. Owns one of Botswana's largest cutting factories: 90% women, trained from scratch, plus its own doctor when 60% of staff were HIV-positive. Crisis context: lab-grown diamonds are squeezing the whole natural industry — the moat is now brand + story, not just stones. |
[EVIDENCE]REXT Holdings Co., Ltd. tracker page ↗ | ransomhousefilter this group | · 15d ago | No details on the leak post beyond the victim name. |
We have successfully infiltrated your systems tracker page ↗ | meowciety403filter this group | · 15d ago | SECTOR: Financial Brokerage/Foreign Exchange (Forex / FX) | COUNTRY: 🇦🇪 AE | DETAILS: internal documents, 216 pdf files, Hr management,daily corporate action reports, legal documents Api keys | We have successfully infiltrated your systems and obtained the following sensitive data from https://www[.]century[.]ae UAE-based financial services and brokerage company that provides individuals, businesses, and instit... | WARNING / NEW |
Ville de Libercourt tracker page ↗ | kairosfilter this group | · 15d ago | Libercourt is a commune in the Pas-de-Calais department of the Hauts-de-France region in northern France. |
Royal Plaza On Scotts tracker page ↗ | eclipsefilter this group | · 15d ago | Royal Plaza on Scotts Hotel is a five-star independent hotel located in the heart of Singapore's Orchard Road, offering spacious and modern accommodations. With a legacy of over 50 years, it has been recognized as Asia Pacific's Best Independent Hotel, providing guests with a comfortable stay and award-winning halal-certified dining at its renowned Carousel restaurant. The hotel caters to both leisure and business travelers, featuring facilities for meetings, events, and weddings. Guests can enjoy exclusive offers and loyalty rewards through the I Prefer Hotel Rewards Programme. |
ScrubaDub Auto Wash Centers tracker page ↗ | akirafilter this group | · 15d ago | ScrubaDub Car Wash is New England's leading auto wash, offering customizable tunnel and touchless washes, interior cleaning, and detailing services across over 20 locations in Massachusetts,New Hampshire, Maine, and Rhode Island.We will upload corporate data soon. Employee personal information (passport numbers, DLs of 22 employees, contact information), clients information (addresses, contacts and so on), company financials, payment details. |
Algra Group tracker page ↗ | akirafilter this group | · 15d ago | Algra Group specializes in customized input systems, front panels, and industrial labels, providing tailored solutions for various industries. Their product range includes agnostic touch systems, piezo keyboards, and weightpads, catering to sectors such as food processing, automation,wellness, medical technology, and transportation.We will upload 55gb of corporate data soon. Employee personal information (passport numbers, DLs), clients and partners information, contacts and agreements, financials, NDAs. |
PennFab tracker page ↗ | akirafilter this group | · 15d ago | PennFab is a Pennsylvania-based steel manufacturing company specializing in structural steel fabrication for various industries, including railroad and transportation. They offer a wide range of services such as engineering, welding, and custom metal fabrication, ensuring high-qualityproducts made in the USA.We will upload 40gb of corporate data soon. Employee personal information (scanned passports, DLs, SSNs and so on of 53 employees), clients information, contacts and agreements, financials, NDAs. |
Uak University tracker page ↗ | qilinfilter this group | · 15d ago | Education |
specialtytextile.com tracker page ↗ | inc ransomfilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Chip 1 Exchange tracker page ↗ | aurorafilter this group | · 15d ago | Chip 1 Exchange — a global independent electronics distributor headquartered in Neu-Isenburg, Germany, with primary US operations in Laguna Hills, California. The dataset spans 13 years (2013-2026) of corporate operations and encompasses: 40+ passport photographs, I-9 forms with SSNs, W-4 tax forms, payroll registers. Complete 2026 financial intelligence — P&L through July, executive financial health assessment, AR/AP aging, chart of accounts revealing all bank account numbers. 15+ exclusive franchise manufacturer agreements with pricing terms, territory allocations, and per-customer gross profit margins. ITAR registration and defense customer sales orders to Jabil Defense, Curtis-Wright, GEN3 Defense, and Cobham Remec. 5.7 GB of Outlook PST email archives spanning years of C-suite and employee correspondence. |
