Incidents
Ransomware leak-site victims (RansomLook), confirmed breaches (Have I Been Pwned) and AI-written profiles of the most active groups
Leak-site victims · 7d
183
Leak-site victims · 30d
1K
Active groups · 30d
778 new
Most active · 7d
the gentlemen
Breaches added · 30d
9
Accounts exposed · 30d
36.8MHIBP
Ransomware & extortion groups · activityleak-site posts · 90-day window · click a group for its profile
| # | Group | 7d | trend | 30d | 90d | all-time* | Last post | Status | Estimated earnings (public reporting) |
|---|---|---|---|---|---|---|---|---|---|
| 1 | the gentlemen | 30 | ▲6 | 155 | 401 | 401 | active | no public figure | |
| 2 | qilin | 23 | ▲9 | 117 | 361 | 361 | active | no public figure | |
| 3 | krybit | 13 | ▲13 | 47 | 96 | 96 | active | no public figure | |
| 4 | storm | 4 | ▼36 | 44 | 56 | 56 | active | no public figure | |
| 5 | akira | 9 | = | 43 | 86 | 86 | active | Approximately $42 million in ransom proceeds as of March 2024; no comprehensive public estimate since. | |
| 6 | direwolf | 3 | ▼8 | 41 | 62 | 62 | active | no public figure | |
| 7 | coinbase cartel | 0 | = | 37 | 56 | 56 | active | no public figure | |
| 8 | inc ransom | 8 | ▲3 | 36 | 112 | 112 | active | no public figure | |
| 9 | lockbit5 | 4 | ▼4 | 27 | 53 | 53 | active | Over US$120 million in ransom payments received, per U.S. DOJ and UK NCA Operation Cronos announcement (February 2024). Earnings attributable to the LockBit… | |
| 10 | audit team | 11 | ▲2 | 23 | 25 | 25 | active | no public figure | |
| 11 | safepay | 10 | = | 22 | 67 | 67 | active | no public figure | |
| 12 | leakeddata | 0 | ▼4 | 20 | 38 | 38 | active | no public figure | |
| 13 | orova | 0 | = | 19 | 44 | 44 | active | no public figure | |
| 14 | zawoo | 0 | = | 19 | 19 | 19 | active | no public figure | |
| 15 | emperador | 5 | = | 18 | 22 | 22 | active | no public figure | |
| 16 | kazu | 0 | ▼17 | 17 | 17 | 17 | active | no public figure | |
| 17 | shinyhunters | 2 | ▼1 | 15 | 32 | 32 | active | no public figure | |
| 18 | vexy | 4 | ▼5 | 15 | 15 | 15 | active | no public figure | |
| 19 | panzer | 7 | ▲5 | 14 | 25 | 25 | active | no public figure | |
| 20 | black nevas | 1 | ▼12 | 14 | 14 | 14 | active | no public figure | |
| 21 | dragonforce | 3 | ▲1 | 12 | 71 | 71 | active | no public figure | |
| 22 | chaos | 4 | ▲2 | 12 | 34 | 34 | active | no public figure | |
| 23 | everest | 0 | ▼4 | 12 | 34 | 34 | active | no public figure | |
| 24 | pear | 1 | = | 12 | 23 | 23 | active | no public figure | |
| 25 | rhysida | 3 | ▲1 | 12 | 14 | 14 | active | no public figure |
*all-time = since this tracker started collecting leak-site posts. Earnings are estimates from public reporting (law enforcement, blockchain analytics), compiled by the model; treat as indicative.