| Manchester Airports Group magairports.com | breach | · 15d ago | 8.8M accounts · breached 2026-08-27 · Browser user agent details, Email addresses, Geographic locations, IP addresses, Names, Phone numbers, Purchases, Vehicle registration plates · In August 2026, Manchester Airports Group (MAG) disclosed a data breach impacting their services . The incident was later claimed by the FulcrumSec hacking group , who subsequently published email addresses and phone numbers relating to 8.8M customers of Manchester, Stansted and East Midlands airports. The data contained personal information relating to airport services, including vehicle registrations and parking history, Fast Track purchases and lounge bookings. In their disclosure notice , MAG advised that "at no point has passenger safety or aviation security been compromised". |
Grayson Rural Electric Cooperative tracker page ↗ | qilinfilter this group | · 15d ago | Electricity, Oil & Gas |
Marlborough Partners tracker page ↗ | anubisfilter this group | · 15d ago | Major data breach at a capital solutions advisory firm. |
Proliance Surgeons tracker page ↗ | payoutskingfilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Quality Resource Pvt tracker page ↗ | global secret groupfilter this group | · 15d ago | Country: United States | Website: qualityresourcepvt.com | Revenue: $19 Million | Industry: Advertising Networks | Employees: 201–500 employees | Properties: 60.1 GB (170,436 Files, 88,440 Folders) |
Holland & Knight tracker page ↗ | leakeddatafilter this group | · 15d ago | Holland & Knight, headquartered in Tampa, Florida, and established in 1968, is a law firm that offers … |
SHAHEEN LAW GROUP PLC - Richmond, Virginia, USA tracker page ↗ | deadlockfilter this group | · 15d ago | Family law firm , established 1995 by Victor A. Shaheen (†2025 - the General Assembly of Virginia honored him with a resolution; google it, it is touching). Now run by his three sons. 48 employees across four offices: Richmond, Midlothian, Virginia Beach, Newport News. What do they do? They close 150+ real estate transactions EVERY MONTH for some of the largest corporate relocation programs in America. When a Fortune-500 moves an employee to Virginia, this firm holds that employee's Social Security Number, bank wiring details, home address, family identities, and sometimes their medical clearance. They hold everyone's future in a shared folder. We now hold the folder. |
Szechenyi Programiroda Nonprofit Kf tracker page ↗ | rhysidafilter this group | · 15d ago | Szechenyi Programiroda Nonprofit Kf As a key player in Hungarian development policy, our Company participates in the planning and implementation of development programs based on certain EU and domestic funds. More |
H... ...s tracker page ↗ | leakeddatafilter this group | · 15d ago | To be announced... |
Honeycomb Programs Inc tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
PT Intraco Penta Tbk tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Oportunidados tracker page ↗ | direwolffilter this group | · 15d ago | No details on the leak post beyond the victim name. |
Flex1 tracker page ↗ | akirafilter this group | · 15d ago | Flex1 is an innovative provider of desktop-as-a-service solutions that enables businesses to create secure and cost-effective digital workspaces. Their platform combines cloud architecture with productivity tools and managed support services to ensure employees can work efficiently from any device, at any time.We will upload 402gb of corporate data and their clients soon. Employee personal information, clients information (lawyers clients (passports, DLs, SSNs and so on), pet's clinic, etc), financials and so on. |
BYK Construction tracker page ↗ | akirafilter this group | · 15d ago | BYK Construction is a trusted home builder based in Mount Vernon, Washington, specializing in residential and commercial construction, land development, property management, and home maintenance.We will upload 27gb of corporate data soon. Employee personal information (passport numbers, SSNs, DLs, financial information), clients information, company financials, projects (specifications) and so on. |
Congressional Iron Works tracker page ↗ | akirafilter this group | · 15d ago | Congressional Iron Works is a full-service miscellaneous metals contractor serving the commercial construction industry in the greater Baltimore-Washington area. Established in 2004, the company offers a range of services including estimating, drafting, fabrication, and project management, focusing on steel and architectural metals components such as structures, stairs, and canopies.We will upload 35gb of corporate data soon. Employee personal information (passport numbers, SSNs, DLs, financial information, health information), clients information, company financials, projects, NDAs. |
Transportes Montejo S.A.S. tracker page ↗ | nightspirefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
rubbermill.com tracker page ↗ | dragonforcefilter this group | · 16d ago | ═════════════════ ═════════════════ ═════════════════ RUBBERMILL, INC. DUMP: BREAKDOWN OF AN OEM MANUFACTURER LEAK ═════════════════ ═════════════════ ═══════... |
SCHMIDT 🇺🇸 tracker page ↗ | bravoxfilter this group | · 16d ago | Abrasive Blasting Systems and Engineering Solutions for Industry. |
Total Education Solutions tracker page ↗ | wallstreetfilter this group | · 16d ago | TES IDEA provides personalized educational, therapeutic, and developmental solutions that help students, families, and schools achieve better outcomes. |
REXT Holdings Co., Ltd. tracker page ↗ | ransomhousefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Seasia Infotech tracker page ↗ | the gentlemenfilter this group | · 16d ago | seasiainfotech.com zoominfo.com/c/seasia-infotech/353879170 Seasia Infotech — global IT services company, founded in 2000 in California, USA. Delivery centers in India (Mohali/Chandigarh); offices in UK, Australia, UAE, Canada. 25+ years in business; completed 50,000+ projects in 36+ countries for 500+ clients. Clients include HP, Harley-Davidson, Mahindra, Flipkart, Adani, NEC, Canon. Holds CMMI Level 5 — the highest software process certification; also ISO 27001 and Microsoft Gold. Services: custom software, web/mobile apps, AI & Generative AI, cloud, cybersecurity, QA, UI/UX. 2026 focus: "AI Pods" — ready-made expert teams with AI tools for HealthTech, FinTech, LegalTech. Scale: ~300–680 employees, est. revenue $100–150M, fully bootstrapped — no external funding. Risks: shrinking headcount (-9% YoY), unaudited revenue figures, too small for giant enterprise deals. |
Manchester Airports Group tracker page ↗ | fulcrumsecfilter this group | · 16d ago | No details on the leak post beyond the victim name. |
TERRACOM & MONTCAU tracker page ↗ | majinahanashifilter this group | · 16d ago | PUBLICATION SCHEDULED. Publication scheduled: 2026-09-05T08:08:00Z Package: 896 MiB / 6341 files |
seashellhospital.com tracker page ↗ | krybitfilter this group | · 16d ago | Seashell Hospital is a comprehensive private Egyptian hospital located in New Cairo, Egypt, offering world-class multidi... |
uicc.org tracker page ↗ | krybitfilter this group | · 16d ago | The Union for International Cancer Control (UICC) is the world's largest international cancer membership non-profit orga... |
tum.com.mx tracker page ↗ | krybitfilter this group | · 16d ago | TUM Transportistas Unidos Mexicanos División Norte, S.A. de C.V. is the largest trucking company in Mexico, founded in ... |
www.alphaplantes.com tracker page ↗ | krybitfilter this group | · 16d ago | Alphaplantes (Service d'Entretien des Plantes Alpha Inc.) is a Canadian family-owned company founded in 1970, headquarte... |
reignwoodpark.com tracker page ↗ | krybitfilter this group | · 16d ago | Reignwood Park Thailand is a luxury real estate and integrated lifestyle development project by Reignwood Group — a le... |
orex.co.th tracker page ↗ | krybitfilter this group | · 16d ago | Orex Trading Co., Ltd. is a Thai trusted distributor and one-stop service provider of medical products, pharmaceuticals,... |
amptc.net tracker page ↗ | krybitfilter this group | · 16d ago | Arab Maritime Petroleum Transport Company (AMPTC) is a leading Arab maritime shipping company established in 1972 as a s... |
dmt-group.com tracker page ↗ | krybitfilter this group | · 16d ago | DMT Consulting Private Limited is an Indian private limited company incorporated on September 25, 1998, formerly known a... |
jswlaw.bt tracker page ↗ | krybitfilter this group | · 16d ago | Jigme Singye Wangchuck School of Law (JSW Law) is Bhutan's first and only law school, established by Royal Charter on Fe... |
vedantaainstitute.in tracker page ↗ | krybitfilter this group | · 16d ago | Vedantaa Institute of Medical Sciences (VIMS) is a private Indian medical education institution and hospital operated un... |
meccahighfeed.blogspot.com tracker page ↗ | krybitfilter this group | · 16d ago | مصنع مكة وهاي فيد للأعلاف (Mecca High Feed Factory) is an Egyptian animal feed manufacturing compan... |
transportesmontejo.com tracker page ↗ | krybitfilter this group | · 16d ago | Transportes Montejo S.A.S. is a Colombian specialized heavy transport and logistics company established on June 7, 1988,... |
southsign.in tracker page ↗ | krybitfilter this group | · 16d ago | Southsign Technologies is an Indian proprietor firm established in 2021, headquartered in Dindigul, Tamil Nadu, India, o... |
hccd-construction.com tracker page ↗ | krybitfilter this group | · 16d ago | The Holding Company for Construction and Development (HCCD) is an Egyptian public holding company (Egyptian Holding Stoc... |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.