Incidents2,828 records · full details
| Victim | Group / type | Discovered | Details |
|---|---|---|---|
southsign.in tracker page ↗ | krybitfilter this group | · 16d ago | Southsign Technologies is an Indian proprietor firm established in 2021, headquartered in Dindigul, Tamil Nadu, India, o... |
hccd-construction.com tracker page ↗ | krybitfilter this group | · 16d ago | The Holding Company for Construction and Development (HCCD) is an Egyptian public holding company (Egyptian Holding Stoc... |
Commission de la construction du Quebec tracker page ↗ | qilinfilter this group | · 16d ago | Government |
| Questel questel.com | breach | · 16d ago | 1.2M accounts · breached 2026-08-01 · Email addresses, Employers, Job titles, Names, Phone numbers, Physical addresses, Support tickets · In August 2026, the French intellectual property software and services company Questel was the target of a ShinyHunters "pay or leak" extortion campaign . The group subsequently published an extensive corpus of data they alleged was obtained from the company, largely comprising corporate contact information associated with sales leads, support cases and marketing activities, with 1.2M unique email addresses. The data also included names, employers and job titles, along with physical addresses and phone numbers. |
Rise UP tracker page ↗ | everestfilter this group | · 16d ago | 2 posts - 1h |
VIVOTEK tracker page ↗ | everestfilter this group | · 16d ago | 2 posts - 1h |
Italtel Peru tracker page ↗ | everestfilter this group | · 16d ago | 2 posts - 1h |
iwin tracker page ↗ | black xfilter this group | · 16d ago | This company is a manufacturer of car parts. We have obtained all of your company's technical data. (1TByte) If you do not contact us, all your data, including technical, sales, drawings, quality, logistics, and supply chain information, will be leaked. |
ahadandco.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 405,000(405k) documents and files of your company, with a total size of over 300 GB. This data contains a significant amount of banking information, as well as the pe... |
sago.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have approximately 56,000 (56k) documents and files belonging to your company, including data on business relationships with more than 800 clients; data on research participants... |
crmeyer.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 275,000(275k) documents and files of your company, with a total size of over 330 GB. The data includes a customer database (~250 customers) — the largest ones are:... |
ccsperfusion.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have approximately 306,000 (306k) documents and files belonging to your company, with a total size of over 200 GB. 160k files containing complete employee personnel files; 75k f... |
Inmac tracker page ↗ | qilinfilter this group | · 16d ago | Architecture, Engineering & Design |
icot.es tracker page ↗ | brain cipherfilter this group | · 16d ago | If you use this hosting service, we have some bad news for you. We'll soon be publishing more than 200 database backups that belong to you. Demo download: h4zmek6bf3lebauy7dtyxmui6... |
aeiconsultants.com tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 35,000(35k) documents and files of your company, with a total size of over 55 GB. The data includes: Personal Data, Real Estate Data, Internal Security/HR, Infrastruc... |
syc.es tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 57,000(57k) documents and files of your company, with a total size of over 40 GB. Contents: Personal data of thousands of candidates for top positions; Data on the fi... |
Adviesbureau De Beuckelaer BV tracker page ↗ | brain cipherfilter this group | · 16d ago | We have about 415,000(415k) documents and files of your company, with a total size of over 150 GB. Virtually all data falls under the protected category: 1) Financial data for more... |
Nutex Health tracker page ↗ | the gentlemenfilter this group | · 16d ago | nutexhealth.com zoominfo.com/c/nutex-health-inc/372032478 (NUTX, Nasdaq) — US healthcare company, based in Houston, Texas, founded in 2011 by Dr. Thomas Vo. It runs 27 small "micro-hospitals" in 12 states — small hospitals with full 24/7 emergency rooms. Model: fast, cheaper ER care between urgent care and giant hospitals; most revenue comes from Texas. Q2 2026: net income $65.8M (vs loss a year ago), EBITDA $90M, cash $205M, debt only $31M. Profit exploded because it wins 85%+ of insurance arbitrations (IDR) and got paid at higher out-of-network rates. Plans: 7 new hospitals by 2027 plus two share buyback programs. Main risk: the whole profit engine depends on the arbitration system — new regulation could cut it. Cheap-looking: P/E around 6, but volatile small-cap with thin analyst coverage. |
The Sole tracker page ↗ | the gentlemenfilter this group | · 16d ago | thesole.com zoominfo.com/c/the-sole-proprietor/94159619 The Sole Supplier — UK sneaker and streetwear platform, founded in 2013 by George Sullivan in London. Started as a £100 blog in his parents' house — no investors, fully bootstrapped for 12+ years. Model: media content (release dates, reviews) + affiliate links to 50+ retailers — earns commission, holds no stock. Works with 30+ brands including Nike, adidas, UGG, Dr. Martens; claims to be Nike's top UK media partner. Scale: 4.5M monthly users, £400M+ lifetime sales driven for brands, with only ~35 staff. In 2026 relaunched its app as a "micro-social" shopping community for sneaker culture. Risks: thin margins, UK-only focus, and dependence on affiliate rates and brand budgets. |
Easyoga tracker page ↗ | nightspirefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
Truckworx tracker page ↗ | nightspirefilter this group | · 16d ago | No details on the leak post beyond the victim name. |
R L Fine Chem Pvt. Ltd. tracker page ↗ | global secret groupfilter this group | · 16d ago | Country: BANGALORE, Karnataka, India | Website: rlfinechem.com | Revenue: $54.3 Million | Industry: Pharmaceutical Manufacturing | Employees: 500-1000 | Properties: 18.6 GB (14,155 Files, 2,840 Folders) |
ASYS Corporation tracker page ↗ | orovafilter this group | · 16d ago | ASYS has been dedicated to providing instrument agency services for semiconductor technology factories and developing services such as facility system integration engineering. With years of technical accumulation, we have also successfully developed proprietary products, including yield improvement equipment and industrial IoT-related sensors. |
Fu Sheng Industrial Co., Ltd tracker page ↗ | orovafilter this group | · 16d ago | The company was initially built from the ground up, and it overcame daunting challenges to gain a foothold in Taiwan, where it specialized in overhauling all types of air compressors made in European countries, the United States of America, and Japan. |
Super Systems Inc tracker page ↗ | interlockfilter this group | · 16d ago | https://supersystems.com/ Super Systems, Inc. develops and manufactures products for the heating industry. However, it is extremely negligent in its own security and that of its customers, resulting in data breaches. You can view documents revealing confidential control schemes and vulnerabilities in customer systems, SSi's entire client portfolio, and confidential financial information about outstanding customer accounts, which undermines trust and damages the company's reputation. You are also provided with a list of over 500 customers with their contact information and price lists for products and services. You are also provided with SSi's intellectual property, a full suite of software for process control, data collection, analysis, and product tracking. |
CareerSource Palm Beach County tracker page ↗ | the gentlemenfilter this group | · 17d ago | www.careersourcepbc.com https://www.zoominfo.com/c/careersource-palm-beach-county/359202628 Headquartered in West Palm Beach Florida. CareerSource Palm Beach County is a nonprofit organization chartered by the state to lead workforce development in the United States. |
Allied Recycling tracker page ↗ | qilinfilter this group | · 17d ago | Energy, Utilities & Waste |
FFKR Architects tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
New Century Ophthalmology Group tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Hayward Holdings tracker page ↗ | falconfilter this group | · 17d ago | 561 GB compressed · 848 GB uncompressed |
zenithtechnology.co.nz tracker page ↗ | zawoofilter this group | · 17d ago | country: New Zealand | fileSize: 72009692411 | PUBLISHED | Zenith Technology Corporation Limited (ZenTech) is a New Zealand-based Contract Research Organisation (CRO) headquartered in Dunedin, New Zealand. The company was incorporated in 1987 and specializes in clinical research and pharmaceutical analytical services for the international pharmaceutical industry. |
fes-sport.de tracker page ↗ | zawoofilter this group | · 17d ago | country: German | fileSize: 49760098079 | PUBLISHED | FES Sport (fes-sport.de) is the Institut für Forschung und Entwicklung von Sportgeräten (FES), a German institute specializing in research, engineering, and development of high-performance sports equipment and technology. It is based in Berlin, Germany, with an additional facility in Oberhof. |
esopartnerscpa.com tracker page ↗ | zawoofilter this group | · 17d ago | country: USA | fileSize: 90147829401 | PUBLISHED | ESOP Partners appears to be a specialized professional-services firm focused on Employee Stock Ownership Plans (ESOPs) rather than a general-purpose CPA firm. |
Cedar County Memorial Hospital tracker page ↗ | wallstreetfilter this group | · 17d ago | Cedar County Memorial Hospital is a community hospital providing emergency, inpatient, outpatient, diagnostic, surgical, and rehabilitation services. |
MEQ tracker page ↗ | playfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Figgins Family Wine Estates tracker page ↗ | playfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
KRC Machine Tool Solutions tracker page ↗ | playfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Meteor Group tracker page ↗ | playfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
svfcu.org tracker page ↗ | lockbit5filter this group | · 17d ago | Susquehanna Valley Federal Credit Union is a member-owned financial institution that offers a range... |
hoaattorneys.com tracker page ↗ | lockbit5filter this group | · 17d ago | For more than 40 years, Beaumont Tashjian has provided common interest developments with the legal e... |
Metro Tulsa Foot tracker page ↗ | insomniafilter this group | · 17d ago | A comprehensive foot and ankle treatment center with five locations in the Tulsa Metro area. They offer a range of services including treatment for common foot pains, deformities, and injuries, and provide same-day appointments for urgent needs. |
zummocorp.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
www.lichtvision.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
www.renorefractories.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
cimbsecurities.com tracker page ↗ | inc ransomfilter this group | · 17d ago | No details on the leak post beyond the victim name. |
Gale Credit Union tracker page ↗ | akirafilter this group | · 17d ago | Gale Credit Union offers a variety of financial products and services including loans, savings and checking accounts, and credit cards. Their intended clients are individuals and businesses residing or working in ten counties in Illinois.We will upload 50gb of corporate data soon. Employee personal information (passport, SSNs, DLs,credit cards and so on), clients and partners information, projects, financials, contracts andagreements and so on. |
KFZ-MEISTERBETRIEB JOST GmbH tracker page ↗ | akirafilter this group | · 17d ago | KFZ-MEISTERBETRIEB JOST GmbH specializes in the repair and maintenance of all types of motor vehicles. The company offers comprehensive services in the maintenance, repair, and sale of motorvehicles.We will upload 6gb of corporate data soon. Employee personal information, clients information, financials and so on. |
Ishbia & Gagleard, P.C. tracker page ↗ | aurorafilter this group | · 17d ago | Ishbia & Gagleard, P.C. — a boutique law firm in Birmingham, Michigan, founded in 1999 by Jeffrey A. Ishbia and Michael A. Gagleard. The firm practises real estate, corporate, estate planning, personal injury, medical malpractice, and commercial litigation for high-net-worth individuals and closely held entities. The exposed material includes: 360+ client/matter folders — the complete attorney-client privilege corpus: litigation strategy memos, settlement agreements, case assessments, deposition notes, correspondence with opposing counsel. Full Social Security Numbers for 25+ identified individuals — trust beneficiaries, family members, employees of client businesses, and a scanned Social Security card. Protected Health Information — hospital admission records from Oakwood Hospital, University of Michigan Hospital, and William Beaumont Hospital. Also: 55+ employee files from a sexual health clinic client with SSN searches and scanned SS cards. 100+ client tax returns spanning 2003–2024, each containing SSNs, EINs, and income data. 11 email archive files (PST/OST) containing years of unfiltered attorney correspondence. Personal legal matters of Mat Ishbia — CEO of publicly-traded UWM Holdings Corp. (NYSE: UWMC), the largest wholesale mortgage lender in the United States. |
WEMS tracker page ↗ | akirafilter this group | · 17d ago | WEMS Electronics is a full-service turn-key small business specializing in state-of-the-art EMIcustom filters, engineering, and manufacturing services. The company offers a completely integrated approach to the design and fabrication of precision electronic components, assemblies, and subsystems.We will upload 51gb of corporate data soon. Employee personal information, client information, lots of confidential HR files, projects, financials, projects, contrast and agreements, NDAs and so on. |
Saudi Consulting Services SAUD CONSULT tracker page ↗ | the gentlemenfilter this group | · 17d ago | saudconsult.com zoominfo.com/c/saudi-consulting-services---saud-consult/348812396 SaudConsult — Saudi Arabia's oldest and largest privately owned engineering consultancy, founded in 1965 by Eng. Dr. Tarek M. A. Al Shawaf. The first Saudi engineering consulting firm — 100% Saudi privately owned, headquartered in Riyadh with branches in Jeddah, Khobar, Medina, Abha, plus offices in Bahrain and Egypt. Employs 2,800+ professionals (engineers, architects, designers); completed 3,500+ projects over six decades. Full-cycle services: feasibility studies, design, project management, construction supervision, procurement, commissioning, O&M. Sectors: infrastructure, oil & gas (clients include Saudi Aramco, SABIC, SADARA, MAADEN), power, hospitals, airports, defense & aviation, master planning. Actively participates in Saudi Vision 2030; in 2026 formed a partnership with Canada's Dokainish & Company for full EPCM capability. |
EP Manufacturing Bhd tracker page ↗ | the gentlemenfilter this group | · 17d ago | epmb.com.my zoominfo.com/c/ep-manufacturing-bhd/372140192 EPMB (7773, Bursa Malaysia) — Malaysian auto manufacturer, operating since 1982. Formerly made parts for Proton, Perodua, Honda, Toyota. Now assembles complete cars in Melaka for Chinese brands: GWM, BAIC, XPENG, MG. Capacity raised to 30,000 vehicles/year; in 2026 output exceeds 1,000 cars/month. Q2 2026: net profit RM5.15m (19× up), revenue RM212.7m (+67%) — 10-year record. Share price ~RM0.44, market cap ~RM125m, dividend ~1.2%; risks — debt and low liquidity. |
Me*** tracker page ↗ | crypto24filter this group | · 17d ago | No details on the leak post beyond the victim name. |
bartelsbv.nl tracker page ↗ | lockbit5filter this group | · 17d ago | Bartels BV is reeds 40 jaar een toonaangevend bedrijf op het gebied van metalen gevels, daken en lic... |
vkj.nl tracker page ↗ | lockbit5filter this group | · 17d ago | Van Kessel & Janssen begeleidt huisvestingsprojecten met deskundig advies en projectmanagement. Van... |
allsteelproducts.nl tracker page ↗ | lockbit5filter this group | · 17d ago | All Steel Products is a wholesale supplier specializing in hydraulic products, offering a wide range... |
bkc.org tracker page ↗ | lockbit5filter this group | · 17d ago | bkc.org and bethelclassical.org Mission Statement Bethel Classical Academy seeks to guide studen... |
Westwing Group SE tracker page ↗ | coinbase cartelfilter this group | · 17d ago | Furniture - $465.5 Million |
Directorate-General for Education tracker page ↗ | panzerfilter this group | · 17d ago | The Direção-Geral de Estatísticas da Educação e Ciência (DGEEC) is a Portuguese government agency responsible for collecting, analyzing, and publishing official statistics on education, science, and technology. |
Andover tracker page ↗ | wallstreetfilter this group | · 18d ago | The Town of Andover, Massachusetts, is a municipal government organization that provides public services, administration, community programs, education resources, infrastructure support, and civic information to residents and businesses in Andover. |
AFSARD tracker page ↗ | qilinfilter this group | · 18d ago | Finance |
Breach & ransomware newsAll →
Leak-site posts are claims by criminals and can be false or duplicated; victim names are shown as posted. HIBP entries are verified breaches with the affected account count. Dates are when the post or breach was first observed, not when the intrusion happened.